Colorado Student Data Transparency and Security: Contract Providers and On-Demand Providers
Colorado's student data statute does something no other state we are aware of does. It looks at the actual way software enters a school — sometimes through a procurement, sometimes through a teacher clicking accept on a Tuesday — and it writes different rules for each. If your district has a shadow-IT problem, and every district does, this is the statute that already anticipated it.
| Situation | Which category | What the district owes | What the provider owes |
|---|---|---|---|
| Board-approved platform, signed agreement, roster feed | Contract provider | Publish it; hold the contract; review the privacy terms | Full statutory duties, including deletion on request |
| Teacher signs up free, types in 28 student names | On-demand provider | Have a policy governing whether this is allowed at all | A published privacy policy, and the statutory prohibitions |
| Free tier of a product the district also contracts for | Depends on the instrument | Decide deliberately; do not let it drift | Whatever the instrument in force says |
| Pilot with real student data, no contract yet | A problem | Stop, and paper it before the data moves | — |
| Vendor engaged by a school PTO, not the district | Neither, and worse | Confirm no student records are flowing through it | — |
| Sub-processor of a contract provider | Reached through the contract | Require flow-down terms and a named list | Bound only as tightly as the prime contract binds it |
Category names are Colorado's; the situations and the recommended responses are ours. Confirm the current definitions in the Colorado Revised Statutes, Title 22, Article 16, before you build policy on this table.
What the statute asks for
Colorado's Student Data Transparency and Security Act sets out obligations for the state education department, for local education providers, and for the two provider categories above. The themes will be familiar from other states: no selling student personally identifiable information, no targeted advertising based on it, deletion at the district's request, a published privacy policy, and public transparency about who holds what.
The transparency piece is the one to plan for. Colorado expects local education providers to make information about their school service contract providers public, alongside the contracts themselves. Like Illinois, that turns your agreement into a document a parent may read. Unlike Illinois, Colorado pairs it with an explicit expectation that the district has a policy about the informal route as well.
Confirm the specifics — what must be posted, in what form and on what timeline — with the Colorado Department of Education, which publishes guidance for local education providers and maintains the state-level data inventory the Act contemplates.
Why the on-demand category matters for communications specifically
Communications is the single most common shadow-IT category in K-12, ahead of anything instructional. The reason is structural: a teacher who wants to reach a class of parents has an urgent need, a free consumer tool one search away, and no obvious reason to think of it as a data flow. Nobody sets out to create an unpapered disclosure of guardian contact details. It happens because the alternative was slower.
Two things follow.
- A policy that only forbids is a policy that will be ignored. The durable version pairs the prohibition with a supported route that is faster than the unsupported one, and names it.
- Delegation is the actual fix. If a teacher, a coach or a PTA volunteer can send to their own group inside the district's own system, the free tool loses its advantage. Kastr's group governance is built for this: a volunteer can post as the group and manage its membership without any district console access at all, and every group-identity post still records the true author person identifier underneath for audit. That is the shape of the answer to Colorado's on-demand category — make the sanctioned path the convenient one.
A quarterly reconciliation a Colorado district can actually run
The Act rewards an accurate public list, and lists decay. This takes about ninety minutes a quarter.
- Pull the roster export destinations. Every system your SIS or roster service pushes to. Not the systems you remember — the ones in the configuration.
- Pull the single sign-on or launcher tile list, if you have one. Tiles outlive contracts.
- Ask each building for tools in active use with student names in them. Ask for tools, not for violations, and you will get an honest list.
- Reconcile against the published contract provider list. Anything in the first three that is not in the fourth is either a missing contract or a missing publication.
- Decide each exception deliberately: paper it, publish it, or turn it off. Leaving it undecided is the only wrong answer.
What we cannot do for you here. Kastr resolves two audience types: specific people, and everyone in the district. There is no grade, school, class or bus-route targeting. For a Colorado district trying to pull a teacher off an unsanctioned tool by offering a sanctioned one, that matters — the teacher's real need is often “my class only”, and today that is served by saving an ad-hoc selection of specific people as a reusable audience preset rather than by picking a class. That works, and it is more manual than it should be. It is on the roadmap and it is not in the product.
This page describes what a statute asks of a vendor. It is not legal advice, statutes are amended, and section numbering moves. Confirm the current text with your own counsel or your state education agency before you rely on any of it in a contract or a procurement file.
Questions people actually ask
What is the difference between a contract provider and an on-demand provider in Colorado?
A school service contract provider is engaged under a contract with the local education provider. An on-demand provider is a service accepted under click-through terms, typically by an individual educator, with no district contract behind it. Colorado assigns different duties to each, which is unusual and useful, because it means the informal route is regulated rather than invisible.
Does Colorado require districts to publish their edtech contracts?
Colorado's transparency provisions expect local education providers to make information about their school service contract providers publicly available, along with the contracts. Confirm the precise posting requirements and timeline with the Colorado Department of Education, which publishes guidance for local education providers.
Can a Colorado teacher use a free classroom messaging app?
That is a district policy question the statute expects you to have answered. The Act contemplates on-demand providers as a real category rather than pretending they do not exist, which means the district should have a written position on when they may be used and what data may go into them — and, ideally, a sanctioned alternative that is faster.
Does Colorado require deletion of student data when a contract ends?
Deletion on the district's request is a recurring feature of these statutes, and end-of-contract handling belongs in the agreement regardless. Define the request route, the acknowledgement, what counts as complete, and how backups are treated, because the statutory language will not define those for you.
One price. Every feature. Locked for three years.
$3.50 per student per year under 5,000 students. No tiers, no add-on modules, no per-message fees. Published on the site because you should not have to book a call to learn a price.