Georgia has emerged as one of the fastest-growing markets for online K-12 education. The state requires private schools to file an annual declaration with the Georgia DOE, and the Fair Business Practices Act (FBPA) provides consumer protection that applies directly to enrollment agreements. Georgia's Student Data Privacy Act adds a layer of data protection requirements.
Understanding these state-specific requirements is essential for any online school enrolling Georgia students. Unlike some states with minimal oversight, Georgia imposes teacher qualification requirements (a bachelor's degree), mandates specific subject coverage, and provides consumers with a private right of action under the FBPA that includes the possibility of treble damages for intentional violations.
Under O.C.G.A. § 20-2-690(c), private schools in Georgia must file an annual declaration of intent with the Georgia Department of Education. This declaration is the foundational regulatory requirement for operating a private school in the state, including online schools that serve Georgia-resident students.
Filing Deadline
The declaration must be filed by September 1 of each year. Late filings can jeopardize your school's status and affect families' ability to claim the private school exemption from compulsory attendance requirements.
Required Information
- School name and address - The legal name and physical location of the school (for online schools, the administrative office address)
- Names and addresses of owners and operators - All individuals with ownership interest or operational control
- Enrollment by grade level - Total number of students enrolled, broken down by grade
- List of teachers and their qualifications - Names and educational credentials of all instructional staff
- Statement of intent - A declaration that the school intends to provide a private education program
Operating Requirements
- 180-day school year - Must operate for 180 days per year or the equivalent in instructional hours (4.5 hours per day for elementary, 5 hours for secondary)
- Required subjects - Must include reading, language arts, mathematics, social studies, and science in the curriculum
- Attendance records - Must maintain monthly attendance records for each student and report them when requested
- Student health records - Must maintain immunization records as required by Georgia law
Teacher Qualification Requirements
Georgia is notable among states for requiring private school teachers to hold at least a baccalaureate degree from an accredited institution. This is a significant distinction from many other states:
- Bachelor's degree minimum - All teachers must hold at least a bachelor's degree
- No specific teaching certificate required - Unlike public schools, a Georgia teaching certificate is not mandated for private schools
- Degree from accredited institution - The degree must be from a college or university accredited by a recognized accrediting body
- Applies to all instructional staff - This includes online instructors, not just traditional classroom teachers
Georgia requires a bachelor's degree for private school teachers, unlike Florida or Texas which have no teacher qualification requirements for private schools. This can impact hiring decisions and staffing costs for online schools that serve Georgia students, especially if the school also operates in states with no such requirements.
Online School Considerations
- Physical address requirement - Even fully online schools need a Georgia physical address for the declaration filing (can be the administrative office)
- Multi-state enrollment - If your online school is based outside Georgia but enrolls Georgia students, you may still need to comply with these requirements
- Curriculum alignment - Ensure your online curriculum covers all five required subject areas: reading, language arts, math, social studies, and science
- Instructional hours tracking - Online schools must document how they meet the 180-day or equivalent hours requirement, which can include asynchronous instructional time
Failure to file the annual declaration means families cannot claim the private school exemption from compulsory attendance under Georgia law. If parents enrolled in your school are found to be in violation of compulsory attendance requirements, the legal consequences fall on the families - which creates significant liability and reputational risk for the school.
The Georgia Fair Business Practices Act (FBPA), codified at O.C.G.A. § 10-1-390 et seq., is Georgia's primary consumer protection statute. It is the state's equivalent of federal FTC Act protections and directly applies to online school enrollment practices, marketing, and billing.
What the FBPA Prohibits
The FBPA broadly prohibits unfair or deceptive acts or practices in the conduct of consumer transactions. Specific prohibited conduct includes:
- False or misleading advertising - Making claims about your school, programs, or outcomes that are untrue or cannot be substantiated
- Failure to disclose material terms - Omitting important information that a reasonable consumer would want to know before enrolling
- Bait-and-switch tactics - Advertising one program or price and then pressuring families into a different, more expensive option
- Misrepresenting the nature of services - Overstating teacher qualifications, accreditation status, or program features
- Unconscionable contract terms - Including terms in enrollment agreements that are excessively one-sided or unfair
Enforcement Mechanisms
- Attorney General enforcement - The Georgia AG's Consumer Protection Division can investigate complaints, seek injunctions, and impose civil penalties
- Private right of action - Individual consumers (parents) can sue under the FBPA for actual damages
- Treble damages - For intentional violations, courts may award up to three times the actual damages
- Attorney fees - Prevailing consumers can recover attorney fees, making smaller claims economically viable to litigate
- Injunctive relief - Courts can order schools to cease deceptive practices
30-Day Demand Letter Requirement
Under O.C.G.A. § 10-1-399, before filing a private lawsuit under the FBPA, a consumer must send a written demand letter to the business at least 30 days before filing suit. This demand letter must:
- Identify the specific unfair or deceptive practice complained of
- State the injury or loss suffered by the consumer
- State the relief sought (amount of damages, corrective action, etc.)
- Be sent to the business at its principal place of business or registered agent
If the business makes a reasonable settlement offer within 30 days, the consumer's ability to recover attorney fees and treble damages may be limited. This creates an incentive for schools to resolve complaints quickly.
How FBPA Applies to Online Schools
The FBPA directly impacts several areas of online school operations:
- Enrollment marketing claims - Claims about program quality, outcomes, graduation rates, and college acceptance must be truthful and substantiated
- Accreditation representations - Stating or implying accreditation that the school does not hold is a clear FBPA violation
- Outcome statistics - Claims like "95% of our students improve by 2 grade levels" must be backed by verifiable data
- Fee disclosures - All fees, charges, and billing terms must be clearly disclosed before enrollment is finalized
- Refund policy clarity - Refund terms must be prominently disclosed and not misleading
Common Marketing Claims vs. FBPA Risk
| Marketing Claim | FBPA Risk Level | Issue |
|---|---|---|
| "Nationally accredited program" | HIGH | Must specify accreditor; misleading if not actually accredited |
| "Students improve by 2+ grade levels" | HIGH | Needs substantiation with verifiable data and methodology |
| "Credits accepted by all colleges" | HIGH | Almost never true; transfer decisions made by receiving institution |
| "Small class sizes (max 15 students)" | MEDIUM | Becomes contractual obligation; must actually maintain limit |
| "Certified teachers in every subject" | MEDIUM | Must verify all teachers actually hold relevant certifications |
| "Flexible schedule for your family" | LOW | General claim; low risk if some scheduling flexibility exists |
| "Interactive online learning platform" | LOW | General claim; low risk if platform has interactive features |
Legal Layers Affecting Georgia Marketing
FBPA allows treble damages for intentional violations - a $5,000 claim can become $15,000 plus attorney fees. If a parent pays $10,000 in tuition based on misrepresented accreditation status, the school could face $30,000 in damages plus the parent's legal costs. Multiply this across a class of affected families and the exposure becomes substantial.
Georgia is a one-party consent state for recording communications. Under O.C.G.A. § 16-11-62, it is illegal to record or intercept a wire, oral, or electronic communication unless at least one party to the communication has given consent. This is more permissive than two-party consent states like California and Florida.
What One-Party Consent Means for Online Schools
- Teacher recording their own class - If the teacher initiates the recording of a class they are participating in, that satisfies Georgia's one-party consent requirement. The teacher is the consenting party.
- No need for student/parent consent under Georgia wiretapping law - As long as one party (the teacher) consents, the recording is lawful under state wiretapping law
- School-authorized recordings - If the school directs the recording through its platform (e.g., Zoom recording), the school as a party to the communication can be considered the consenting party
- Student-initiated recordings - Students (or their parents) can also record classes they participate in without the teacher's knowledge under Georgia law
Important Limitations
- Multi-state classes - If any student in the class is located in a two-party consent state (California, Florida, Illinois, etc.), you must comply with that state's stricter requirements. The most restrictive law applies.
- COPPA still applies - Even though Georgia's wiretapping law only requires one-party consent, class recordings capture children's voices and images, which are personal information under COPPA. You still need verifiable parental consent under COPPA for students under 13.
- Contractual obligations - If your enrollment agreement promises notification before recording, you are contractually bound to provide it regardless of what state law requires.
Best Practices Despite One-Party Consent
Even though Georgia law does not require all-party consent, we recommend the following practices for transparency and trust:
- Include recording disclosure in enrollment agreement - Inform parents that classes may be recorded for quality, review, and makeup purposes
- Announce at the start of each recorded session - A brief verbal or text notification builds trust
- Offer alternatives for families who object - Camera-off options, audio-only participation, or access to recorded content without appearing in recordings
- Establish retention and access policies - Define how long recordings are kept, who can access them, and when they are deleted
- Address recordings in privacy policy - Clearly state what data is collected through recordings and how it is used
Georgia's one-party consent law simplifies class recording logistics compared to two-party consent states like California and Florida. However, always get COPPA consent for students under 13 regardless of Georgia's wiretapping law, and check the location of every student in multi-state classes to ensure you comply with the most restrictive applicable law.
Criminal Penalties for Violations
Violations of O.C.G.A. § 16-11-62 can result in criminal penalties:
- Felony offense - Unlawful recording is a felony in Georgia, punishable by imprisonment of 1 to 5 years
- Civil liability - Victims of unlawful recording can also sue for damages
- Exclusion of evidence - Unlawfully obtained recordings are inadmissible in court proceedings
While one-party consent is relatively easy to satisfy, the consequences of getting it wrong are severe. Always document your consent basis for any recording.
The Georgia Student Data Privacy, Accessibility, and Transparency Act was enacted as SB 89 in 2015. This legislation establishes a framework for the collection, use, and sharing of student data within the state's education system, including the creation of a Chief Privacy Officer position within the Georgia Department of Education.
Key Provisions
- Chief Privacy Officer - Established within the Georgia DOE to oversee student data privacy, develop policies, and respond to data concerns from parents and educators
- Data governance - Requires the state to maintain a comprehensive data governance plan that addresses collection, storage, access, security, and destruction of student data
- Transparency requirements - The DOE must publish a data inventory detailing what student data is collected, why it is collected, and who has access
- Parent rights - Parents have the right to access their child's data, request corrections, and be notified about data collection practices
- Restrictions on commercial use - Student data collected by the state or its contractors cannot be used for commercial purposes unrelated to education
Applicability to Private Schools
SB 89 primarily governs the collection and use of student data by the Georgia public school system, the DOE, and their contractors. Private schools are not directly subject to most of its provisions. However:
- Industry standard - The Act sets expectations for how student data should be handled in Georgia, and private schools that fall short of these standards may face reputational and legal risk
- Third-party contractors - If a private school contracts with vendors who also serve the public school system, those vendors may already be subject to SB 89 requirements
- Parent expectations - Georgia parents may expect private schools to meet the same data privacy standards as public schools
- Future regulation - States frequently expand student privacy laws to cover private schools in subsequent legislation
Requirements for Third-Party Contractors
When the state or its agencies share student data with third-party contractors, SB 89 requires:
- Data governance plan - Contractors must maintain a data governance plan detailing how student data will be protected
- Security measures - Appropriate administrative, technical, and physical safeguards must be implemented
- Breach notification - Contractors must notify the DOE of any data breach involving student information
- Data destruction - Upon termination of the contract, student data must be returned or destroyed
- Prohibition on secondary use - Student data cannot be used for purposes beyond the scope of the contract
Federal Laws That Still Apply to Private Schools
Even though SB 89 primarily targets public schools, private online schools in Georgia remain subject to:
- COPPA - Federal Children's Online Privacy Protection Act applies to all online services collecting data from children under 13, including private schools
- General Georgia data protection laws - Georgia's Personal Identity Protection Act and other state privacy laws apply to all businesses, including private schools
- FTC Act - The FTC can take action against any business that makes deceptive privacy promises or fails to adequately protect consumer data
Georgia Personal Identity Protection Act - Breach Notification
Under Georgia's Personal Identity Protection Act (O.C.G.A. § 10-1-912), businesses that experience a data breach involving personal information must:
- Notify affected individuals - Notification must be made in the "most expedient time possible and without unreasonable delay"
- Notify the AG - If the breach affects more than 10,000 Georgia residents, the Attorney General must be notified
- Notify consumer reporting agencies - If the breach affects more than 10,000 Georgia residents, the three major consumer reporting agencies must also be notified
- Content of notice - Must include a description of the breach, the type of information compromised, contact information for the business, and the toll-free numbers for consumer reporting agencies
While Georgia's Student Data Privacy Act primarily targets public schools, private online schools should follow its standards as industry best practice. Adopting a comprehensive data governance plan, implementing strong security measures, and being transparent about data collection will position your school well for both parent trust and potential future regulatory requirements.
Practical Data Protection Checklist for Georgia Online Schools
- Maintain a written data inventory documenting all student data collected, stored, and shared
- Implement encryption for student data at rest and in transit
- Conduct annual security assessments of your technology infrastructure
- Execute data processing agreements with all third-party vendors who handle student information
- Develop and publish a clear, accessible privacy policy that addresses student data specifically
- Create an incident response plan for data breaches that complies with Georgia notification requirements
- Train all staff on data privacy requirements and incident reporting procedures
- Establish a data retention and destruction policy with defined timelines
Georgia does not have a specific auto-renewal statute comparable to California's Automatic Renewal Law (ARL) or Florida's Fla. Stat. § 501.165. However, this does not mean online schools can implement auto-renewal billing without legal constraints. Several federal and state laws, plus credit card network rules, still govern subscription billing practices in Georgia.
Federal ROSCA Requirements
The Restore Online Shoppers' Confidence Act (ROSCA) is a federal law that applies to all online businesses, including those in Georgia. Under ROSCA:
- Clear disclosure - All material terms of the transaction must be clearly and conspicuously disclosed before the consumer agrees
- Affirmative consent - The consumer must provide informed, affirmative consent to the charges
- Simple cancellation - Consumers must be provided with a simple mechanism to stop recurring charges
- No negative option billing without consent - You cannot charge consumers under a negative option feature without their express informed consent
FBPA Coverage of Billing Practices
Even without a specific auto-renewal statute, Georgia's FBPA (O.C.G.A. § 10-1-390 et seq.) covers deceptive billing practices generally. Billing practices that could trigger FBPA liability include:
- Hidden auto-renewal terms - Burying renewal language in lengthy agreements without clear disclosure
- Difficult cancellation processes - Making it unreasonably hard to cancel (e.g., requiring a phone call during limited business hours when enrollment was online)
- Failure to send renewal notices - Not alerting consumers before automatic charges renew
- Unclear pricing - Failing to clearly disclose recurring charge amounts, frequency, and duration
- Price increases without notice - Raising tuition rates during an auto-renewal period without adequate prior notice
Georgia Uniform Deceptive Trade Practices Act
In addition to the FBPA, the Georgia Uniform Deceptive Trade Practices Act (O.C.G.A. § 10-1-370 et seq.) provides a separate cause of action for deceptive trade practices. While it overlaps with the FBPA in many areas, it provides additional consumer protections:
- Injunctive relief - Consumers can seek court orders to stop deceptive practices
- No damage requirement - Unlike the FBPA, a consumer can seek relief under the UDTPA without proving actual monetary damages
- Attorney fees for willful violations - If the court finds the violation was willful, attorney fees may be awarded
Legal Stack for Georgia Billing Compliance
Best Practices for Georgia Billing Transparency
Even without a specific auto-renewal statute, Georgia online schools should implement the following billing practices:
- Prominent disclosure at enrollment - Clearly state the recurring charge amount, frequency, and duration near the enrollment button or signature
- Separate checkbox for auto-renewal consent - Do not bundle auto-renewal consent with general terms of service acceptance
- Pre-renewal email notification - Send a reminder email 14-30 days before each automatic renewal with the charge amount and date
- Easy online cancellation - Provide a cancellation mechanism at least as easy as the enrollment process (online enrollment = online cancellation)
- Confirmation of enrollment terms - Send a confirmation email after enrollment that clearly restates the billing terms, renewal dates, and cancellation process
- Document consent - Maintain records of when and how each family consented to auto-renewal billing
- Price change notice - If tuition increases, notify families at least 30 days before the renewal that will reflect the new price
If your online school enrolls students in California, you must comply with California's strict Automatic Renewal Law regardless of where your school is based. Similarly, Florida and New York have their own auto-renewal requirements. Design your billing practices to meet the most restrictive state's requirements, and you will be compliant across all states.
Online schools serving Georgia students are subject to oversight from multiple state and federal agencies. Each agency has a different jurisdictional focus, and understanding who enforces what is critical for prioritizing compliance efforts.
| Regulatory Body | Jurisdiction | Key Responsibilities |
|---|---|---|
| Georgia Department of Education | Education oversight | Receives annual private school declarations, monitors compliance with private school operating requirements, oversees curriculum and teacher qualification standards |
| Georgia AG Consumer Protection Division | Consumer protection | Enforces the Fair Business Practices Act (FBPA), investigates consumer complaints about deceptive marketing, billing, and enrollment practices |
| Georgia Chief Privacy Officer | Student data privacy | Oversees student data governance for the public school system, establishes data privacy standards, responds to privacy-related complaints |
| Federal Trade Commission (FTC) | Federal consumer protection & children's privacy | Enforces COPPA for children under 13, enforces ROSCA for subscription billing, investigates deceptive advertising and unfair business practices |
Understanding which regulator is most likely to take action based on the type of violation helps schools prioritize their compliance efforts:
| Compliance Issue | Most Likely Enforcer | Typical Trigger | Potential Consequence |
|---|---|---|---|
| Missing DOE declaration | Georgia DOE | Audit, parent complaint, attendance inquiry | Families lose private school exemption from compulsory attendance |
| Deceptive enrollment marketing | Georgia AG / FTC | Consumer complaints, competitor report | FBPA injunction, civil penalties, treble damages |
| COPPA violation (under-13 data) | FTC | Complaint, FTC sweep, data breach | Civil penalties of $50,120+ per violation |
| Auto-renewal / billing issues | Georgia AG / FTC | Consumer complaints, chargebacks | FBPA damages, ROSCA enforcement action |
| Data breach | Georgia AG | Breach discovery, external report | Mandatory notification costs, potential litigation |
| Unqualified teachers | Georgia DOE | Parent complaint, declaration audit | Loss of private school status, parent lawsuits |
How Investigations Typically Start
- Parent complaints to the AG - The most common trigger. A dissatisfied parent files a consumer complaint about billing, refunds, or misleading marketing claims
- BBB complaints - Patterns of complaints to the Better Business Bureau can attract AG attention
- Competitor reports - Other schools may report deceptive advertising claims to the AG or FTC
- DOE audit - Periodic review of annual declarations may reveal incomplete filings or teacher qualification issues
- FTC sweep - The FTC periodically conducts industry-wide investigations into EdTech and online education COPPA compliance
- News coverage - Media reports about problems at an online school can prompt regulatory inquiry
A single incident can trigger action from multiple agencies simultaneously. For example, a data breach involving student records could trigger Georgia AG enforcement under the Personal Identity Protection Act, FTC action for COPPA violations, and parent lawsuits under the FBPA for failure to adequately protect data as promised in the privacy policy.
- Enrollment agreement review
- FBPA compliance check
- Refund policy analysis
- Marketing claims review
- Written red flag report
- Recommended revisions
- All documents reviewed
- DOE declaration compliance
- COPPA assessment
- FBPA marketing audit
- Billing flow review
- Privacy policy analysis
- 30-min strategy call
- Custom privacy policy
- COPPA compliance program
- Parental consent forms
- Data processing agreements
- Vendor audit checklist
- Recording consent system
- Breach response plan
Yes. Under O.C.G.A. § 20-2-690(c), private schools in Georgia must file an annual declaration of intent with the Georgia Department of Education by September 1 each year. This applies to online schools enrolling Georgia-resident students. The declaration requires the school's name and address, names and addresses of owners/operators, enrollment by grade level, a list of teachers and their qualifications, and a statement of intent. Failure to file means families enrolled in your school cannot claim the private school exemption from Georgia's compulsory attendance law, which creates serious liability for the families and reputational risk for the school.
The Georgia Fair Business Practices Act (FBPA), codified at O.C.G.A. § 10-1-390 et seq., is the state's primary consumer protection law. It prohibits unfair or deceptive acts in consumer transactions, including false advertising, failure to disclose material terms, and bait-and-switch tactics. For online schools, the FBPA directly affects enrollment marketing claims, accreditation representations, outcome statistics, fee disclosures, and refund policies. It gives consumers (parents) a private right of action with the possibility of treble damages for intentional violations, plus recovery of attorney fees. Before filing suit, consumers must send a 30-day demand letter under O.C.G.A. § 10-1-399.
Yes. Georgia is one of the states that imposes teacher qualification requirements on private schools. Under the annual declaration requirements, all private school teachers must hold at least a baccalaureate (bachelor's) degree from an accredited college or university. This is a meaningful distinction from states like Florida and Texas, which have no teacher qualification requirements for private schools. While Georgia does not require a state teaching certificate for private school teachers, the bachelor's degree requirement applies to all instructional staff, including online instructors. This affects hiring decisions and may increase staffing costs compared to states without such requirements.
Georgia is a one-party consent state under O.C.G.A. § 16-11-62. This means only one party to a communication needs to consent to the recording. For online schools, if the teacher initiates and consents to the recording of their own class, that satisfies Georgia's wiretapping law. However, two important caveats apply: (1) If any student in the class is located in a two-party consent state such as California or Florida, you must comply with that state's more restrictive requirements, and (2) COPPA still requires verifiable parental consent before collecting personal information (including voice and image in recordings) from children under 13, regardless of Georgia's wiretapping law.
Yes. Georgia enacted the Student Data Privacy, Accessibility, and Transparency Act (SB 89) in 2015, which established a Chief Privacy Officer within the Georgia DOE and created a framework for student data governance. However, this law primarily governs data collected by the public school system and its contractors, not private schools directly. Private online schools in Georgia are still subject to federal COPPA requirements for children under 13, the Georgia Personal Identity Protection Act for data breach notification, and general FBPA consumer protection standards. Best practice is to voluntarily adopt SB 89 standards for data governance, security measures, and transparency even as a private school.
Georgia does not have a specific auto-renewal statute like California's ARL or Florida's Fla. Stat. § 501.165. However, online schools using recurring billing in Georgia must still comply with federal ROSCA (clear disclosure, affirmative consent, simple cancellation), the Georgia FBPA (which covers deceptive billing practices), and credit card network rules. Additionally, the Georgia Uniform Deceptive Trade Practices Act provides a separate cause of action. Best practice is to design your billing system to comply with the strictest state requirements (typically California's ARL), which will ensure Georgia compliance as well.
owner@terms.law