Building for neurodiversity starts inside the company
Read blog Solution overview
See solutions side by side.What SB 930 Means for K-12 Proctoring
Starting July 1, 2027, proctoring for California K-12 classroom and course exams must be end-to-end encrypted.
What it requires- End-to-end encryption for proctored classroom and course exams
Who it covers- California school districts, county offices of education, and charter schools
Vendor access- None, including the proctoring company itself
- Starts
- July 1, 2027
- Status
- Signed Sept 30, 2026 after passing unanimously
What is SB 930?
A higher bar for how proctoring handles student data
SB 930, authored by Senator Eloise Gómez Reyes, updates California's Student Test Taker Privacy Protection Act (Business and Professions Code Section 22588). Existing law already limits proctoring companies to collecting, using, keeping, and sharing only the personal information strictly necessary to run the exam.
SB 930 adds a technical requirement on top of that. Starting July 1, 2027, any business providing proctoring services to a local educational agency for classroom- or course-based exams must use end-to-end encryption.
The law's definition of end-to-end encryption
Data is encrypted on the sender's device and stays encrypted until it reaches the intended recipient's device, unreadable by any other party, including the business providing proctoring services.
Watch for the "authorized user" carve-out. Many providers describe their product as end-to-end encrypted while keeping access for themselves, often by treating their own staff or support teams as "authorized users." SB 930 does not allow that. The data must be unreadable by every party except the intended recipient, including the proctoring company.
The law also defines proctoring broadly. It covers services that observe, monitor, or administer an exam, not only webcam-based tools.
SB 930 is K-12 only. The encryption requirement applies to local educational agencies, which the law defines as school districts, county offices of education, and charter schools. Colleges and universities are not covered.
Why it matters
Proctoring captures some of the most sensitive data a student generates.
When schools moved testing online, many proctoring tools began collecting video and audio of students and their homes, ID documents, biometric data, and browsing activity. Lawmakers saw that a privacy policy alone does not protect that data. Encryption the vendor cannot undo does.
It's a window into the home
Webcam and room scans can reveal a student's bedroom, family members, living situation, and belongings. That information should never be readable by a third party.
Breaches can't expose what vendors can't read
If a vendor holds the keys, a breach, a rogue employee, or a subpoena can expose student recordings. With true end-to-end encryption, there is nothing readable to expose.
Trust from families
Parents are paying closer attention to student data. Clear encryption standards give districts a simple, verifiable answer when families ask who can see their child's exam footage.
How it impacts California schools
The obligation sits with vendors. The exposure sits with districts.
SB 930 is written as a requirement on the businesses that provide proctoring. But districts sign the contracts, hold the student relationship, and answer to families and boards. A tool that can't meet the standard by July 2027 becomes a district problem.
Who is covered
- School districts, county offices of education, and charter schools
- Classroom- and course-based exams, including quizzes, unit tests, midterms, and finals
- Proctoring services, which the law defines as including services that observe, monitor, or administer an exam. How this applies to specific tools is a question for your vendor and counsel
- Virtual academies, independent study programs, and credit recovery, where students test unsupervised most often
What districts should do now
- Inventory every tool teachers use to monitor or secure exams, including those inside your LMS
- Ask each vendor, in writing, whether it can read student exam data today
- Review contracts and renewals that run past July 1, 2027
- Build any transition into 2027-28 budgets and procurement timelines
It's not just your vendor, it's your vendor's vendors
SB 930 requires exam data to be unreadable by any other party, not only the proctoring company. Most proctoring tools rely on other companies to host video, stream live sessions, run AI analysis, or handle support. If any of them can see student exam data, the encryption isn't end to end.
Cloud hosting
If recordings are stored with a cloud provider in a form that provider could decrypt, the data isn't protected end to end.
Video and live sessions
If exams are watched live through a video meeting platform, ask whether that platform can access the stream or recordings.
AI and support tools
If footage is sent to an outside AI service or viewed by support staff, that access counts too.
Ask every vendor for a list of its subprocessors and whether each one can read student exam data.
How it impacts California schools
Jan 2026
Introduced
SB 930 introduced in the California Senate.
Sept 30, 2026
Signed into law
Passed unanimously, then signed by the Governor as Chapter 989.
Now
Plan and budget
Districts set 2027-28 budgets and review vendor contracts.
July 1, 2027
Encryption required
Proctoring for K-12 classroom and course exams must be end-to-end encrypted.
Beyond California
California often sets the template for student privacy.
California's earlier student privacy law, SOPIPA, became a model that many other states adapted. The California Consumer Privacy Act did the same for consumer data. SB 930 passed without a single opposing vote, which signals a broad consensus that other legislatures can easily pick up.
For K-12 districts and schools outside California, the smart move is to treat end-to-end encryption as the new baseline now. Choosing a provider that already meets the standard avoids a costly switch later, and gives you a clear answer for parents and boards today.
Five questions to ask your vendor
Send these to every company that proctors or secures your exams. Ask for answers in writing.
Can you decrypt or view our students' exam data?
Ask how their encryption maps to SB 930's definition, and request a written explanation you can share with counsel.
Who holds the encryption keys?
Ask where keys are stored, who can use them, and when anyone outside your school could access exam data.
Where is exam data encrypted?
The law requires encryption on the student's device, before anything is sent. Encryption in transit and at rest alone is not end to end.
Which other companies touch our exam data?
Ask for their subprocessor list, including hosting, video, AI, and support providers, and whether any of them can read student exam data.
Will you confirm SB 930 compliance in our contract?
Ask for a written commitment that covers July 1, 2027 and every renewal after it.
How Proctorio complies
End-to-end encryption isn't new for us. It's how Proctorio was built.
Proctorio has long designed around a simple principle: we should never be able to see your students. All exam audio, video, and screen recordings are end-to-end encrypted, and only your school's approved staff can decrypt them. Proctorio holds no cryptographic key.
End-to-end
Recordings are encrypted on the student's device. Only your approved educators hold the keys. AES-GCM
In transit
A second layer protects every transfer, with Perfect Forward Secrecy support. TLS 1.2 / 1.3
At rest
A third layer encrypts stored data in ISO 27001 certified data centers. Our hosting providers store only encrypted recordings they cannot read. AES-256 · FIPS 140-2
Proctorio supported SB 930 and shared our technical expertise with lawmakers because we believe every student deserves this protection, no matter which vendor their school chooses.
Audits and certifications
Independent certifications and attestations that back up how Proctorio handles student data.
SOC 2 Type 2
Independently assesses the privacy, confidentiality, security, and availability of our systems.
ISO/IEC 27001:2022
Certifies our information security management system against the leading global standard.
ISO/IEC 27018:2019
Governs protection of personal data processed in the cloud, including student records.
ISO/IEC 42001:2023
The first international standard for responsible AI management and governance.
FERPA
Aligns our data handling with federal student education-record privacy requirements.
COPPA
Protects the data of students under 13 in accordance with federal law.
CCPA
Meets California's consumer data privacy and access requirements.
SOPIPA
Follows California's Student Online Personal Information Protection Act.
Free SB 930 proctoring stack review
Know where you stand before July 2027.
Tell us what your schools use today. We'll review your current proctoring and exam security tools against SB 930's requirements, so you aren't caught out of compliance.
Request your review- Share the tools your teachers use to monitor or secure exams.
- We map each one against SB 930's encryption and data rules.
- You get a clear summary of where each tool stands.
Frequently asked questions
When does SB 930 take effect?
SB 930 was signed on September 30, 2026. The end-to-end encryption requirement applies beginning July 1, 2027. California's existing data minimization rules for proctoring already apply today.
Does it apply to higher education?
No. SB 930's encryption requirement applies only to proctoring provided to local educational agencies, which the law defines as school districts, county offices of education, and charter schools. Colleges and universities are not covered.
Does it apply to lockdown browsers or only webcam proctoring?
The law defines proctoring services as including services that observe, monitor, or administer an exam. That is broader than webcam monitoring alone. Ask each vendor and your counsel how their specific product is treated.
What about state standardized tests?
SB 930's encryption requirement targets classroom- and course-based exams, the assessments teachers give as part of their courses. Confirm how state-administered testing is handled with your assessment office and counsel.
Isn't encryption in transit and at rest enough?
No. Those protect data while it moves and while it's stored, but the vendor can still decrypt it. SB 930 requires that data stay unreadable to every party except the intended recipient, including the vendor.
Does SB 930 cover the companies my vendor uses?
The law's definition says exam data must be unreadable by any party other than the intended recipient, including the proctoring business. That reasonably extends to the hosting, video, AI, and support providers a vendor relies on. Ask each vendor to confirm in writing that none of its subprocessors can read student exam data.
Is this page legal advice?
No. This page is a plain-language summary for education leaders. Please consult your district's legal counsel about your specific obligations.