FERPA and AI

FERPA-aligned AI considerations for schools

What districts should review before student data moves through classroom AI workflows.

This is not legal advice, but it gives school teams a practical review map for privacy, contracts, access controls, and classroom implementation.

Quick answer

A FERPA-aligned school AI workflow should limit data collection, keep student records under school control, document vendor obligations, avoid ad-tech data uses, and give authorized educators access only when they need it for instruction or support.

Treat AI prompts as school-context data

Student prompts can reveal academic needs, identity details, classroom context, and sensitive support needs. District review should treat those records with the same seriousness as other education data.

  • Avoid unnecessary personal details in prompts.
  • Keep student identity tied to school accounts, not personal accounts.
  • Preserve auditability for authorized staff.

Review vendor handling before launch

Districts should confirm how data is stored, whether prompts are used for model training, how deletion works, and what subprocessors touch student content.

  • Ask for DPA terms before pilots scale.
  • Confirm student data is not sold.
  • Document where support and security contacts live.

Match access to educational need

Teacher visibility is valuable, but access should still be tied to the classroom relationship. Administrators need review paths without turning every student chat into broad internal content.

  • Use class membership and school identity checks.
  • Keep review actions narrow and auditable.
  • Separate teacher support from broad administrative access.

Privacy review checklist

  • Data collected from students
  • Training and retention terms
  • Subprocessor list
  • School account identity model
  • Teacher and administrator access scope
  • Deletion/export process
  • Incident and support contacts

Frequently asked questions

Does FERPA forbid classroom AI?

FERPA does not automatically forbid AI tools, but districts need a lawful, controlled implementation that protects education records and limits unnecessary disclosure.

Should students use personal AI accounts for schoolwork?

For district-managed classroom workflows, school-approved accounts are safer because they preserve governance, access control, and data handling expectations.