Each panel below is a working miniature of a site that could run at this address: navigation, hero, product screen and proof numbers, followed by a plain note on how that business would position the name. All twenty stay on screen at all times; a lane simply marks its own. The domain sits in the browser bar of every one of them, whole and unbroken, because the name is the thing being sold.
01
It Is A Condition On A Cheque
The education records law is written to the Secretary, not to anyone else
GetMathGames
1232gno fundspolicy
Read the first words
The records law does
not tell a school what
to do. It tells the
Secretary what not to fund.
Almost every description of the federal student records law gets its grammar wrong, and the grammar is the whole thing. Both operative commands begin with the same four words, and they are addressed to a budget rather than to a school, a parent or a software company.
20 U.S.C. 1232g(a)(1)(A) AND 1232g(b)(1), UNITED STATES CODE 2023 EDITION · READ OCTOBER 4, 2026PRIMARY SOURCE
No funds shall be made available under any applicable program to any educational agency or institution which has a policy or practice of permitting the release of education records ... without the written consent of their parents1232g(b)(1), QUOTED TO ITS OPERATIVE CONDITION. THE ACCESS PROVISION AT (a)(1)(A) OPENS WITH THE SAME FOUR WORDS.
WHAT THAT STRUCTURE MEANSThe statute does not prohibit a disclosure. It conditions a payment. A school that releases a record has not broken a prohibition; it has given the Secretary a reason to stop funding it, and only if the release reflects a policy or practice rather than a single incident.A CONDITION
WHO IS COVEREDAn educational agency or institution, defined as any public or private agency or institution that is the recipient of funds under an applicable program. A software company is not one, and the regulation adds that the part does not apply merely because students receive non-monetary benefits.FUNDS RECIPIENTS
AND THE REMEDY, WHICH IS THE WHOLE MENUWithhold further payments, issue a complaint to compel compliance through a cease and desist order, or terminate eligibility to receive funding. There is no fine, no damages figure and no injunction in either the statute or the rule.THREE OPTIONS
CARD 02 IS WHY THAT ARCHITECTURE DECIDED A SUPREME COURT CASE. NOTHING ON THIS PAGE IS LEGAL ADVICE AND NOTHING HERE SAYS ANY SCHOOL, AGENCY OR COMPANY HAS COMPLIED OR FAILED TO.NOT ADVICE
1232gthe section
2operative commands
4words they both start with
How they position itEvery operator in this category has heard of the records law. The address that prints its first four words is the one a product counsel trusts.
02
Two Steps Removed
The Supreme Court held the grammar decides it, and said so in those words
GetMathGames
20021983no rights
Read the holding
Because the statute
speaks to the Secretary,
the Court held it confers
no right anyone can sue on.
A student sued over a disclosure and the case reached the Supreme Court. The reasoning turned entirely on the structure described on card 01, and the Court used a phrase worth remembering because it explains the whole design.
GONZAGA UNIVERSITY v. DOE, 536 U.S. 273, DECIDED JUNE 20, 2002 · BOUND VOLUME READ OCTOBER 4, 2026PRIMARY SOURCE
We hold such an action foreclosed because the relevant provisions of FERPA create no personal rights to enforce under 42 U.S.C. 1983.THE HOLDING, AT 276, QUOTED.
FERPA's provisions speak only to the Secretary of Education, directing that "no funds shall be made available" to any "educational agency or institution" which has a prohibited "policy or practice." ... This focus is two steps removed from the interests of individual students and parentsAT 287, QUOTED. THE REASONING IS CARD 01'S GRAMMAR, APPLIED.
THREE LIMITS ON THAT HOLDING, EACH OF WHICH IS ROUTINELY DROPPEDIt concerns the nondisclosure provisions, not the access provisions. It concerns the section 1983 route specifically. And a footnote expressly declines to decide whether the statute's own procedures independently preclude private enforcement.READ IT EXACTLY
AND THE OTHER ROUTE, WHICH WAS ALREADY CLOSEDThe absence of a right of action directly under the statute was not this Court's holding. It was common ground below and comes from the circuits. The decision closed one door; the other was already shut.TWO DOORS
A WIDELY CIRCULATED CITATION FOR THIS CASE IS 534 U.S. 1103. THAT IS THE ORDER GRANTING REVIEW, NOT THE DECISION. THE OPINION IS AT 536 U.S. 273, AND WE READ THE BOUND VOLUME RATHER THAN A SUMMARY OF IT.WRONG CITATION IN CIRCULATION
2002the June it was decided
1983the section relied on
0personal rights found
How they position itA correctly stated holding, with its three limits, is a page a lawyer forwards. Nobody else in this category prints the footnote.
03
Under The Direct Control Of
How a school shares records with a supplier without asking any parent
GetMathGames
99.313 conditionsno consent
Read the test
There is an exception,
it needs no consent,
and it turns on four
words about records.
The most common statement in this whole area is that a school needs parental consent before giving a supplier student data. It is wrong, and the provision that makes it wrong is short enough to print whole.
34 C.F.R. 99.31(a)(1)(i)(B), CURRENT TEXT AS OF OCTOBER 1, 2026 · READ OCTOBER 4, 2026PRIMARY SOURCE
A contractor, consultant, volunteer, or other party to whom an agency or institution has outsourced institutional services or functions may be considered a school official under this paragraph provided that the outside party (1) Performs an institutional service or function for which the agency or institution would otherwise use employees; (2) Is under the direct control of the agency or institution with respect to the use and maintenance of education records; and (3) Is subject to the requirements of 99.33(a) governing the use and redisclosure of personally identifiable information from education records.QUOTED COMPLETE. THE LEAD-IN TO 99.31(a) IS THAT DISCLOSURE MAY BE MADE WITHOUT THE CONSENT REQUIRED BY 99.30.
WHAT DIRECT CONTROL IS NOTRead the qualifier. It is control with respect to the use and maintenance of education records, not control over the company. The rule specifies no audit right, no inspection right and no particular contract clause, and a reader looking for one will not find it here.NARROWER THAN IT SOUNDS
THE CONDITION THAT TRAVELS WITH THE DATACondition three pulls in the redisclosure rule: a recipient may not pass the information on without consent, and its officers, employees and agents may use the information, but only for the purposes for which the disclosure was made.PURPOSE-BOUND
AND THE PART THAT IS THE SCHOOL'S HOMEWORKThe exception is not self-executing. The school's annual notification must include a specification of criteria for determining who constitutes a school official and what constitutes a legitimate educational interest. Without published criteria the school has not set the exception up.NOT AUTOMATIC
99.31the exception
3conditions in the test
0parental consents required
How they position itCorrecting the single most repeated error in school software, with the rule printed whole, is the most linkable thing an address here can carry.
04
Once It Leaves, Nothing Follows It
One category of record carries no downstream restriction at all
GetMathGames
99.3799.33(c)none
Follow the switch
For one category the
rule that limits what a
recipient may do is
switched off entirely.
There is a class of student information a school may release with no consent at all, on nothing more than published notice. What happens to it afterwards is governed by a cross-reference most summaries never follow, and following it changes the answer completely.
34 C.F.R. 99.3, 99.31(a)(11), 99.33(c) AND 99.37 · ALL READ OCTOBER 4, 2026PRIMARY SOURCE
WHAT THE CATEGORY ISInformation in an education record that would not generally be considered harmful or an invasion of privacy if disclosed. The regulation's list is expressly open-ended and includes name, address, telephone listing, electronic mail address, photograph, date and place of birth, grade level, enrollment status and dates of attendance.OPEN-ENDED
HOW A PARENT STOPS ITThe school publishes notice; the parent must then notify the school in writing, within a window the school itself sets. It is opt-out, not opt-in, and silence is consent.OPT-OUT
AND THE CROSS-REFERENCE THAT DECIDES EVERYTHINGThe redisclosure and purpose-limitation rule begins by listing the disclosures it does not apply to, and the directory-information disclosure is on that list. So neither the no-further-disclosure condition nor the purpose limit attaches, and the school is relieved of even telling the recipient those requirements exist.SWITCHED OFF
THE ONE REAL QUALIFIER, AND WHO IT BINDSA school may specify that disclosure will be limited to specific parties or purposes, and if it does, it must keep to what it published. That is a constraint on the school's own disclosures, not a duty running to whoever received the data.BINDS THE SCHOOL
THE STATUTE'S OWN LIST OF THIS CATEGORY IS SHORTER THAN THE REGULATION'S AND CONTAINS NEITHER AN EMAIL ADDRESS NOR A PHOTOGRAPH. QUOTING THE STATUTE ALONE UNDERSTATES WHAT THE CATEGORY REACHES, AND THIS CARD USES THE REGULATION BECAUSE IT IS THE OPERATIVE ONE.USE THE REGULATION
99.3where it is defined
0use limits on the recipient
1cross-reference that does it
How they position itA structural finding this specific, reached by following one cross-reference, is exactly what makes a reference address worth linking to.
05
Five Years Away From The Data
The one sanction in the records regime that lands on a supplier
GetMathGames
99.675 yearsnot a fine
Read the bar
No fine reaches a
supplier. One thing does,
and it is worse than
a fine for a product.
The records regime is built around a funding condition on schools, which is why it is usually described as having nothing to say to a software company. There is one provision that reaches one directly, and it is not a penalty. It is a disqualification.
20 U.S.C. 1232g(b)(4)(B) AND 34 C.F.R. 99.67(c) TO (e) · READ OCTOBER 4, 2026PRIMARY SOURCE
[the school] may not allow the third party found to be responsible for the violation access to personally identifiable information from education records for at least five years.THE CONSEQUENCE OF AN IMPROPER REDISCLOSURE FINDING, QUOTED. THE BRACKETED SUBJECT IS THE ORIGINATING SCHOOL.
WHY IT IS SHARPER THAN A PENALTYIt does not take money. It takes the customer's data away from the product for half a decade, which for a service built on that data is the same as taking the customer.THE CUSTOMER
AND WHAT IS NOT THERENo civil penalty provision exists in the statute or the rule. Figures circulate for fines under this regime and there are none to find; the Secretary's menu is withholding payments, a cease and desist order, or terminating eligibility.NO FINE EXISTS
HAS A SCHOOL EVER ACTUALLY LOST ITS FUNDING OVER THISWe could not establish it in either direction. The Department's own 2018 enforcement guidance says it will withhold funds only where an institution is unwilling or unable to come into voluntary compliance. An Inspector General audit of the Department's enforcement of this regime was closed in 2022 without a report because the evidence obtained was not sufficient to answer the objective. We print no count.NOT ESTABLISHED
5years, the access bar
0dollars of penalty available
1provision reaching a supplier
How they position itThe five-year bar is the fact a product team needs and almost nobody states. Printing it, with the enforcement question left open, is the credible version.
06
The Same Eight, Printed Twice
One list, two subsections, two completely different legal operations
GetMathGames
1232h(b)(c)
Read both
Eight categories appear
twice in one statute.
One needs consent. The
other needs a policy.
There is a second federal education statute almost nobody in this market has read, and it contains a list of eight sensitive topics. The list appears twice, and the two appearances do entirely different things. Citing the wrong one is the most common mistake made with it.
20 U.S.C. 1232h(b) AND 1232h(c)(1)(B), UNITED STATES CODE 2023 EDITION · READ OCTOBER 4, 2026PRIMARY SOURCE
1Political affiliations or beliefs of the student or the student's parent
2Mental or psychological problems of the student or the student's family
3Sex behavior or attitudes
4Illegal, anti-social, self-incriminating, or demeaning behavior
5Critical appraisals of other individuals with whom respondents have close family relationships
6Legally recognized privileged or analogous relationships, such as those of lawyers, physicians, and ministers
7Religious practices, affiliations, or beliefs of the student or student's parent
8Income, other than that required by law to determine eligibility for a program or financial assistance
WHERE IT IS A PROHIBITION(b)NO STUDENT SHALL BE REQUIRED TO SUBMIT TO SUCH A SURVEY WITHOUT PRIOR WRITTEN PARENTAL CONSENT. OPT-IN.
WHERE IT IS A PROCESS(c)THE SAME EIGHT FEED A POLICY, NOTICE AND OPT-OUT REGIME INSTEAD. NO CONSENT REQUIRED.
IDENTICAL LISTS, OPPOSITE MECHANICS. CITING THE PROHIBITION FOR A SITUATION GOVERNED BY THE PROCESS, OR THE REVERSE, IS WRONG, AND IT IS THE ERROR THIS CARD EXISTS TO PREVENT.DO NOT CONFLATE
8categories in the list
2places it appears
2different legal operations
How they position itA statute this consequential and this unread is a content position nobody in the category has taken.
07
A Policy, Not A Consent
What the marketing provision actually requires, which is less than everyone says
GetMathGames
(c)(1)(E)policyopt-out
Read the duty
It does not prohibit
collecting for marketing.
It requires somebody
to have a policy about it.
The provision people reach for when they want to say student data cannot be collected for marketing says something quite different, and it imposes its duty on a party that is not the software company.
20 U.S.C. 1232h(c)(1)(E) AND 1232h(c)(2) · READ OCTOBER 4, 2026PRIMARY SOURCE
a local educational agency that receives funds under any applicable program shall develop and adopt policies, in consultation with parents, regarding ... the collection, disclosure, or use of personal information collected from students for the purpose of marketing or for selling that informationTHE LEAD-IN TO (c)(1) AND THE MARKETING ITEM AT (c)(1)(E), JOINED. THE VERB IS DEVELOP AND ADOPT POLICIES.
WHO THE DUTY FALLS ONA local educational agency, defined in the same section as an elementary school, secondary school, school district or local board of education that receives the funds, and expressly not a postsecondary institution. The duty never falls on a software publisher, at any point in the section.THE SCHOOL
WHAT THE PARENT GETSNotice of the policies at least annually at the start of the year and within a reasonable time after a substantive change, direct annual notice of the approximate dates such activities are scheduled, an opportunity to opt the student out, and a right to inspect the collection instrument before it is used.NOTICE AND OPT-OUT
AND THE DEFINITION THAT HOLLOWS IT OUT FOR SOFTWAREPersonal information in this section means first and last name, a home or other physical address, a telephone number, or a social security identification number. No email address. No device identifier. No persistent identifier. No behavioral or usage data. Most of what an application collects is outside the definition entirely.FOUR ITEMS
0consents required
1annual notice owed
1opt-out that must be offered
How they position itA definition written before the product existed, printed next to the product, is the clearest possible argument for an address that reads statutes.
08
For The Exclusive Purpose Of
The carve-out that was written for exactly this kind of product
GetMathGames
(c)(4)(A)exclusive6 examples
Read the hinge
The marketing item has
an exception, and the
whole exception turns
on one word.
Immediately after the marketing provision sits a carve-out naming the category this product is in. It is broadly drawn, its list is illustrative rather than closed, and a single adjective decides whether any given product is inside it.
20 U.S.C. 1232h(c)(4)(A) · READ OCTOBER 4, 2026PRIMARY SOURCE
Paragraph (1)(E) does not apply to the collection, disclosure, or use of personal information collected from students for the exclusive purpose of developing, evaluating, or providing educational products or services for, or to, students or educational institutions, such as the followingQUOTED TO ITS LIST. THE SIX EXAMPLES THAT FOLLOW INCLUDE CURRICULUM AND INSTRUCTIONAL MATERIALS, AND TESTS AND ASSESSMENTS.
THE HINGE, WHICH IS ONE ADJECTIVEExclusive. Collection for product development plus a marketing list is, on the face of the text, outside the exception. The word does the entire job and there is no partial version of it.EXCLUSIVE
WHAT IT DOES NOT EXEMPTOnly the marketing-policy item. The survey prohibition, the inspection rights and the notice duties elsewhere in the section are untouched by it.ONE ITEM ONLY
AND THE FLOOR CLAUSEThe same subsection provides that it shall not be construed to preempt applicable provisions of State law that require parental notification. This sets a floor and not a ceiling, which is what card 11 is about.A FLOOR
THIS CARD DOES NOT SAY THAT ANY PARTICULAR PRODUCT IS INSIDE OR OUTSIDE THE EXCEPTION, AND NOTHING ON THIS PAGE IS LEGAL ADVICE. IT PRINTS A CARVE-OUT AND IDENTIFIES THE WORD IT TURNS ON.NOT ADVICE
1item it exempts
6illustrative examples
1word that decides it
How they position itThe carve-out written for this exact category, with its hinge named, is the sentence a product lead needs and cannot find anywhere else.
09
Enforced The Same Way, Worded Differently
Two statutes, one remedial architecture, and a distinction worth keeping
GetMathGames
(e)same boarddifferent grammar
Compare the two
One is written as a bar
on funding. The other
is not. They are enforced
identically anyway.
These two statutes sit in the same part of the same chapter and are enforced through the same machinery, but their prohibitions are built differently. Getting that right matters because it is the difference between what a statute forbids and what it defunds.
20 U.S.C. 1232h(e) AND (f), BESIDE 1232g(f) AND (g) · BOTH READ OCTOBER 4, 2026PRIMARY SOURCE
THE RECORDS STATUTE1232gOPERATIVE CLAUSES PHRASED AS A BAR ON THE SECRETARY: NO FUNDS SHALL BE MADE AVAILABLE TO AN INSTITUTION WITH A PROHIBITED POLICY OR PRACTICE.
THE PUPIL RIGHTS STATUTE1232hONE CLAUSE PHRASED AS A BAR ON REQUIRING A STUDENT TO SUBMIT, AND ANOTHER AS A DUTY ON A FUNDS RECIPIENT TO ADOPT POLICIES.
The Secretary shall take such action as the Secretary determines appropriate to enforce this section, except that action to terminate assistance ... shall be taken only if the Secretary determines that there has been a failure to comply and that compliance cannot be secured by voluntary means.1232h(e), QUOTED. THE RECORDS STATUTE'S ENFORCEMENT CLAUSE READS ALMOST WORD FOR WORD THE SAME.
THE SHARED MACHINERYBoth are Secretary-administered. Both make termination of assistance available only after voluntary compliance has failed. Both require a dedicated office and review board inside the Department. And the part of the chapter they sit in is headed Records; Privacy; Limitation on Withholding Federal Funds.IDENTICAL
THE ACCURATE SENTENCEThe pupil rights statute reaches only federal funds recipients and is enforced the same way the records statute is, though its prohibitions are not worded as funding bars. Saying both are funding conditions is close enough to be tempting and wrong enough to matter.SAY IT PRECISELY
AND THEY STACKThe pupil rights statute states in terms that it does not supersede the records statute. Neither displaces the other.BOTH APPLY
1part of the chapter holding both
2different grammars
1remedial architecture
How they position itA distinction this fine, drawn correctly, is what separates a reference page from a summary of a summary.
10
Instructional Material Includes The Internet
A definition from 2001 that reaches a product from 2026, and one that does not
GetMathGames
(c)(6)(A)digitalexcluded
Read both halves
The definition reaches
digital material by name.
And then excludes the
thing that measures it.
A statute written before most of this market existed contains a definition that was updated to reach software, and the same definition carves something out. The combination produces a result that is easy to get backwards.
20 U.S.C. 1232h(c)(6)(A), DEFINITION OF INSTRUCTIONAL MATERIAL · READ OCTOBER 4, 2026PRIMARY SOURCE
WHAT IT REACHESInstructional material includes materials in electronic or digital formats, such as materials accessible through the Internet. The definition was not left in print-only terms, and a web-delivered product is inside it on the face of the words.INCLUDED BY NAME
AND WHAT IT EXPRESSLY DOES NOTIt does not include academic tests or academic assessments. So the practice material is instructional material and the measurement is not, which splits a single product in two for the purposes of the inspection right attached to the definition.EXCLUDED
WHY THAT MATTERS TO A PRODUCT RATHER THAN A LAWYERThe right the definition carries is a parent's right to inspect. A product that teaches and tests in one motion has one half of itself inside an inspection right and the other half outside it, and nothing in the statute tells anyone where the line falls in software.ONE PRODUCT, TWO HALVES
THIS PAGE DOES NOT SAY WHERE THAT LINE FALLS FOR ANY PARTICULAR PRODUCT, AND DOES NOT ADVISE ANYONE. IT PRINTS A DEFINITION, ITS EXCLUSION, AND THE QUESTION THE PAIR LEAVES OPEN.QUESTION LEFT OPEN
1definition
1inclusion by name
1express exclusion
How they position itShowing where a statute runs out, rather than pretending it does not, is the credibility this category is missing.
11
Nobody Official Counts Them
We went looking for how many states have one, and found no authority publishing a number
GetMathGames
countnot publishedadvocacy
See where we looked
Every figure for how
many states have one
comes from somebody
with a position.
A page in this category is expected to open with a number of states. We looked for one from a government source and could not find it. Reporting where we looked, and what we found instead, is more useful than the number would have been.
WHERE WE LOOKED FOR AN AUTHORITATIVE COUNT OF STATE STUDENT DATA PRIVACY LAWS · SEARCHED OCTOBER 4, 2026OUR SEARCH
01The congressional audit office's report on student data security. Read it. It is about breach incidents, not state law, and publishes no count.NOT THERE
02The Congressional Research Service's legal analysis of the federal records statute, updated June 5, 2026. Searched the full text for enactment counts. State law appears only in passing, on an unrelated question.NOT THERE
03The Department of Education and its student privacy office. No count published in any form we could locate.NOT THERE
04The national body that tracks state legislation. It publishes a consumer data privacy summary. We found no student data privacy enactment count.NOT THERE
-Every count in circulation traces to an advocacy organization or a commercial tracker. Those may well be accurate. They are not a government source, and this page's rule is that a number carries its source or it does not appear.NO FIGURE
THIS CARD DOES NOT SAY THE CIRCULATING COUNTS ARE WRONG. IT SAYS WE COULD NOT SOURCE ONE TO AN AUTHORITY AND THEREFORE PRINT NONE. CARD 12 TAKES ONE SPECIFIC STATE STATUTE AND READS IT INSTEAD, WHICH IS WHAT WE COULD ACTUALLY VERIFY.ABSENCE, NOT A CLAIM
0official counts located
4places we looked
0figures printed here
How they position itOpening with the number everyone expects, and explaining why it is absent, is the most credible first move available in this category.
12
Three Conditions, All Of Them Cumulative
The state statute everyone cites, and the definition that decides who it catches
GetMathGames
22584actual knowledgeand
Read the definition
It binds an operator
who knows, whose product
is used primarily, and
which was designed for it.
One state's student privacy statute is the one the whole market names. Whether it reaches a given product is settled by a single definition, and the definition is built out of three conditions joined by the word and.
CALIFORNIA BUSINESS AND PROFESSIONS CODE 22584(a)(7), AS AMENDED EFFECTIVE JANUARY 1, 2025 · READ FROM THE LEGISLATURE'S OWN SITE, OCTOBER 4, 2026PRIMARY SOURCE
Operator means the operator of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for K-12 school purposes and was designed and marketed for K-12 school purposes.QUOTED WHOLE. THE 3 UNDERLINED CONDITIONS ARE CUMULATIVE, AND THE CHAPTER BECAME OPERATIVE IN 2016.
WHO IT BINDS, AND WHO IT DOES NOTThe operator directly. Not the school, and not the app store. The statute says so about the store in terms: it imposes no duty on a provider of an electronic store, gateway or marketplace to review or enforce compliance on the applications it carries.THE OPERATOR
AND THE EXPRESS EXCLUSIONThe section does not apply to general audience websites, online services, online applications or mobile applications, even if login credentials created for a covered service may be used to access them.GENERAL AUDIENCE OUT
WHICH MAKES THE TEST A GO-TO-MARKET QUESTIONDesigned and marketed for school purposes. The same binary sold to parents and sold to districts gives different answers. The distinction is the marketing, not the code.NOT THE CODE
22584the section
3cumulative conditions
2016when it took effect
How they position itA definition that turns on how a product is sold rather than how it is built is the single most actionable thing a buyer in this category can be told.
13
Three Things It Simply Forbids
The prohibitions, which are unusually blunt for a privacy statute
GetMathGames
(b)3 bans1 carve-out
Read the bans
No targeted advertising.
No profile. No sale.
Three sentences, and
almost no qualifications.
Where most privacy law is built from notice and consent, this section is built from flat prohibitions. Reading them next to each other shows a legislature deciding that for this one product category, some things simply do not happen.
CALIFORNIA BUSINESS AND PROFESSIONS CODE 22584(b) · READ OCTOBER 4, 2026PRIMARY SOURCE
BAN 1 OF 3, ADVERTISINGEngage in targeted advertising on the service, or target advertising on any other service when the targeting is based upon any information, including covered information and persistent unique identifiers, that the operator has acquired because of the use of that service. The second half reaches advertising that happens somewhere else entirely.BOTH PLACES
BAN 2 OF 3, PROFILINGUse information, including persistent unique identifiers, created or gathered by the service, to amass a profile about a pupil, except in furtherance of K-12 school purposes.NO PROFILE
BAN 3 OF 3, SALESell a pupil's information, including covered information. One carve-out: a purchase, merger or acquisition of the operator, provided the successor remains subject to the section as to information already held.NO SALE
AND THE SAFE HARBORS, WHICH ARE WHAT MAKE THE PRODUCT POSSIBLE AT ALLThe prohibitions do not stop the operator using information for maintaining, developing, supporting, improving, or diagnosing the service. Deidentified covered information may be used to improve educational products and to demonstrate the effectiveness of the operator's products, including in their marketing. And the section does not limit using pupil data for adaptive learning or customized pupil learning purposes, which is the entire mechanic of the product this domain names.
THE STATUTE ALSO PERMITS MARKETING EDUCATIONAL PRODUCTS DIRECTLY TO PARENTS, SO LONG AS THE MARKETING DID NOT RESULT FROM COVERED INFORMATION OBTAINED THROUGH THE COVERED SERVICE.ONE ROUTE LEFT OPEN
3outright prohibitions
1carve-out, on one of them
5circumstances allowing disclosure
How they position itPrinting the bans and the safe harbors together is how an address here becomes the page a product team actually designs against.
14
And Nobody To Enforce It
We read the whole chapter looking for the enforcement clause
GetMathGames
2 sections0 penalties0 actions
Read what is missing
The chapter is two
sections long. The second
is one sentence. There
is nothing else in it.
Having read the prohibitions, the obvious question is what happens if an operator ignores them. We went looking for the answer in the statute and the answer is that the statute does not contain one.
CALIFORNIA BUSINESS AND PROFESSIONS CODE, CHAPTER 22.2, SECTIONS 22584 AND 22585, READ IN FULL · OCTOBER 4, 2026OUR READING
WHAT WE SEARCHED FOR AND DID NOT FINDNo enforcement provision. No civil penalty. No private right of action. No attorney fee provision. The second section of the chapter is 1 sentence setting the operative date, and there is nothing after it.NONE OF IT
THE TWO EXCLUSIONS IT DOES CONTAINIt imposes no duty on an electronic store, gateway or marketplace to review or enforce compliance, and it does the same for interactive computer service providers under the federal provision that protects them.STORES EXCLUDED
WHAT THIS PAGE WILL NOT DO WITH THATThere is an obvious argument that a violation feeds a general unfair competition claim, because of where in the code the section sits. We found no appellate decision resolving it and we are not going to infer one onto a page whose value is its sourcing. The printable fact is narrower and certain: the statute itself creates no private right of action.WE DO NOT INFER
THIS CARD DOES NOT SAY THE STATUTE IS UNENFORCEABLE OR THAT IT IS NOT ENFORCED. IT REPORTS WHAT TWO SECTIONS OF A CODE DO AND DO NOT CONTAIN, HAVING READ BOTH IN FULL.READ, NOT INFERRED
2sections in the chapter
1sentence in the second
0enforcement provisions
How they position itReading a two-section chapter to the end, and reporting the hole, is exactly the work nobody else in this category does.
15
A Floor, Not A Ceiling
The federal statute says in terms that the states may go further
GetMathGames
(c)(4)(B)no preemptionstack
Read the clause
The federal statute
declines to preempt.
So the layers stack
rather than replace.
A reasonable assumption is that a federal statute on a subject settles it. On this one the text says the opposite, in a clause most readers never reach, and the consequence is that a product faces the layers together rather than one at a time.
20 U.S.C. 1232h(c)(4)(B)(i) AND 1232h(c)(5)(A)(i) · READ OCTOBER 4, 2026PRIMARY SOURCE
[this subsection] shall not be construed to preempt applicable provisions of State law that require parental notification.1232h(c)(4)(B)(i), QUOTED. THE BRACKETED SUBJECT IS THE SUBSECTION CARRYING THE EDUCATIONAL-PRODUCTS CARVE-OUT ON CARD 08.
AND THE FEDERAL STATUTES DO NOT DISPLACE EACH OTHER EITHERThe pupil rights statute states that it does not supersede the records statute. Two federal statutes and a state one, none of which replaces another.ALL THREE
WHAT STACKING ACTUALLY MEANS FOR A PRODUCTThe question is never which regime applies. It is which regimes apply at once, and they answer to different bodies with different remedies: a funding condition administered by a Secretary, a second funding-adjacent duty on a school district, and a state prohibition with no enforcement clause in it.DIFFERENT BODIES
AND THE ONE THAT IS NOT LAW AT ALLCard 16 onward is the layer that is enforced fastest and is not a statute. It is a contract, and it is the only one of the four that can remove the product from distribution the same week.SEE CARD 16
1clause declining preemption
3layers that stack
0of them displacing another
How they position itFraming the question as which regimes apply at once, rather than which one applies, is the reframing that makes this address the reference.
16
Two Stores, Opposite Answers
The same product, the same question, two different rules
GetMathGames
gatepermitteddifferent
Compare the rules
One store bans buying
inside a kids app without
a gate. The other permits
it and regulates how.
The fastest-moving layer in this whole stack is not a statute and is not enforced by any agency. It is two companies' published rules, and on the question that matters most to a game with purchases in it, they do not agree.
ONE STORE'S REVIEW GUIDELINES, THE PAGE DATED JUNE 8, 2026; AND THE OTHER'S FAMILIES POLICY, WHICH PUBLISHES NO DATE · BOTH READ OCTOBER 4, 2026PLATFORM POLICY
STORE 1 OF 2, KIDS CATEGORYGATETHESE APPS MUST NOT INCLUDE LINKS OUT OF THE APP, PURCHASING OPPORTUNITIES, OR OTHER DISTRACTIONS TO KIDS UNLESS RESERVED FOR A DESIGNATED AREA BEHIND A PARENTAL GATE.
STORE 2 OF 2, FAMILIES POLICYRULESPURCHASES ARE PERMITTED, AND THE LISTED REQUIREMENT IS A CLARITY ONE: NOT PROVIDING A DISTINCTION BETWEEN THE USE OF VIRTUAL GAME COINS VERSUS REAL-LIFE MONEY TO MAKE IN-APP PURCHASES.
THE FIRST STORE ALSO LIMITS WHO ELSE IS IN THE APPKids Category apps may not send personally identifiable information or device information to third parties, and should not include third-party analytics or third-party advertising, with narrow relief for services that do not collect identifiers and for contextual advertising with documented human review of creatives.THIRD PARTIES OUT
THE SECOND STORE REGULATES THE ADVERTISING INSTEADAds shown to children or users of unknown age must come only from its self-certified advertising toolkits, must not involve interest-based advertising or remarketing, must be age-appropriate, and must follow its format rules. Mixed-audience apps must implement age screening measures, such as a neutral age screen.CERTIFIED ONLY
AND A ONE-WAY DOOR WORTH KNOWING BEFORE YOU WALK THROUGH ITOnce customers expect an app to follow the Kids Category requirements, it must continue to meet them in later updates, even if the developer deselects the category.NO WAY BACK
NEITHER OF THESE IS LAW AND NEITHER IS ENFORCED BY AN AGENCY. THEY ARE ENFORCED BY REMOVAL FROM DISTRIBUTION, WHICH IS WHY THEY ARE THE LAYER A PRODUCT MEETS FIRST. ONE OF THE TWO POLICIES CARRIES NO PUBLICATION DATE, AND THIS CARD SAYS SO RATHER THAN IMPLYING ONE.CONTRACT, NOT LAW
2published rulebooks
1that requires a gate
1that permits and regulates
How they position itTwo rulebooks disagreeing on the central question, printed side by side, is a comparison the category has never published.
17
Both Stores Make You Say Who It Is For
The one requirement both stores impose, and the right they both reserve
GetMathGames
ratingdeclarereviewed
Read both duties
Both stores make you
say who it is for. Both
reserve the right to
decide you were wrong.
Before any of the content rules apply, something has to establish who the product is aimed at, and that is done by the developer answering questions. Both stores require it, and both say plainly that they may form their own view.
BOTH STORES' PUBLISHED DEVELOPER POLICIES, PUBLICLY READABLE WITHOUT A DEVELOPER ACCOUNT · READ OCTOBER 4, 2026PLATFORM POLICY
THE FIRST STOREAnswer the age rating questions honestly so that your app aligns properly with parental controls. If the app is mis-rated, customers might be surprised by what they get, or it could trigger an inquiry from government regulators. Separately, metadata must suit all audiences: icons, screenshots and previews must meet the lowest age rating even where the app is rated higher.ONE QUESTIONNAIRE
THE SECOND STORE, WHICH ASKS TWICEA target audience declaration before publishing, and a separate content rating questionnaire. Its policy requires accurate answers in the target audience section, the data safety section and the rating questionnaire, and requires them to be updated when the app changes.TWO DECLARATIONS
AND THE RESERVED RIGHT, STATED IN TERMSThe second store reserves the right to conduct its own review of the app information that you provide to determine whether the target audience that you disclose is accurate, and warns that misrepresentation may result in removal or suspension. The first store's rules reach apps intended primarily for kids however they are categorised.DECLARING IS NOT DECIDING
A DEVELOPER DECLARING A GENERAL AUDIENCE HAS NOT THEREBY ESCAPED THE CHILDREN'S RULES AT EITHER STORE. THAT IS THE PRACTICAL POINT OF THIS CARD AND IT IS IN BOTH RULEBOOKS.NOT AN ESCAPE
2stores requiring a declaration
2separate declarations at one of them
2that reserve review
How they position itThe declaration is the first thing a new entrant does and the first thing they get wrong. An address that explains it owns the question.
18
The Cases Were About Billing
Three federal matters about children and purchases, and what they were actually pleaded as
GetMathGames
2014Section 5unfairness
Read the count
Three matters, one count
each, and the count is
not about children. It is
about who authorized
the charge.
When children run up purchases inside an app, there is a body of federal enforcement about it. What that enforcement was actually built on is routinely described wrongly, and the correct version reaches far more products than the wrong one.
THREE FEDERAL TRADE COMMISSION MATTERS, COMPLAINTS AND ORDERS READ DIRECTLY · OCTOBER 4, 2026PRIMARY SOURCE
1An administrative matter, complaint dated January 15, 2014. The consent agreement requires refunds of no less than $32,500,000. The mechanism pleaded: the account password was cached for fifteen minutes after entry, and it was not disclosed that entering it opened a window in which further charges could be incurred.$32.5M
2A second administrative matter, complaint dated September 4, 2014. The order requires refunds of no less than $19,000,000.$19M
3A matter that was litigated rather than settled, filed in federal district court on July 10, 2014. Refunds exceeded $70 million, and the agency's 2017 announcement states the parties agreed to end the litigation, which paved the way for the refund program to begin.$70M+
In numerous instances, [the respondent] bills parents and other account holders for children's activities in apps that are likely to be used by children without having obtained the account holders' express informed consent.THE CONDUCT PARAGRAPH, WHICH APPEARS IN NEARLY IDENTICAL WORDS IN ALL THREE COMPLAINTS. BRACKETS OURS.
AND WHY THE LEGAL THEORY IS THE WHOLE POINTEach complaint carries exactly one count, captioned unfair billing, pleading the unfairness provision of the general consumer protection statute. Not one of the three contains a children's privacy count. The theory is the billing relationship with the account holder, an adult. The child's presence supplies the foreseeability of an unauthorized charge; it is not the protected status. Which means these precedents reach a product that collects no data at all, so long as it bills.
3federal matters, all 2014
1count in each complaint
0of them a privacy count
How they position itA legal theory correctly identified, where the whole market has it backwards, is worth more than any single fact on the page.
19
A Parent Buys It At Home
Which of the four layers actually applies when no school is involved
GetMathGames
3 off2 onnot clear
Read the answer
Take the school away
and three layers fall off.
The two that remain are
the ones with real teeth.
The question this whole page builds toward. A parent buys a math game and installs it at home. No district, no classroom, no contract. Here is what still applies, taken one regime at a time, and what the removal does not clear.
EACH REGIME TAKEN IN TURN AGAINST ITS OWN TEXT · ALL READ OCTOBER 4, 2026PRIMARY SOURCE
THE RECORDS STATUTE, OFFTwo independent reasons. It regulates an educational agency or institution defined as a funds recipient, and a software company is not one. And there are no education records, which the statute defines as records maintained by such an institution or by a person acting for it. A vendor selling to a parent acts for the parent.DOES NOT APPLY
THE PUPIL RIGHTS STATUTE, OFFIts survey prohibition bites only on a survey administered as part of any applicable program, and its policy duties run to a local educational agency. It imposes no obligation on a software publisher at any time, in any setting.DOES NOT APPLY
THE STATE STATUTE, OFF, AND THIS IS THE EASY ONE TO TRIPIts definition needs the product to be used primarily for and designed and marketed for school purposes, and it expressly excludes general audience applications. But sell the same binary to districts, or let a teacher assign it, and the marketed prong is live again.UNTIL YOU SELL TO SCHOOLS
THE GENERAL CONSUMER PROTECTION STATUTE, ONNothing in the three matters on card 18 depended on a school or on the child's protected status. If the product bills, the unauthorized-charge theory applies on its own terms, and the design implication from the orders is express informed consent from the account holder before the charge, with no cached window that silently authorizes later ones.APPLIES
THE STORES, ON, AND FIRSTAn age rating is required either way. If the declared audience includes children, the content, advertising and purchasing rules follow, and both stores reserve the right to second-guess the declaration.APPLIES
REMOVING THE SCHOOL CLEARS THE EDUCATION-LAW LAYER AND NOTHING ELSE. THERE IS A FURTHER FEDERAL CHILDREN'S PRIVACY REGIME THAT THIS PAGE DOES NOT COVER AT ALL, AND BOTH STORE POLICIES REQUIRE COMPLIANCE WITH IT BY NAME AS A CONDITION OF DISTRIBUTION. ITS ABSENCE HERE IS A SCOPE DECISION, NOT A SUGGESTION THAT IT DOES NOT APPLY.SCOPE, NOT CLEARANCE
3layers that fall away
2that remain
1that can act this week
How they position itThis is the card the whole page exists for, and it is the answer every operator in this category needs and cannot find stated correctly.
20
What This Page Will Not Say
The claims we refused, published so they can be checked
GetMathGames
RefusedCheckable14
Hold us to it
Fourteen things
we would not
put in print.
Every figure here names its source and its date. These are the statements that could not be made that way, or that a page selling a domain name has no business making at all. They are published together so a buyer can hold us to the list.
THE FULL LIST, PUBLISHED SO IT CAN BE CHECKED AGAINST EVERY OTHER CARDREFUSED
01Any legal advice, and any statement about what any product, school or company should do. Every card that comes near one says so on its face.
02That any named or unnamed company, school or agency complies or fails to comply with anything. No company and no school is named anywhere on this page.
03Any count of states with a student data privacy law. Card 11 is the four places we looked and what we found instead.
04That the Department has or has never withdrawn funds over the records statute. We could not establish it in either direction, and card 05 says so.
05That the records statute provides for fines, or any penalty figure under it. It has no civil penalty provision at all.
06That a school needs parental consent before sharing records with a supplier. Card 03 is the exception that says otherwise, printed whole.
07That direct control means controlling the supplier, or implies an audit or inspection right. It is control over the use and maintenance of records and the rule specifies no clause.
08That recipients of directory information are bound by the records regime. Card 04 follows the cross-reference that switches those conditions off.
09That the pupil rights statute requires consent for marketing collection. It requires a policy, a notice and an opt-out, and the consent requirement is in a different subsection for a different thing.
10That the pupil rights statute protects student data from software companies. Its duties run to a school district, never to a publisher, and its definition of personal information contains four items, none of them digital.
11That the Supreme Court held the records statute has no private right of action. It held the nondisclosure provisions create no personal rights enforceable under one particular section, expressly declined to decide a related question, and the other route was already closed by the circuits.
12That a violation of the state statute supports a private claim through a general unfair competition theory. The argument is obvious from where the section sits in the code. We found no appellate decision resolving it and will not infer one.
13That removing the school clears the field. Card 19 is precise about which layers fall away and which do not, and names a regime this page does not cover.
14Any market size, growth rate, download count or search volume for this category, from any source. None appears anywhere on this page.
EVERY NUMBER ON THIS PAGE CARRIES ITS SOURCE AND ITS DATE, AND WHERE A FIGURE IS OUR OWN SEARCH RATHER THAN A PUBLISHED ONE, THE CARD THAT PRINTS IT SAYS SO.SOURCED OR ABSENT
14refused claims
0unsourced numbers
0sentences of legal advice
How they position itIn a category sold on reassurance, publishing the refusals is the whole differentiator.