Security: Student Privacy and FERPA When Using AI

Security: Student Privacy and FERPA When Using AI

Using AI tools in education creates serious privacy considerations. Student data is protected by law, and educators have an ethical obligation to safeguard it. This lesson covers what you need to know to use AI responsibly.

What is FERPA?

The Family Educational Rights and Privacy Act (FERPA) is a U.S. federal law that protects the privacy of student education records. Under FERPA:

• Parents have rights to inspect and review their child's education records
• Schools must have written permission to release personally identifiable information
• Student records include grades, transcripts, disciplinary records, and more
• Violation can result in loss of federal funding for the institution

What counts as student data?

When using AI, be aware that the following are all protected student data:

• Student names and identifying information
• Grades and assessment scores
• Student work (essays, assignments, projects)
• IEP and 504 plan information
• Disciplinary records
• Attendance records
• Photos and videos of students
• Any combination of data that could identify a student

What NOT to do with AI and student data

What TO do instead

Questions to ask before using any AI tool

1. Does this tool use my data for training? Check the privacy policy. Some tools explicitly state they don't; others do by default.
2. Is this tool approved by my institution? Many schools and districts maintain approved tool lists.
3. What data am I about to enter? If it contains personally identifiable student information, stop.
4. Could this data identify a specific student? Even without names, combinations of details can identify students.
5. Is there a non-AI alternative? Sometimes traditional methods are safer for sensitive tasks.
6. Have I checked the tool's data retention policy? Know how long your data is stored.

Education-specific tools with privacy protections

• Khanmigo: Designed for K-12 with student data protection built in; does not use student data for training.
• MagicSchool AI: Built for educators with privacy considerations; complies with FERPA and other education privacy laws.
• ChatGPT (education plans): OpenAI offers education-specific plans with data protection options — check if your institution has one.

International considerations

If you teach outside the U.S., be aware of additional regulations:

• GDPR (Europe): Strict data protection rules apply to AI tools processing EU citizens' data
• PIPEDA (Canada): Personal information protection requirements
• Local education privacy laws: Many countries and states have their own regulations

Corporate training privacy

In workplace training, be mindful of:

• Proprietary company information — don't paste confidential materials into public AI tools
• Employee performance data — treat with same care as student data
• Client information — never include client details in AI prompts
• Use enterprise AI tools with data protection agreements for workplace content