PROHIBITED USE OF COVERED INFORMATION.

(a) An operator may not knowingly:

(1) engage in targeted advertising on any website, online service, online application, or mobile application if the target of the advertising is based on any information, including covered information and persistent unique identifiers, that the operator has acquired through the use of the operator's website, online service, online application, or mobile application for a school purpose;

(2) use information, including persistent unique identifiers, created or gathered by the operator's website, online service, online application, or mobile application, to create a profile about a student unless the profile is created for a school purpose; or

(3) except as provided by Subsection (c), sell or rent any student's covered information.

(b) For purposes of Subsection (a)(2), the collection and retention of account information by an operator that remains under the control of the student, the student's parent, or the campus or district is not an attempt to create a profile by the operator.

(c) Subsection (a)(3) does not apply to:

(1) the purchase, merger, or any other type of acquisition of an operator by another entity, if the operator or successor entity complies with this subchapter regarding previously acquired student information; or

(2) a national assessment provider if the provider secures the express affirmative consent of the student or the student's parent, given in response to clear and conspicuous notice, and if the information is used solely to provide access to employment, educational scholarships, financial aid, or postsecondary educational opportunities.