Data Privacy Basics for Classroom AI Tools

ByLearnCodex Adm

This isn’t a hypothetical risk. Human Rights Watch reviewed 163 EdTech products endorsed by 49 governments for remote learning during COVID — and found that 89% of them engaged in data practices that put children’s rights at risk, in most cases collecting far more than the service needed to function. Before adopting a new AI tool in your classroom, it’s worth knowing which rules actually apply and what they require.

The three laws that actually govern this

FERPA (the Family Educational Rights and Privacy Act) protects the education records a school itself holds and controls disclosure of them — but it applies to the school, not directly to a vendor’s app, and it predates cloud-based AI tools by decades.

COPPA (the Children’s Online Privacy Protection Act) applies to any online service that collects personal information from children under 13, and normally requires verifiable parental consent. There’s a specific carve-out relevant here: a school can consent on behalf of parents, but only when the tool is used solely for the school’s educational benefit and no other commercial purpose. If a vendor’s terms allow using student data for advertising, product marketing, or building profiles beyond the classroom, the school-consent shortcut doesn’t apply — a parent would need to consent directly.

State laws add a third layer. California’s SOPIPA, for example, prohibits targeted advertising to students, prohibits building non-educational profiles of them, prohibits selling their data outright, and requires vendors to delete data at a school’s request. It applies to any vendor that knowingly serves K-12 users in California, regardless of where the company is based — which in practice means most national EdTech vendors are covered by it.

What changed in 2022

The FTC issued a unanimous policy statement putting EdTech vendors on notice that it would enforce COPPA’s full substance, not just the headline consent requirement. Three points from it are directly useful when evaluating a tool:

  • Students shouldn’t be required to hand over more data than the schoolwork actually needs.
  • Data collected under school consent can only be used to provide the requested educational service — nothing else.
  • “Reasonable security” is required even if there’s never been a breach; a clean track record isn’t proof of compliance.

The gap generative AI opens up

None of these laws were written with large language models in mind, and none directly answer the question school leaders are actually asking now: can a vendor use what a student types into an AI tutor to train its underlying model? COPPA’s use-limitation principle (data collected for the educational service can’t be repurposed) points toward “no” — but it’s not explicitly litigated for model training yet, so right now this comes down entirely to what’s written in the specific vendor’s terms, not a settled legal default.

A practical checklist, tied to what backs it up

  • Is the tool compliant with FERPA/COPPA, and does it name the specific state laws (e.g., SOPIPA) it follows? Vague “we take privacy seriously” language without naming a law is a signal, not reassurance.
  • Does it retain student data, and for how long? The FTC’s 2022 statement says retention has to be tied to actual need, not indefinite.
  • Is student input used to train underlying models? Ask directly — this is the one current law doesn’t cleanly settle, so the vendor’s own terms are the only real answer available.
  • Can data be deleted on request? SOPIPA and similar state laws require this; a vendor unable to answer clearly hasn’t thought about it.

Many districts maintain an approved-tools list for exactly this reason — check it before adopting something new independently.

The open problem: none of this is information a busy teacher or school leader can realistically verify by reading a vendor’s privacy policy in the ten minutes they actually have. A short, non-legal-jargon way to check these four things quickly is a gap worth closing.

Sources:

Similar Posts