This is a summary of publicly available information from Schools Beyond Screens, and is intended as a general overview to inform parents, does not constitute legal advice. Please note that state laws may give you additional rights, and are not covered below.
As we approach the new school year, many parents are asking questions about the different types of educational technology (EdTech) platforms their kids are using in the classroom, including what accounts districts may have set up on behalf of their kids, what educational purpose these platforms service, and how their kids’ data is being used or shared.
To help parents have these conversations with schools and districts, below is a plain-language summary of what federal law does and doesn't guarantee you as a parent.
There are two main federal laws that provide protection for students’ privacy. There is no private right of action under these laws, meaning an individual can’t use this as the basis to bring a claim in court. We rely on government agencies, including our state Attorneys General, to enforce the law.
COPPA (Children's Online Privacy Protection Act) regulates companies, not schools. COPPA, a law from 1998, requires parents to give consent to share personal information for kids under 13 with a commercial third party.
FERPA (Family Educational Rights and Privacy Act) governs education records, and is a law from 1978. Education records include information such as grades, disciplinary files, and data generated by some EdTech platforms that qualify as “school officials.” FERPA gives parents the right to inspect their child's records, request corrections, and consent to the disclosure of children's personally identifiable information. Schools must provide an annual notice of these rights to parents. The Department of Education's Student Privacy Policy Office provides a plain-language Parent Guide to FERPA.
How can parents receive more information (notice) of the use of EdTech tools in their school?
FTC guidance says: “For the ed tech service to get consent from the school instead of from the parent, the service must provide the school the necessary COPPA-required notice of its data collection and use practices…As a best practice, ed tech services should make the COPPA notice available to parents, and, where feasible, let parents review the personal information collected. In addition, ed tech services should use plain language that students, parents, and educators can easily understand.”
This could show up as a list on a district website, rather than individualized notice. You can ask your school for that list directly, and if that list doesn’t exist, ask them to create one.
What about consent?
When it comes to advocating in your school, it’s important to know that the main protective policy structure for keeping children’s data safe is parental consent to share that data. Federal laws provide families with foundational protective policy measures, but at the same time, educational technology has moved very quickly, and is being deployed in our schools very quickly. These problems are being exacerbated by the use of student-facing artificial intelligence (AI).
EdTech, including student-facing AI, exposes children to undefined, unclear third-party risks. It’s standard practice to get permission slips for parental consent for field trips, because when a child leaves the normal school environment, similar undefined risks could occur. The same is true when we provide children with access to the internet and numerous EdTech platforms that collect and use children’s data.
FTC’s public guidance states, “In the educational context, however, schools can consent on behalf of parents to the collection of student personal information — but only if such information is used for a school-authorized educational purpose and for no other commercial purpose. This is true whether the learning takes place in the classroom or at home at the direction of the school.”
It’s important to know that this policy is unsettled. The FTC's 2022 Policy Statement on Ed Tech reiterates “it is against the law for companies to force parents and schools to surrender their children’s privacy rights in order to do schoolwork online or attend class remotely…companies cannot deny children access to educational technologies when their parents or school refuse to sign up for commercial surveillance.”
In a 2025 amicus brief related to a case involving EdTech platform IXL, the FTC states, “Nothing in COPPA’s text, structure, legislative history, or implementing regulations supports IXL’s claim that COPPA creates an agency relationship between parents and schools for purposes of binding parents to the terms of agreements between IXL and those schools. Moreover, the principal goal of that legislation was to ensure parents’ involvement and control over the dissemination of their children’s personal information.”
Given this context, the idea that schools can consent on behalf of parents to use EdTech is controversial, and is being contested in court. COPPA regulations were updated over a year ago, and FTC decided not to formalize policy about schools providing consent on behalf of families.
What is clear is that we need a more meaningful, modernized framework for parental notification and consent. More of these applications and platforms perform multiple functions encompassing multiple uses of data, including assessment, instruction, assistance with college applications, and administrative data and records management for school districts. More districts are starting to deploy student-facing AI products as well, with more complex impacts on student data collection and potential secondary use.
Can parents opt out of using these tools?
Yes. The COPPA regulations state that upon parents’ requests, the operators of websites or online services subject to COPPA must provide: “The opportunity at any time to refuse to permit the operator's further use or future online collection of personal information from that child, and to direct the operator to delete the child's personal information.”
FTC’s FAQ on COPPA and schools states: “In addition, the operator, upon request from the school, must provide the school a description of the types of personal information collected; an opportunity to review the child’s personal information and the right to have the information deleted; and the opportunity to prevent further use or online collection of a child’s personal information.”
The big picture
Parents have the right to see what data is being collected about their kids and prevent further data collection. If you sense your rights have been violated, you can file a complaint with the Department of Education’s Student Privacy Policy Office.
Ultimately, school districts can, and should, offer parents flexible alternatives for paper-based approaches to assessment and in-class instruction, to accommodate any parent’s concern about use of data and privacy, or simply to support students’ individualized learning.
Questions to ask your school district about the use EdTech, including student-facing AI:
What EdTech products do students have access to? Please provide a list.
What are the privacy policies and data practices of these applications / platforms?
How can I prevent my child’s data from being collected and shared?
How can my family be provided with flexible, paper-based options?
Additional resources:
Parent Coalition for Student Privacy - Exercise Your Student Privacy Rights