Key takeaways

  • FERPA protects education records. Parents hold the rights until the student turns 18 or attends a postsecondary institution at any age; then the student becomes an eligible student and the rights transfer.
  • A vendor can receive student records without parental consent only under a narrow exception: it performs a service the school would otherwise use employees for, it is under the school's direct control over use and maintenance of the records, and it may not redisclose them (34 CFR 99.31 and 99.33).
  • The school must use reasonable methods so that officials, including vendor staff treated as school officials, reach only the records in which they have a legitimate educational interest. Physical or technological access controls are the natural way to do that.
  • COPPA applies to operators of websites and online services, not to schools. It defines a child as under 13, requires verifiable parental consent before collecting personal information, and requires reasonable security and deletion once the data is no longer needed.
  • CIPA is a funding condition. A school that receives E-Rate discounts for Internet access or internal connections certifies each funding year that it enforces an Internet safety policy with filtering, monitoring of minors' online activity and education about online behavior.
  • Vetting a vendor is mostly contract and access work: what data, who sees it, where it goes next, how long it is kept, and what happens when the contract ends.

Three rules, three different questions

Schools hold some of the most sensitive records there are: names, home addresses, grades, health notes, discipline files, special-education plans. They also hold them about children. Three federal rules come up in almost every district security review, and they answer three different questions. FERPA asks who may see a student's education records. COPPA asks what a website or app may collect from a child under 13. CIPA asks what a school must filter and monitor if it takes E-Rate discounts. Mixing them up is the most common mistake, so it is worth separating them first.

FERPA: education records and who may see them

The Family Educational Rights and Privacy Act (FERPA) gives parents rights over their children's education records. The Department of Education's Student Privacy site explains that when a student reaches 18, or attends a postsecondary institution at any age, the student becomes an eligible student and all FERPA rights move from the parent to the student. In practice a K-12 district deals with parents and, for its older students, with the students themselves.

Under the regulations at 34 CFR Part 99, a school must annually notify parents and eligible students of their rights (section 99.7). The general rule is that personally identifiable information from an education record is not disclosed without written consent. The regulations then list exceptions, and one of them matters most for technology: the school official exception in section 99.31.

A school may treat an outside party as a school official if that party performs an institutional service or function for which the school would otherwise use employees, is under the direct control of the school with respect to the use and maintenance of education records, and is subject to the limits on use and redisclosure in section 99.33. The same section says the school must use reasonable methods to make sure school officials get access only to the records in which they have legitimate educational interests, and notes that a school which does not use physical or technological access controls must make sure its administrative policy is effective. Section 99.33 adds that the receiving party may not pass the information on to anyone else without consent, and may use it only for the purposes for which it was disclosed.

Two practical points follow. First, an edtech vendor is not exempt because it is useful. If it holds student records, the contract needs to put it under the school's control, limit its use of the data to the school's purpose and forbid onward disclosure. Second, "directory information" is a trap. The regulation lets a school designate some items as directory information, but a student ID or user ID counts only if it cannot be used to reach education records without a second factor that only the user knows or holds, such as a password or PIN. A student number that opens a portal on its own does not qualify.

COPPA: services that collect data from children under 13

The Children's Online Privacy Protection Rule (16 CFR Part 312) is enforced by the Federal Trade Commission and is aimed at operators of websites and online services. It defines a child as an individual under 13. An operator must obtain verifiable parental consent before any collection, use or disclosure of personal information from children, and must give the parent the choice to agree to collection and use without agreeing to disclosure to third parties.

The rule also sets security and retention duties that map directly to vendor questions. Section 312.8 requires reasonable procedures to protect the confidentiality, security and integrity of children's personal information, and reasonable steps to release it only to service providers and third parties that can keep it safe and give assurances that they will. Section 312.10 says an operator keeps personal information only as long as reasonably necessary for the purpose it was collected, and deletes it using reasonable measures against unauthorized access. The text cited here is the 2024 edition of the Code of Federal Regulations; the FTC has amended the rule since, so read the current version in the eCFR before you write a contract clause around a specific paragraph.

For a school, the useful consequence is a set of questions to put to any app used by children under 13: does the vendor collect only what the lesson needs, who does it share it with, how long does it keep it, and does it delete on request and at contract end?

CIPA: filtering as a condition of E-Rate discounts

The Children's Internet Protection Act is not a privacy law. It is a condition of discounts under the E-Rate program, and the FCC's rule at 47 CFR 54.520 spells it out. A school that receives discounts for Internet access or internal connections must certify in each funding year that it has an Internet safety policy and is enforcing it. Schools that receive discounts only for telecommunications services are not subject to the requirement, but must say so in their certification.

The policy must include a technology protection measure that blocks or filters access to visual depictions that are obscene, child pornography or, for minors, harmful to minors. It must include monitoring of the online activities of minors, and since July 1, 2012 it must provide for educating minors about appropriate online behavior, including social networking sites, chat rooms and cyberbullying awareness and response. The policy must also address access by minors to inappropriate material, the safety of minors using email, chat and other direct communications, unauthorized access including hacking, unauthorized disclosure of minors' personal information, and measures that restrict minors' access to harmful material. For this purpose a minor is anyone under 17. The school must give reasonable public notice and hold at least one public hearing or meeting on the proposed policy.

The rule allows an authorized person to disable the filter for an adult doing bona fide research or other lawful work. A school that knowingly fails to enforce its certification must reimburse the funds and discounts it received for the period of noncompliance. The privacy angle is easy to miss: a filtering or monitoring product sees every student's browsing, so it is itself a vendor that holds student data and belongs in your review.

A vendor checklist built from the three rules

The Department of Education's Student Privacy site publishes guidance on protecting student privacy while using online educational services. It covers software, mobile apps and web tools that a third party provides to a school and that students or parents use as part of a school activity, such as readings, homework and progress dashboards. Combine that scope with the regulations above and a vendor review can stay short.

  • Data inventory. List every field the product collects. Remove anything the lesson does not need, such as birth dates, home addresses or photos.
  • Role and purpose. Confirm in the contract that the vendor acts under the school's direct control, uses records only for the school's purpose and does not redisclose them.
  • Access. Require single sign-on and multifactor authentication for staff accounts, and role-based access so a teacher sees only their own classes.
  • Under-13 users. Ask how the vendor handles verifiable parental consent, and what it collects from children beyond the lesson.
  • Sub-processors. Get the list of companies that handle the data on the vendor's behalf, and a promise that they are held to the same limits.
  • Security. Ask for encryption in transit and at rest, logging of access, and how quickly the vendor will tell you about a breach. Written commitments matter more than a marketing page.
  • Retention and exit. Agree how long data stays, how it is returned, and when it is deleted at the end of the contract or the school year.

Make it routine

Keep one register of every app that touches student data, with the owner, the data fields, the contract and the date of the last review. Teachers sign up for free tools on their own, so the register will always trail reality; pair it with a simple approval step and with network monitoring that shows which services students and staff actually use. Check the register once a year and whenever a vendor is acquired or changes its terms.

Our team helps schools and districts map their apps to these rules, tighten identity and access, and set up filtering and monitoring that can be explained to a school board. Your counsel decides what the law requires of you; we make the technical side match.

Sources

This article is general information, not legal advice. Federal rules are amended and states add their own student-privacy laws; confirm the current text and ask your counsel before you rely on it. Last reviewed .

Next article

Related reading

Need help with this?

We find out whether everything you run is safe from attackers, then we fix it.

Cybersecurity