For example, a new law in Idaho (Idaho Code § 33-133) prohibits private vendors from using student data for any secondary purpose, such as sales, marketing or advertising. A new law in Kentucky (Ky. Rev. Stat. § 365.734) regulates cloud service providers, imposing on them a somewhat confusing prohibition against processing student data for any commercial purpose. In addition to limitations on the use of student data, many states sought to include security provisions in contracts with service providers.