Is AI allowed in schools under COPPA and FERPA?

Yes, US schools can use AI tools with students, including children under 13, but only when the tool and the contract meet COPPA and FERPA. Neither law bans AI. Both control who may collect student data, for what purpose, and who stays in charge of it. This is a general overview, not legal advice: your district's counsel or privacy officer has the final word.

COPPA: who can consent for children under 13

The Children's Online Privacy Protection Act applies to online services that collect personal information from children under 13. The FTC's COPPA FAQ (section N, "COPPA and Schools") says:

• A school can act as the parent's agent and consent to an online program used solely for the benefit of its students.
• That consent only covers information collected "for the use and benefit of the school, and for no other commercial purpose".
• If the vendor uses student data for its own commercial purposes, such as behavioral advertising, the school cannot consent and the vendor must get consent from parents directly.

The FTC's amended COPPA Rule took effect on June 23, 2025, with most compliance obligations due by April 22, 2026 (Federal Register).

FERPA: sharing student records with a vendor

The Family Educational Rights and Privacy Act protects personally identifiable information in education records. A vendor can receive that information without individual parental consent under the "school official" exception (34 CFR 99.31(a)(1)) when it performs a service staff would otherwise do, stays under the school's direct control for that data, and uses it only for the authorized purpose. The Department of Education's Student Privacy Policy Office publishes guidance on online educational services.

If a teacher pastes identifiable student work into a consumer chatbot that has no agreement with the school, that is outside these protections. Keep identifiable records out of tools the district has not approved.

Questions to ask every AI vendor

The FTC suggests schools ask operators these questions before consenting:

1. What personal information do you collect from students?
2. How do you use it, and do you share it?
3. Do you use it for anything unrelated to the school, such as advertising or building commercial profiles?
4. Can the school review and delete student data?
5. What security protects it?
6. How long do you keep it?

Add two AI-specific questions: Do you train AI models on student data? and Can teachers see what students asked and what the AI answered?

A practical checklist

• The vendor's terms allow your students' ages.
• A signed data processing agreement or your state's student data privacy agreement is in place.
• Data is used only for the school's educational purpose: no ads, no sale, no training on student data.
• Students do not need personal email addresses.
• Teachers have visibility into student conversations.
• Parents have been told which tool is used and why.

How Askie for Schools handles this

The Askie for Schools privacy policy states that the school is the data controller and Askie the processor, that Askie operates as a school official under FERPA's exception and relies on school consent as permitted under COPPA for school-authorized educational services, and that Askie does not sell student data, advertise to students or use student data to train AI models. Schools data runs on a database separate from the consumer product, and a data processing agreement is available on request.

For more, see COPPA compliant AI: what to look for and How to use AI safely in schools.