FERPA and AI tools: what administrators need to know

FERPA - the Family Educational Rights and Privacy Act - has been around since 1974. It wasn’t designed with AI in mind. But it absolutely applies to how schools use AI tools with student data.

The challenge is figuring out exactly what that means in practice.

The basics, quickly

FERPA protects “education records” - information directly related to a student that’s maintained by the school. It gives parents (and eligible students) rights to access records and limits who schools can share them with.

For most disclosures, you need written consent. But there’s an exception for “school officials” with “legitimate educational interest.” This is how vendors typically access student data - they’re acting as school officials under contract.

Where AI gets complicated

Traditional edtech vendors sign data privacy agreements, limit how they use data, and delete it when the relationship ends. The rules are established.

AI tools are different. When a teacher pastes student work into ChatGPT for feedback, where does that data go? Who can access it? How long is it retained? Is it used to train future models?

For most consumer AI tools, the honest answers are: we’re not sure, probably lots of people, indefinitely, and maybe.

That’s a problem under FERPA.

Questions to ask before using AI tools with student data

When teachers ask about using a new AI tool, here’s what you should consider:

Is student data being processed? Sometimes it’s obvious (uploading student essays for grading assistance). Sometimes it’s less clear (using AI to generate personalized lesson plans based on class performance data).

What happens to the data? Does the vendor retain it? Use it for model training? Share it with third parties? Read the privacy policy carefully. If it’s vague, that’s a red flag.

Is there a data processing agreement? Enterprise or education versions of AI tools often have explicit privacy commitments. Consumer versions usually don’t. The difference matters.

Is the vendor FERPA-compliant? Some AI tools have explicitly positioned themselves for education with appropriate privacy controls. Many haven’t.

Practical guidance for schools

Here’s what we typically recommend to schools working through these questions:

Create approved and prohibited lists

Maintain explicit lists of AI tools that are approved for use with student data and those that are prohibited. Teachers shouldn’t have to guess.

Default to “no student data” for consumer tools

Consumer AI tools like the free version of ChatGPT generally shouldn’t be used with student-identifiable information. The privacy protections aren’t there.

Get agreements for education-specific tools

When vendors offer education versions with appropriate privacy commitments, get those agreements in writing. Make sure they include data retention limits, prohibition on training use, and deletion requirements.

Train teachers on what counts as student data

Teachers may not realize that a student’s essay, even without a name attached, could be considered a protected education record. Clear training on what to avoid helps prevent accidental violations.

The gray areas

Some situations are genuinely unclear. A teacher using AI to get ideas for accommodating a student with specific learning needs - is that student data being disclosed? What if the teacher describes the situation without naming the student?

We don’t have definitive legal answers for every scenario. But we can help you think through the risks and make reasonable decisions.

In general, when in doubt, anonymize completely or don’t use the AI tool at all for that purpose. The convenience isn’t worth the compliance risk.

What’s next for FERPA and AI

The Department of Education is actively watching how schools use AI. Guidance updates are likely coming. In the meantime, schools that are thoughtful about AI and student data will be better positioned than those who are figuring it out after an incident.

If you’re an administrator at a St. Louis private school and this feels overwhelming, you’re not alone. These are genuinely complex questions. We help schools work through them - not with theoretical frameworks, but with practical policies that staff can actually follow.