Data-flow guide for school leaders
Education AI Privacy and Compliance
An AI tool is not automatically acceptable or prohibited because of a privacy label. Start with the school's intended use, the information the tool receives and what the vendor can do with it. Then have the appropriate reviewers determine which requirements and approval conditions apply.
This guide helps your team prepare those questions. It is general information, not a legal opinion or a decision that any product complies.
Watch what to check about student data before using AI
Before a school uses an AI tool, trace what information enters it and what the vendor does with it. This briefing distinguishes FERPA coverage, COPPA operator responsibilities and the need for qualified human review.
Read the full transcript
Before a school uses an AI tool, what should it know about student privacy? Start with the information, not a compliance label. Think of a package delivery. You would want to know what is inside, where it is going, and who can open it. With AI, trace what information enters the tool and what the vendor does with it. Here is an illustrative example. A lesson outline using public material becomes a different review when someone adds a student's support plan. Pause before that change. The Department of Education advises teachers to check school or district approval. FERPA can affect education record disclosures at covered institutions. COPPA addresses covered operators collecting information from children under 13. School authorization is bounded. Operator responsibilities do not disappear. Individualized student decisions still need qualified people. NeuralEdge can help organize review questions, not replace your counsel. This is general information, not legal advice. Request a consultation about your institution and state requirements at neuraledgeconsulting.ai or call 703-750-8132.
General information, not legal advice.
When might an AI tool receive education-record information?
Look beyond the prompt box. A proposed workflow may involve uploaded files, account details, integrations and outputs as well as the text staff enter. Describe the information categories and who can access them. Ask the vendor for product-specific written answers about use, storage, retention and deletion; mark missing answers as unresolved.
For example, a tool used to draft a general lesson outline from public material presents a different review question from a workflow that uploads identifiable student records. This distinction is not itself permission for either use. The school still needs its approved process and an appropriate review of the actual product and purpose.
School purpose
What task are we trying to support, and who will use the tool?
Review point
Information sent
What enters the system, including through accounts and connected services?
Review point
Vendor handling
Who can access it, what uses are allowed and how does it leave the system?
Review point
Use school AI vendor due diligence to organize the evidence request. A diagram is a conversation aid, not a technical security assessment or a vendor approval. To place this use among the school's other AI risks, see the school AI risk assessment.
What does school approval require?
The Department of Education advises teachers to check school or district approval before using classroom tools. If FERPA applies and the school proposes relying on the school-official exception for disclosure, the relevant conditions must fit the actual arrangement. The FAQ describes an outsourced institutional function, direct control over use and maintenance of education records, use consistent with the school's annual notification and limits on unauthorized redisclosure. Have the appropriate reviewer assess the full conditions for the proposed use.
Do not assume a vendor qualifies because it advertises to schools, offers a contract or uses the word “compliant.” Ask the school's privacy lead or counsel to assess the arrangement and the basis for any disclosure. Record the approved purpose, limits, reviewer and review date. Connect those decisions to the school's AI policy so staff know what to do.
How is COPPA different from FERPA?
The laws address different questions and do not create one universal AI approval label.
FERPA
- Starting question
- Does FERPA apply to this institution, and what basis permits access to or disclosure of education records?
- Important boundary
- Institutional applicability and the facts of the disclosure matter. A school-official arrangement has conditions, not blanket permission.
COPPA
- Starting question
- Is the operator or service covered, and what personal information does it collect from children under 13?
- Important boundary
- Operator duties and the age, product and use context matter. School authorization is bounded and is not a transfer of all operator responsibilities.
The FTC's COPPA FAQ points readers to the revised rule. Use it as a starting reference, not a shortcut to consent or a product approval. Do not assume school authorization extends to advertising, unrelated commercial uses or every product feature. Have the appropriate reviewer assess the current rule, notice/consent route and actual vendor practices.
FERPA does not apply identically to every school. The Department of Education explains institutional applicability by reference to covered funding. Independent-school leaders should verify their institution's status rather than copy a public-district conclusion. See AI governance for independent schools for the distinct leadership context. Other applicable federal, state or contractual requirements may need separate review; this page does not provide a state-by-state legal determination.
Fictional example
A fictional example: the workflow changes
A staff team considers a tool for preparing a general lesson outline. Later, someone proposes uploading a student's support plan to tailor an output. The second proposal changes the information and purpose. Pause and route that change through the school's appropriate review before entering the information.
Reviewers identify the actual data, purpose, product controls and requirements; qualified staff retain responsibility for individualized decisions. This is a fictional example, not a client case or a finding that a specific tool is lawful or unlawful.
What changes for IEP or Section 504 information?
The question is not simply whether AI can produce text. Consider information handling and the school's individualized decision responsibilities separately. Do not treat generated wording as an evaluation, an eligibility decision or a replacement for the appropriate team and review process.
A qualified school special-education reviewer and counsel should assess the facts and applicable obligations. This general planning guide does not interpret IDEA or Section 504 for a particular student or institution. NeuralEdge's governance advisory offer is not an IEP-writing, eligibility or parent-advocacy service.
Questions to take to your reviewers
- Is using AI automatically a FERPA violation?
- No universal answer follows from the word “AI.” Determine institutional applicability, the information involved, the proposed use and the basis for disclosure. Check the school's approval process and seek the appropriate qualified review.
- Does school consent mean an operator has no COPPA duties?
- No. The FTC describes a bounded educational context for school authorization. Operator responsibilities and the actual age, product and use conditions still need assessment.
- Can an independent school use this page as its FERPA determination?
- No. Confirm the institution's status and relevant funding, and consider other applicable requirements. This is a question guide, not a determination of the school's legal obligations.
- Can we remove names and upload an IEP or Section 504 plan?
- Do not assume removing names resolves the review. Other details can still identify a student, and information handling is separate from individualized decision responsibility. Use the school's approved process and qualified review before entering material.
Bring the workflow, not a compliance label
Prepare the proposed purpose, information categories, vendor answers and unresolved questions. NeuralEdge can help organize the governance review and planning conversation. Request a consultation through the form below to discuss your institution and state requirements, or call 703-750-8132. For related school guidance, return to the K–12 education hub.
What happens next: a member of our client team reviews your inquiry and follows up to arrange a conversation.
General information, not legal advice. Your school's qualified privacy, legal and other appropriate reviewers should determine the requirements that apply and assess the proposed use. No legal outcome or compliance guarantee is offered.