Washington Student Data Privacy: RCW 28A.604 and the Public Records Problem
Washington is the state where the two halves of a communications compliance review pull in opposite directions. The student user privacy provisions push toward holding less and disclosing less. The Public Records Act pushes toward being able to produce anything, quickly, on request. A message log sits precisely on that seam.
| Artefact | Student privacy posture | Records posture | The practical rule |
|---|---|---|---|
| District-wide closure robocall script | No student PII | Almost certainly disclosable | Write it assuming publication |
| Attendance letter naming a student | Protected student information | Education-record exemptions engage | Retrievable internally, exempt externally — know which |
| Send log: who received what, when | Student-linked | Likely responsive, likely partly exempt | The redaction burden is yours; make the log exportable |
| Guardian phone and language of record | Protected | Exempt in substance | Never in a bulk response without review |
| Staff text from a personal phone about school business | Depends on content | Generally a district record wherever it lives | The reason to give staff a logged channel |
| Translation of a message into Spanish | Same posture as the original | Same posture as the original | Translations are copies, not new documents |
| Delivery failure report | Student-linked in aggregate | Often responsive to an operational request | Useful, and usually producible without PII |
Postures are general orientations, not determinations. Every records request is decided on its own facts by your public records officer with counsel. The column that is always true is the last one.
What the student privacy provisions require
Washington's student user privacy provisions, at RCW 28A.604, follow the SOPIPA drafting family. They reach operators of sites, services and applications designed and marketed for K-12 school purposes, and they prohibit the familiar set: targeted advertising based on covered information, non-educational profiling, and the sale of student information. They require reasonable security practices and deletion of student information at the district's request.
For a communications platform the interesting question is scope of holding rather than scope of use. These statutes are largely about what a vendor may do with data. Washington districts, because of the records regime, also need to think hard about what a vendor keeps and for how long, because everything kept is potentially producible and everything producible is a redaction cost.
That argues for two things in a contract: a retention schedule that is actually stated per record class rather than described as “as long as necessary”, and an export capability good enough to answer a records request without a support ticket. We can offer you the first — retention defaults are published per record class. On the second we will be honest: Kastr's export is a contract right under clause 7.1, and self-serve export tooling is not built yet. For a Washington district with a heavy records load, that is a real limitation and you should weigh it against vendors who have shipped the tool.
The public records half, which is where districts actually get hurt
Washington's Public Records Act is broad, its exemptions are specific rather than general, and the cost of a mishandled request is not theoretical. Three failure patterns recur in school communications.
- Records that exist nowhere retrievable. A principal texting families from a personal phone has created district records that the district cannot search. The fix is not a policy; it is a channel that is easier than the phone.
- Over-disclosure under time pressure. A bulk export of a send log, produced quickly, containing guardian phone numbers and home languages, is a privacy incident dressed as compliance. Build the review step into the process before the request arrives.
- Under-disclosure by ignorance of the system. Staff who do not know a platform retains something will not search it. Write down, once, exactly what your communications platform holds and for how long, and give that document to your records officer.
See are school text messages public records for the general shape of this problem across states.
Language access, which Washington districts run into constantly
Washington's demographics mean multilingual communication is an everyday operational requirement rather than an occasional one, and the federal obligation to communicate with limited-English-proficient parents in a language they understand applies regardless of state law. That obligation is about meaningful access, not about a translate button.
The two failure modes are equally common. A district that translates the flyer but not the emergency text has translated the wrong thing. A district that machine-translates a legal notice and sends it unreviewed has created a document nobody has read in the language the family receives it in.
Kastr's translation is DeepL-powered, covering the languages DeepL supports, with a translation preview in the composer so a bilingual staff member can read the message in up to five languages before it is sent rather than after. We do not have a district glossary or a terminology override feature — that is on other vendors' feature lists and it is not on ours, because it does not exist in our code. And when no translation key is configured or a call fails, we pass the original text through and still record the target language, so your analytics do not silently show a translated send that never happened. See Title III and language access in K-12.
This page describes what a statute asks of a vendor. It is not legal advice, statutes are amended, and section numbering moves. Confirm the current text with your own counsel or your state education agency before you rely on any of it in a contract or a procurement file.
Questions people actually ask
What does RCW 28A.604 require of edtech vendors?
It follows the SOPIPA model: operators of services designed and marketed for K-12 school purposes may not sell student information, may not use it for targeted advertising, and may not build non-educational profiles. They must maintain reasonable security and delete student information at the district's request. Confirm current text before citing it in an agreement.
Are messages sent through a school platform public records in Washington?
Records about district business are generally subject to the Public Records Act, with education-record and other exemptions engaging depending on content. The practical consequence for communications is that your send log is likely responsive and partly exempt, which makes the redaction burden yours and makes exportability a procurement criterion rather than a nice-to-have.
Does a vendor's retention policy affect our records obligations?
Yes, in both directions. Data the vendor keeps may be producible; data the vendor has destroyed cannot be produced but may raise questions if it was destroyed while a request or a litigation hold was live. Get the retention schedule per record class in writing, and make sure your records officer has read it.
Do Washington districts have to translate emergency messages?
Federal language-access obligations apply to communications about a student's education, and an emergency notification is squarely within that. Translate the message that carries consequence, not only the newsletter, and have a human read the translation of anything with legal or safety weight before it goes out.
One price. Every feature. Locked for three years.
$3.50 per student per year under 5,000 students. No tiers, no add-on modules, no per-message fees. Published on the site because you should not have to book a call to learn a price.