FERPA, COPPA and AI in Schools: A Privacy Checklist

Short answer

FERPA, COPPA, and AI in schools: a privacy checklist

FERPA protects students' education records and COPPA protects personal information collected online from children under 13. Neither law bans AI, but both shape how a school can use it. Before adopting an AI tool, confirm what student data it collects, that the school keeps control of that data, that it is not used to train public models, how long it is kept, and that access is limited by role.

Use this page as part of a connected review: understand the purpose, consider the people affected, check the relevant safeguards, and follow the related routes for practical next steps.

Privacy review is often where school AI projects stall. Most of the delay comes from unclear answers: vendors that cannot say where conversations are stored, consumer accounts outside the school's control, or terms that allow data to be used for training. A short, consistent set of questions makes review faster and decisions easier to explain to families.

Know what data is collected. List every type of information the tool receives: names, emails, class rosters, student work, chat conversations, and uploaded files.

Keep the school in control. Student data should be processed on the school's behalf, under the school's direction, with clear limits on use, disclosure, and retention.

Rule out training on student data. Confirm in writing whether student and staff content is used to train or improve models, and whether that can be turned off.

Limit access by role. Use school sign-in, role permissions, and audit trails so the right people see the right information and access can be reviewed.

Questions for every AI vendor:

What student data do you collect, and where is it stored?

Is any student or staff content used to train models?

How long is data kept, and how is it deleted on request?

Do you support school sign-in (SSO), role permissions, and audit logs?

Documents to request:

A data privacy agreement aligned with FERPA, COPPA, and your state's student privacy law.

Security documentation, such as SOC 2 alignment or reports.

A plain-language summary you can share with families.

Inventory. List the AI tools already in use, including personal accounts teachers and students rely on.

Review. Run each tool through the same vendor questions and data agreement.

Configure. Turn on school sign-in, roles, and retention settings before launch.

Communicate. Tell families what is used, what data is involved, and who to contact with questions.

Use this checklist to structure privacy conversations with AI vendors. It is not legal advice; involve your legal counsel and privacy officer, and confirm requirements in your state.

Common questions

AI tools can touch student records and children's personal information. Before adoption, schools should know exactly what data a tool collects, where it goes, who can see it, and whether it is used to train models.