The last decade has seen many exciting innovations in education. Educators have developed new instructional models that accelerate and deepen student learning by tailoring instruction to each student's individual needs, skills, and interests. In recent years nearly every state in the nation has responded by considering new student data privacy legislation to build upon the aging foundation offered by federal law and to meet the unique circumstances and needs of their schools and communities. Given the complexity of the issue and its relationship to the implementation of other important education policies, it is important for policymakers to ensure that their actions effectively address parents' privacy concerns without unintentionally undermining schools' ability to provide students the personalized, high-quality education parents expect and that will prepare students for success in college, life, and work. Targeted to state policymakers and their advisors and grounded in new data commissioned by ExcelinEd on parent views about technology and student data privacy, the purpose of this paper is threefold: (1) to shed light on the context for the privacy of student data as an issue and on parental concerns more specifically; (2) to provide a brief review and analysis of the current federal and state legislative landscape regulating the collection and use of data about students; and (3) to suggest potential strategies for addressing outstanding parental and public concerns, including via the passage of new state legislation. The paper concludes with recommendations of actions that various stakeholders--including state education agencies, school districts, parents, and companies--can take even in the absence of the passage of new legislation to improve student data privacy and security in the current K-12 context. With or without new legislation, protecting student data will require a focus on good governance processes, regular review of security practices, transparency and effective communications, and a commitment to build the capacity of state, district and school level employees to protect student data.