K-12 content filtering and student device management
Schools and districts that take part in the federal E-Rate program are asked to run a technology protection measure that blocks or filters access to harmful visual content, and to follow internet safety policies under the Children's Internet Protection Act. Students also use managed Chromebooks, tablets and shared laptops both on campus and at home. This group covers how our team plans filtering and device management so that it works on and off the school network.
What we do
- CIPA-aware filter design
- Chromebook policy and OU design
- Off-campus filtering
- Extension and app allowlists
- Student-data vendor review
- Filter log review
- Staff alert routing
- Evidence for E-Rate files
Our team works with school web filters such as Securly, GoGuardian, Lightspeed Systems, Linewize and ContentKeeper, with Google Workspace admin and Chrome device management, with Microsoft Intune for Windows and iPad fleets, and with open-source gateways such as Squid and pfSense. We set up organizational units, policies, extension and app lists, sign-in rules and block categories by grade band, and we help review the privacy terms of the apps a school asks students to use, using the Student Data Privacy Consortium and the U.S. Department of Education student privacy resources.
This works alongside our DNS filtering, device management and identity groups, and links to our Managed IT and Cybersecurity services. Whether a program meets CIPA, FERPA, COPPA or a state student-privacy law is for the school or district and its counsel to decide, and this is not legal advice. These are tools our team has experience with, not partnerships, and not a statement that any tool makes a school compliant.
Leading platforms we work with
- Securly
- GoGuardian
- Lightspeed Systems
- Linewize
- ContentKeeper
- Google Workspace Admin console
- Squid
- pfSense
- Student Data Privacy Consortium
- Cisco Umbrella
- Zscaler
Platforms and practices
- Filter policy by grade band and role
- Off-network filtering for school-issued devices
- TLS inspection decisions and certificate rollout
- Chrome organizational units and device policies
- Forced extension and app allowlists
- Sign-in and domain restrictions on student devices
- Shared device and testing-mode kiosk profiles
- Student-data app review checklist and register
- Safety alert routing to named staff
- Filtering and device reports for board and E-Rate files
References
- Cornell Law School Legal Information Institute: 47 CFR 54.520, CIPA certifications
- Cornell Law School Legal Information Institute: 47 U.S.C. 254, universal service
- USAC: E-Rate program
- U.S. Department of Education: Student Privacy Policy Office (FERPA resources)
- CISA: Cybersecurity for K-12 Education
- Student Data Privacy Consortium
- Securly (vendor page)
- GoGuardian (vendor page)
- Lightspeed Systems (vendor page)
- Linewize (vendor page)
- ContentKeeper (vendor page)
- Google Workspace: Admin console overview
- Google Chrome Enterprise and Education Help
- Microsoft Learn: Microsoft Intune documentation
- Squid cache project
- pfSense project
Sources last checked .
Product names are trademarks of their owners and are listed to describe our experience; they do not imply endorsement or partnership.
How we use K-12 content filtering and student device management for clients
Managed IT Services
We run your IT day to day so it stays secure: help desk, devices, Microsoft 365, Exchange, Active Directory, backups, networks and monitoring.
Learn moreCybersecurity
We find out whether everything you run is safe from attackers, then we fix it.
Learn moreCloud Management
Cloud cost review and management, without compromising on quality or security.
Learn moreWhere this matters most
Frequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageDoes installing a web filter make a school CIPA compliant?
No tool does that on its own. CIPA is a condition of E-Rate discounts: the school certifies that it has an Internet safety policy that includes a filter, monitoring of minors' online activity and teaching students about appropriate online behavior, and it also gives public notice and holds a hearing. We set up the technical side and keep the documentation. Whether the program meets CIPA is for the school and its counsel to decide.
Can the filter follow a school Chromebook home?
Usually yes. Off-network filtering is one of the things we plan: the same policy is pushed to school-issued devices through the device management console, so it applies on campus and at home. What the school filters at home, and how it tells families, is a policy decision for the school.
Should the filter inspect encrypted web traffic?
It is a trade-off, not a default. Inspecting encrypted traffic gives the filter more detail, but it needs a school certificate on every device, can break some apps and means the filter sees more of what students do. Some schools choose DNS or extension-based filtering instead. We lay out the options and the rollout work, and the school decides.
Who checks the privacy terms of the apps students use?
The school or district stays responsible, and its counsel decides what the law requires. We help build the review: a checklist of what data an app collects and who it is shared with, a register with an owner and renewal date for each app, and an approval step so teachers do not sign students up for free tools unreviewed. We use the Student Data Privacy Consortium and Department of Education student privacy resources as references.