A handful of student privacy bills in 2013 paved the way for a decade of legislation, with over 100 new laws passed in 40 states (and hundreds of bills introduced but not passed). As algorithms, AI, ML and more come to the forefront of policy, how can we avoid unintended consequences of well-intended policy? What can technologists, advocates, and policymakers learn from the past decade of student data privacy legislation to inform what’s next?