COPPA, FERPA, and AI in the Classroom: What Parents Need to Know

Why this matters: AI tools are everywhere (and they learn from data)

AI is quickly becoming part of everyday school life—writing support, reading tutors, math help, language practice, even grading and feedback. Used well, these tools can personalize learning and give teachers more time with students.

But AI tools often work by collecting inputs (what a student types, clicks, or uploads) and producing outputs (feedback, hints, rewritten paragraphs). That flow raises an important parent question:

• What student information is being shared—and who controls it?

In the U.S., two major laws show up in school privacy conversations:

• COPPA (focused on kids under 13 and online services)
• FERPA (focused on education records held by schools)

If you’ve ever wondered “Can schools use AI with student data?” the answer is often yes—but only with the right safeguards and agreements. Let’s break it down in plain English and turn it into practical questions you can ask.

COPPA explained for parents (the under-13 online privacy rule)

COPPA stands for the Children’s Online Privacy Protection Act. It applies to many websites and apps that collect personal information from children under 13.

The COPPA idea in one sentence

If an online service collects personal info from kids under 13, it usually needs verifiable parent consent—unless a school is consenting on the parent’s behalf for a school-approved educational purpose.

What counts as “personal information” under COPPA?

Parents are often surprised by how broad this can be. It can include:

• Full name, home address, email, phone number
• Login usernames that identify a child
• Photos, videos, voice recordings
• Precise location data
• Persistent identifiers (like cookies/device IDs) when used to track a child

How COPPA shows up with AI tools

Many AI tools are “general audience” products that weren’t built specifically for classrooms. If a teacher asks students to create accounts, upload assignments, or chat with an AI bot, COPPA questions can pop up—especially in grades K–6.

Here’s the nuance: schools can sometimes provide consent instead of parents (this is often called the “school consent” pathway), but only when:

• The tool is used for the benefit of the school (an educational purpose)
• The data is used only for that purpose, not for marketing or unrelated uses
• The school can review and control what’s happening with student data

Red flags to watch for (COPPA edition)

If you see these, it’s worth asking more questions:

• Students must create personal accounts with non-school emails
• The app asks for extra details (phone number, profile photo, location)
• The tool’s policy says it can use student content to “improve services” broadly without clear limits
• Ads appear in the product, or the company mentions marketing use

FERPA explained for parents (the school records rule)

FERPA stands for the Family Educational Rights and Privacy Act. It governs how schools handle student education records.

The FERPA idea in one sentence

Parents (and eligible students) have rights over education records, and schools must protect those records—and limit when they share them.

What is an “education record”?

In plain terms, it’s any record that is:

• Directly related to a student, and
• Maintained by a school or someone acting for the school

Examples can include:

• Grades, transcripts, attendance
• IEP documents and accommodation plans
• Discipline records
• Assignments stored in school systems
• Teacher notes shared with others (depending on context)

Where AI fits into FERPA

FERPA becomes relevant when a school shares education records—or information from them—with an AI vendor. Schools can share information with vendors under certain conditions (often under the “school official” exception), but typically the vendor must:

• Perform a service the school would otherwise do itself
• Use data only for the authorized purpose
• Be under the school’s “direct control” regarding data use (usually via contract)
• Not re-disclose data improperly

In practice, the contract matters. A lot.

A helpful mental model

• COPPA is mostly about online services collecting data from kids under 13.
• FERPA is mostly about schools controlling access to education records.

A classroom AI tool can implicate both, depending on the student’s age, what data is used, and whether the data is part of an education record.

Student data privacy laws + AI tools: what to ask (and what good answers sound like)

Parents don’t need to become privacy lawyers. You just need a short list of questions that reveal whether the school and vendor have thought this through.

Below is a practical cheat sheet you can use for meetings, emails, or back-to-school nights.

Question to ask the school	Why it matters	What a good answer sounds like
What AI tool is being used, and for what learning goal?	“AI” is broad; the purpose determines the risk level.	“We use it for drafting feedback in writing class, not for grading or discipline.”
What student data is entered or shared?	Data minimization is key—less shared means less risk.	“Students use first name + class code; no birthdays, phone numbers, or photos.”
Does the vendor use student data to train their AI models?	Training can mean long-term retention and broader use.	“No. Contract says student content is not used to train public models.”
How long is data kept, and how is it deleted?	Retention policies often get overlooked.	“Data is deleted within 30 days after the class ends, and we can request deletion anytime.”
Can parents opt out? If yes, what’s the alternative?	Opt-out should not penalize the student.	“Yes. Students can complete the same assignment offline or using a non-account version.”
Who can see the student’s chats/outputs?	Prevents surprises and protects student dignity.	“Teacher and student only; admin access is logged and limited.”
Is there a signed data privacy agreement?	FERPA-style vendor control is usually contractual.	“Yes—our district has a DPA that limits use, sharing, and retention.”

Extra questions for younger grades (COPPA-focused)

If your child is under 13, add:

• Is the school providing consent under COPPA, or are parents asked to consent?
• Does the tool require accounts, and are they school-managed?
• Are there any ads, upsells, or social features (public profiles, friend lists)?

Extra questions for middle/high school (FERPA-focused)

For older students, ask:

• Is the AI tool connected to the gradebook or LMS (Google Classroom, Canvas, Schoology)?
• Does it access accommodations, IEP info, or sensitive notes?
• Could it be used for high-stakes decisions (placement, discipline, grading)?

How to support your child while protecting privacy (real-world tips)

Even when a school is doing “everything right,” students also need coaching. AI tools change how kids learn—and how their work is stored.

Teach a simple “privacy rule of thumb”

Tell your child:

• Never share passwords, home address, phone number, or real-time location
• Don’t upload medical, counseling, or family legal information
• Be careful with personal stories that identify other students
• Assume a teacher might review AI chats (even if it feels private)

For teens, add a practical line:

• If you wouldn’t want it read out loud in class, don’t paste it into an AI chat.

Encourage “smart input” instead of oversharing

A lot of AI value comes from well-framed prompts—not personal data. Examples:

• Instead of: “Here’s my full essay with my name and school at the top…”
• Try: “Here is a draft essay (no names). Can you suggest ways to strengthen the thesis and transitions?”

Look for privacy-friendly defaults

When comparing tools (or asking what the school chose), parents can advocate for:

• School-managed accounts (not personal emails)
• No ads, no social features
• Clear settings for data retention and deletion
• Strong limits on model training using student content

Remember: states and districts may add extra rules

In addition to COPPA and FERPA, many states have student privacy laws and districts often have their own vetting process. If your school says “We can’t use that tool; it doesn’t meet district privacy standards,” that’s usually a good sign.

Next Steps: a 10-minute parent checklist for AI tools at school

Use this quick plan to move from worry to clarity.

• 1) Ask for the name of the tool and its purpose.

  • “Which AI tool are students using, and what specific assignments will it support?”

• 2) Ask what data the tool collects (and what it doesn’t).

  • “Do students enter names, emails, voice recordings, or photos?”

• 3) Ask the two make-or-break questions.

  • “Is student content used to train AI models?”
  • “How long is data kept, and can it be deleted on request?”

• 4) Ask about consent and opt-out.

  • “Is this covered by school consent under COPPA for under-13 students?”
  • “If we opt out, what’s the alternative assignment?”

• 5) Coach your child on safe AI use.

  • Pick one rule to start this week: No personal details in AI chats.

If you want a simple way to frame the conversation with your school: you’re not trying to block AI—you’re trying to make sure it’s used like a responsible classroom tool, with clear limits, transparency, and student-first privacy.