Bus. & Prof. Code, § 22585.6

(a) A national assessment provider shall not knowingly do any of the following with respect to its administration of, or publishing or distributing the scores with respect to, a standardized test:

(1) (A) Except as provided in subparagraph (B), sell covered information.

(B) A national assessment provider may sell covered information if either of the following apply:

(i) The sale is incident to the purchase, merger, or other type of acquisition of a national assessment provider by another entity, if that entity complies with this chapter as if it were a national assessment provider.

(ii) (I) The sale is to colleges, universities, financial aid and scholarship agencies, government agencies, and organizations that offer educational, community involvement, extracurricular, and career opportunities products and services solely to provide access to employment, educational scholarships or financial aid, or educational opportunities.

(II) This clause applies only if the individual, or the individual’s parent or legal guardian, identified by the covered information expressly consented to the sale of the covered information.

(2) Disclose covered information to a third party, including, but not limited to, social media providers through cookies, pixels, or similar tracking technologies on the national assessment provider’s internet website.

(3) Disclose covered information unless any of the following is true:

(A) (i) The disclosure is made in furtherance of the purposes of the standardized test, including, but not limited to, disclosure to postsecondary institutions, scholarship providers, or government agencies for the purpose of an individual’s admission, course credit, or placement in an institution or facilitating an individual’s eligibility for recognition, a scholarship, or financial aid.

(ii) This subparagraph applies only if the individual identified by the covered information expressly consented to the disclosure, and the recipient of the covered information agreed not to further disclose the information without the consent of the individual or as required by law.

(B) The disclosure is made to ensure legal and regulatory compliance.

(C) The disclosure is made to respond to, or participate in, judicial process.

(D) The disclosure is made to protect personal safety or the safety of others.

(E) The disclosure is made to a service provider if a national assessment provider contractually does all of the following:

(i) Prohibits the service provider from using any covered information for a purpose other than providing the contracted service to, or on behalf of, the national assessment provider.

(ii) Prohibits the service provider from disclosing any covered information provided by the national assessment provider to other third parties.

(iii) Requires the service provider to implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and protect that information from unauthorized access, destruction, use, modification, or disclosure.

(F) The disclosure is made for legitimate research purposes required by state or federal law.

(G) The disclosure is made to a state or local educational agency, including a school or school district.

(H) The disclosure is made to a parent or legal guardian of the individual identified by the covered information if that individual is under the age of 18.

(b) This section does not prohibit a national assessment provider from using covered information for maintaining, developing, supporting, improving, or diagnosing the national assessment provider’s programs and services.

(c) A national assessment provider shall implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and protect that information from unauthorized access, destruction, use, modification, or disclosure.

(d) If there is a conflict between any other law, including the California Consumer Privacy Act of 2018 (Title 1.81.5 (commencing with Section 1798.100) of Part 4 of Division 3 of the Civil Code) and this chapter, the law that affords the greatest protection of the right of privacy shall control.