Pennsylvania School Internet Safety Laws: Act 197, CIPA and What Comes Next
Pennsylvania is one of the states with its own Child Internet Protection Act. It reaches school entities whether or not they take E-Rate, so every district needs a filter-backed acceptable use policy.
Child Internet Protection Act (Act 197 of 2004)
- Signed
- November 2004
- Covers
- School entities and public libraries
- Core duty
- Acceptable use policy reasonably designed to block prohibited material
- Tools
- Blocking software or servers that block prohibited content
- Updated
- 2024 (SB 187), wording on child sexual abuse material
What federal CIPA requires in Pennsylvania
CIPA is a condition of E-Rate discounts for internet access and internal connections. If your district or library takes those discounts, it applies alongside Act 197. Our guide to what CIPA is covers the detail.
Technology protection measure
Block visual depictions that are obscene, child pornography or harmful to minors on computers used by minors.
Internet safety policy
Adopted after reasonable public notice and at least one public hearing or meeting, covering the five CIPA topics.
Monitoring and education
Monitor minors' online activity and teach appropriate online behavior, including social networking and cyberbullying awareness.
Two laws, one program
Most Pennsylvania districts answer to both CIPA and Act 197. Write one policy set that names both, so staff follow a single set of rules.
The board owns it
Both laws put the policy in the hands of the governing body. Technology staff configure the filter; the board adopts the rules it enforces.
Review every year
New sites, devices and AI tools appear constantly. An annual review keeps the policy "reasonably designed" in practice, not only on paper.
One filter for students, staff and every school-owned laptop
Act 197 asks a Pennsylvania board for a policy reasonably designed to stop prohibited material on school equipment, and that includes employees. Our hosted CIPA filter is a DNS filter we run for you, so the same category rules can be written into your policy and then applied across your buildings.
- Adult and VPN/Proxy/Anonymizers are on in the CIPA preset, which covers the bypass tools an auditor asks about
- Always-allow and always-block lists per school give your unblock reviewer a quick fix for a teacher's request
- Nothing is installed on the computers, and a take-home laptop keeps the rules through a private encrypted link
Act 197: Pennsylvania's Child Internet Protection Act
Act 197 was signed in November 2004 and sits in Title 24 of Purdon's Statutes, starting at 24 P.S. 4601. The school duties are mostly in section 4604. Here is what it asks of a school board, in our own words.
Adopt an acceptable use policy for the internet
Every school board must have an internet acceptable use policy. It is a state requirement, separate from the CIPA internet safety policy, though many districts combine the two.
Design it to block prohibited material
The policy must be reasonably designed to prevent students and employees from using school-owned equipment or services to access or transmit obscene material, child sexual abuse material or material harmful to minors.
Set consequences for willful violations
The policy must include appropriate measures against students and staff who willfully break it.
Offer expedited review of blocking claims
There must be a quick route to review and resolve a claim that the policy is denying access to material that is not prohibited. In practice, a fast unblock request process.
Enforce it with technology
Boards take the steps they consider appropriate, which can include software that blocks prohibited visual depictions or choosing online servers that block such content.
Give parents a copy on request
A school entity must provide its adopted acceptable use policy to a parent or guardian who asks in writing.
Federal CIPA and Pennsylvania Act 197 side by side
The two laws overlap heavily, but they are triggered differently and ask for slightly different things. A single well-built policy can satisfy both.
Federal CIPA
- Triggered by E-Rate discounts for internet access or internal connections.
- Requires a technology protection measure on computers.
- Internet safety policy with public notice and a hearing or meeting.
- Monitoring of minors and online safety education.
- Adult filter disabling allowed for bona fide research or other lawful purposes.
- Certified on Form 486 or Form 479.
Pennsylvania Act 197
- Applies to covered school entities by state law, E-Rate or not.
- Covers students and employees using school equipment or services.
- Acceptable use policy adopted by the school board.
- Penalties for willful violations written into the policy.
- Expedited review of claims of wrongful blocking.
- Copy to parents on written request.
Other Pennsylvania rules that affect school internet safety
Beyond Act 197, a few other state measures shape how Pennsylvania schools handle devices, alerts and data. Status labels reflect our last check in October 2026.
| Measure | Status | What it does | Why IT should care |
|---|---|---|---|
| Act 197 of 2004 | Law | State Child Internet Protection Act for schools and public libraries. | Drives the acceptable use policy and filtering. |
| SB 187 of 2024 | Law | Updated Act 197 terminology to child sexual abuse material. | Policy wording should match the current statute. |
| Act 44 of 2018 | Law | Created the Safe2Say Something anonymous reporting program run by the Office of Attorney General. | Every school entity has procedures for responding to tips; align them with filter and monitoring alerts. |
| SB 1014 (2025-26) | Passed Senate | Bell-to-bell restriction on personal devices, with exceptions; would apply by 2027-28. | Would move more student browsing onto district devices. |
| HB 1814 (2025-26) | Passed House | House companion bell-to-bell bill, passed in late May 2026. | Final text depends on the two chambers agreeing. |
Phones: watch this space
Both chambers passed bell-to-bell bills in 2026, and the Governor has backed the idea. At our last check no final bill had been signed, so treat it as pending.
Student data: FERPA first
We did not find a broad Pennsylvania statute governing edtech operators like those in some other states. FERPA, PPRA and your board's student records policy apply.
Safety tips and alerts
If your monitoring tool raises self-harm or threat alerts, route them through the same team that handles Safe2Say tips, so nothing falls between processes.
What Pennsylvania law means for web filtering and monitoring
Act 197 does not name categories, but its three prohibited types of material map cleanly onto a category-based filter. Local board choices then sit on top.
Staff policy too
Act 197 covers employees on school equipment, so staff need a policy that still blocks obscene and child sexual abuse material.
Fast unblock path
Give teachers a simple form, a target response time and a named reviewer. Log each decision.
Equipment off campus
The Act talks about school-owned equipment, which includes take-home laptops. Filter them on home networks too.
How the kinds of sites an Act 197 policy has to think about are labelled in our data
Act 197 names obscene material, child sexual abuse material and material harmful to minors, and a board also wants bypass tools handled. These are real lookups from our database, and a site can sit in more than one category.
| Site | Categories in our data | Where it fits a Pennsylvania policy |
|---|---|---|
| pornhub.com | Adult | The obscene-material side, blocked for students and employees |
| betmgm.com | Gambling | A harmful-to-minors choice for student groups |
| tinder.com | Dating, Social Networking | Two categories, so either switch reaches it |
| civitai.com | AI / LLM Tools, Arts & Entertainment | An image-generation site a board may hold back from students |
| midjourney.com | AI / LLM Tools | An AI image tool that a district can allow or block by choice |
| croxyproxy.com | VPN / Proxy / Anonymizers | A web proxy that needs no install, kept out by a category rule |
Libraries, charters and intermediate units
Pennsylvania has many kinds of education providers. The table below is a starting point for who should check what; confirm coverage with your solicitor.
| Organisation | Act 197 | Federal CIPA | Practical note |
|---|---|---|---|
| Public school districts | Covered as school entities | If taking E-Rate for internet | One board-adopted policy can meet both. |
| Charter and cyber charter schools | Check how the Act defines school entity | If taking E-Rate for internet | Cyber charters should look hard at filtering on home devices. |
| Intermediate units | Check the definition | Often via consortium or own applications | Shared networks need clear policy ownership. |
| Public libraries | Covered by the Act's library provisions | If taking E-Rate or certain LSTA funds | Plan adult unblocking and patron notices. |
| Private schools | Check the definition | If taking E-Rate for internet | Many follow CIPA voluntarily. |
For an easy-to-adapt template, read our guide to the acceptable use policy for schools and the CIPA internet safety policy.
Writing an Act 197 policy that holds up
A policy is "reasonably designed" when it is specific enough to act on. These building blocks turn the statute into something staff can follow and an auditor can check.
Scope statement
Name every network and device the policy covers: wired, wireless, guest, take-home and any district-paid hotspots. Say that it applies to students and employees.
Prohibited material defined
Use the statute's three types of material, with the 2024 wording, and point to the state definitions rather than writing your own.
Technology measures named
Say that the district uses category-based filtering and blocks bypass tools, without listing vendor settings that change often.
Review route with a clock
Describe how to ask for a review of a block, who decides and how quickly. Publish the form.
Consequences scale
Link willful violations to the student code of conduct and staff discipline policies so the penalties are consistent.
Parent access and annual review
State how parents get a copy and commit to reviewing the policy every year, with the date of the last review shown.
Pennsylvania scenarios: applying the rules
Short worked examples from the kind of requests Pennsylvania technology teams handle every week.
A teacher's research site is blocked
This is exactly what the expedited review covers. Check the site's categories, decide quickly, and log the request, the decision and the time taken.
A staff member wants filtering off
CIPA lets an authorised person disable the filter for an adult's bona fide research, but Act 197 still asks the policy to block prohibited material for employees. Keep adult categories blocked.
A parent writes in for the policy
Send the current acceptable use policy and note the date. The written request and your reply go in the evidence folder.
A cyber charter student browses at home
The school-owned laptop is still school equipment. A filter agent or DNS profile that works on any network is the practical answer.
A monitoring alert suggests self-harm
Route it through your threat and safety team, the same people who handle Safe2Say tips, and follow your written response procedure.
Students find an AI image tool
Check its category. Image generators that can make explicit images raise Act 197 concerns, so many districts block them for students and allow approved tools only.
Keeping take-home laptops inside the policy
Act 197 speaks of school equipment, so a cyber charter laptop on a kitchen table is still covered. A private encrypted link sends that laptop's lookups through the same rules as the building, and the filter decides by domain rather than by page.
Pennsylvania school internet safety compliance checklist
Run this each school year. The federal items are expanded in the CIPA compliance checklist.
Evidence to keep for Act 197 and E-Rate
Keep a folder per school year. Each item below answers a question an auditor, solicitor or parent is likely to ask.
Running an Act 197 policy with a hosted filter or without one
Each row is a job the policy puts on a Pennsylvania school entity, set beside how a hand-built setup and our hosted filter handle it.
| What the policy needs | Hand-kept lists and device settings | Hosted CIPA filter |
|---|---|---|
| Block prohibited material for students and employees | Two sets of lists that drift apart | Category switches per school, Adult on in the CIPA preset |
| A fast review of a wrongful block | A ticket and a manual edit of a list | Always-allow list per school, changed by the reviewer |
| Staff who research a blocked adult topic | Turn the filter off, then forget to turn it on | PIN bypass for 15, 30 or 60 minutes, logged, switches back |
| Bypass tools such as web proxies | A growing list of proxy sites | VPN/Proxy/Anonymizers blocked as a category, even with the PIN |
| Cyber charter and take-home laptops | Settings that stop at the school gate | Private encrypted link keeps the same rules away from the network |
| Proof for the evidence folder | Screenshots taken by hand | Activity reports, policy record and a log export |
Pennsylvania school internet safety FAQ
Does Pennsylvania have its own school internet filtering law?
Yes. Act 197 of 2004 requires school boards to adopt an acceptable use policy reasonably designed to stop students and employees using school equipment to reach obscene material, child sexual abuse material or material harmful to minors.
Does Act 197 apply to schools that do not take E-Rate?
Yes for the school entities it covers, because it is a state law. Federal CIPA only applies when E-Rate discounts for internet access or internal connections are taken.
Must Pennsylvania schools give parents a copy of the internet policy?
Yes, on written request. Posting the policy on your website as well saves time.
Does Act 197 cover teachers and staff?
Yes. The policy must be designed to prevent both students and employees from using school equipment to access or transmit prohibited material.
Has Pennsylvania passed a school phone ban?
The Senate passed SB 1014 and the House passed HB 1814 in 2026. At our last check, a final bill had not been signed. Check the General Assembly for the current status.
Does Pennsylvania require schools to block social media?
We found no state statute that requires it. Social media rules are a local board decision on top of Act 197 and CIPA.
Do Pennsylvania public libraries have to filter?
Act 197 includes provisions for public libraries, and many Pennsylvania library policies cite it as the reason they filter. Libraries taking E-Rate also follow CIPA, which allows adult unblocking for lawful purposes.
Read public library internet filtering policy for patron-facing rules.
Is this page legal advice?
No. It is a plain-language summary for school IT staff. Confirm with your solicitor, the Pennsylvania Department of Education and your E-Rate consultant.
Related state pages and guides
See all state guides on our school internet safety laws by state page.
A price depends on how many Pennsylvania schools and devices you need covered, and our quote arrives within one business day. Starting with one building lets your team read the blocks and reports before the whole entity follows.
Talk to us about your Pennsylvania district
We can show how category data covers Act 197 and CIPA material for students and staff, on campus and on take-home equipment.
Not legal advice. This page summarises Pennsylvania and federal law as we understand it in October 2026. Bills, statutes and guidance change; confirm with your solicitor and current official sources before acting.