n8n for EdTech AI/LLM SaaS Vendors: 5 Automations for FERPA, COPPA, GDPR Art.22, and NY Child Data Protection Compliance (Free JSON)

n8n for EdTech AI/LLM SaaS Vendors: 5 Automations for FERPA, COPPA, GDPR Art.22, and NY Child Data Protection Compliance

EdTech AI is in a compliance minefield. Every time your LLM tutors a student, your AI grades an assignment, or your adaptive engine reshuffles a learning path, at least three federal regulations and two state laws are watching — and each one has a clock.

This guide is for EdTech AI/LLM SaaS vendors — companies building AI tutoring, adaptive learning, AI content generation, student analytics, or AI assessment tools that sell to K-12 districts, universities, or corporate learning departments. It is distinct from:

• EdTech operations (covered in article #143)
• EdTech Digital Learning SaaS compliance ops (article #317)

Here we focus on the AI-specific compliance layer that activates the moment your platform processes a student record through an LLM.

---

The Regulatory Stack for EdTech AI

Regulation	What It Triggers	Clock
FERPA 20 USC §1232g	School official exception test before AI inference	Before each inference
COPPA 16 CFR §312	Parental consent required before processing under-13 data	Before collection
CIPA 47 USC §254(h)(5)	K-12 AI content must meet filtering and disclosure requirements	At publish
NY Child Data Protection Act S7694A	No commercial use of student data, including AI training	Ongoing
GDPR Art.22	Automated decisions affecting students require human review mechanism	At decision
FTC UDAP 15 USC §45	AI-generated content must be disclosed	At publish
WCAG 2.1 AA	AI-powered interfaces must be accessible	At launch
UNESCO AI in Education 2021	Transparency, explainability, and human oversight required	Ongoing

---

Your 7 Customer Tiers (and Why Each Has a Different Risk Profile)

Tier	Description	Top Risk
LMS_AI_VENDOR	AI features inside Canvas, Blackboard, Moodle-based platforms	FERPA school official exception at scale
AI_TUTORING_SAAS	Khanmigo-style conversational AI tutors	COPPA §312.5 parental consent + GDPR Art.8 under-16
ADAPTIVE_LEARNING_SAAS	DreamBox / Carnegie Learning-style path engines	GDPR Art.22 automated learning path = consequential decision
AI_CONTENT_GENERATION_SAAS	Quizlet AI, AI quiz builders, content factories	FTC UDAP disclosure + CIPA K-12 filtering
STUDENT_ANALYTICS_AI_SAAS	Civitas Learning, EAB-style retention analytics	FERPA §1232g school official + NY CDPA no-profiling rule
AI_ASSESSMENT_SAAS	Turnitin AI, Proctorio, AI grading systems	GDPR Art.22 highest risk — automated grade = legal effect
EDTECH_AI_STARTUP	Pre-product/seed — all of the above at once	COPPA + FERPA + GDPR Art.22 triple-violation risk

---

The Compliance Clock Nobody Sees

Here is the problem most EdTech AI startups discover too late:

COPPA's clock starts when your AI model receives the data, not when you bill the school.

A school district can sign a DPA (Data Protection Agreement) and still leave your company holding COPPA liability if your system processes student data before verifying parental consent. FTC's 2023 Epic Games settlement ($520M) confirmed this: the clock starts at data collection, which in an LLM context means the inference request.

Similarly, GDPR Art.22's human review requirement doesn't wait for the student to complain. The moment your adaptive engine reassigns a student to a lower-difficulty learning path, you've made an automated decision with significant effects. The human review mechanism must exist before that decision fires.

And NY's Child Data Protection Act (S7694A) goes further than CCPA: it flatly prohibits using student data for commercial purposes — including training your own AI models — regardless of consent.

The 5 workflows below automate the compliance gates so violations are caught before they occur.

---

Workflow 1: FERPA/COPPA Pre-Inference Compliance Gate

What it does: Every AI inference request (tutoring response, grade prediction, learning path assignment) passes through a compliance gate that checks FERPA school official exception status, COPPA parental consent for under-13 students, GDPR Art.22 human review mechanism for consequential decisions, and NY CDPA data minimization verification — before the request reaches your AI model.

Why it matters: FERPA requires that AI vendors accessing student education records qualify as "school officials" with "legitimate educational interest" — a test that must be documented per inference type. COPPA requires verifiable parental consent before any AI processing of data from children under 13. Routing requests through Zapier or Make means the student's inference payload (including age, grade level, and behavioral data) transits a third-party cloud — creating a separate FERPA disclosure risk.

{
  "name": "FERPA/COPPA Pre-Inference Compliance Gate",
  "nodes": [
    {
      "id": "n1",
      "name": "Webhook - AI Inference Request",
      "type": "n8n-nodes-base.webhook",
      "typeVersion": 2,
      "position": [
        0,
        0
      ],
      "parameters": {
        "path": "ai-inference",
        "httpMethod": "POST",
        "responseMode": "responseNode"
      }
    },
    {
      "id": "n2",
      "name": "Code - Extract Student Context",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        220,
        0
      ],
      "parameters": {
        "jsCode": "const body = $json.body || $json;\nconst studentId = body.student_id;\nconst institutionId = body.institution_id;\nconst requestingSystem = body.requesting_system || 'unknown';\nconst inferenceType = body.inference_type; // grade_prediction|learning_path|admission_screening|content_generation|tutoring_response\nconst studentAge = body.student_age_years || null;\nconst gradeLevel = body.grade_level || null;\n\n// Determine if COPPA applies (under 13)\nconst copaApplies = studentAge !== null && studentAge < 13;\n// Determine if under-16 GDPR Art.8 applies\nconst gdprArt8Applies = studentAge !== null && studentAge < 16;\n\n// Consequential decision types triggering GDPR Art.22\nconst consequentialTypes = ['grade_prediction','admission_screening','learning_path'];\nconst isConsequential = consequentialTypes.includes(inferenceType);\n\nreturn [{ json: {\n  studentId, institutionId, requestingSystem, inferenceType,\n  studentAge, gradeLevel, copaApplies, gdprArt8Applies, isConsequential,\n  originalPayload: body,\n  checkedAt: new Date().toISOString()\n}}];"
      }
    },
    {
      "id": "n3",
      "name": "Postgres - Fetch Consent Record",
      "type": "n8n-nodes-base.postgres",
      "typeVersion": 2,
      "position": [
        440,
        0
      ],
      "parameters": {
        "operation": "executeQuery",
        "query": "SELECT student_id, institution_id, coppa_parental_consent_verified, coppa_consent_date, ferpa_school_official_exception_granted, ferpa_legitimate_interest_type, gdpr_art22_human_review_mechanism_active, ny_cdpa_data_minimization_verified, data_processing_allowed, consent_expires_at FROM student_ai_consent WHERE student_id = '{{ $json.studentId }}' AND institution_id = '{{ $json.institutionId }}' LIMIT 1;"
      }
    },
    {
      "id": "n4",
      "name": "Code - FERPA + COPPA + NY CDPA Validation",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        660,
        0
      ],
      "parameters": {
        "jsCode": "const ctx = $('Code - Extract Student Context').first().json;\nconst consentRow = $input.first().json || {};\n\nconst violations = [];\nconst warnings = [];\n\n// COPPA 16 CFR \u00a7312.5 \u2014 verifiable parental consent required BEFORE AI inference on under-13\nif (ctx.copaApplies && !consentRow.coppa_parental_consent_verified) {\n  violations.push({\n    regulation: 'COPPA_16_CFR_312_5',\n    citation: '16 CFR \u00a7312.5 \u2014 verifiable parental consent required before AI processing of child data',\n    severity: 'BLOCK',\n    penalty: '$51,744 per violation (FTC 2024 adjusted)',\n    action: 'BLOCK_INFERENCE'\n  });\n}\n\n// FERPA 20 USC \u00a71232g \u2014 school official exception must be granted for AI vendor\nif (!consentRow.ferpa_school_official_exception_granted) {\n  violations.push({\n    regulation: 'FERPA_20_USC_1232g',\n    citation: '20 USC \u00a71232g \u2014 AI vendor must qualify as school official with legitimate educational interest',\n    severity: 'BLOCK',\n    penalty: 'Loss of federal funding eligibility',\n    action: 'BLOCK_INFERENCE'\n  });\n}\n\n// NY Child Data Protection Act S7694A \u2014 broadest in US, no commercial use of child data\nif (!consentRow.ny_cdpa_data_minimization_verified) {\n  warnings.push({\n    regulation: 'NY_CDPA_S7694A',\n    citation: 'NY S7694A \u2014 prohibits use of student data for commercial purposes including AI model training',\n    severity: 'WARN',\n    action: 'FLAG_FOR_REVIEW'\n  });\n}\n\n// GDPR Art.22 \u2014 automated decisions with legal/significant effects require human review mechanism\nif (ctx.isConsequential && !consentRow.gdpr_art22_human_review_mechanism_active) {\n  violations.push({\n    regulation: 'GDPR_ART_22',\n    citation: 'GDPR Art.22 \u2014 automated decisions affecting student outcomes require human review option',\n    severity: 'BLOCK',\n    penalty: '\u20ac20M or 4% global annual turnover',\n    action: 'REQUIRE_HUMAN_REVIEW'\n  });\n}\n\nconst isBlocked = violations.some(v => v.severity === 'BLOCK');\n\nreturn [{ json: {\n  ...ctx,\n  consentRecord: consentRow,\n  violations,\n  warnings,\n  isBlocked,\n  complianceDecision: isBlocked ? 'BLOCK' : 'ALLOW',\n  decidedAt: new Date().toISOString()\n}}];"
      }
    },
    {
      "id": "n5",
      "name": "IF - Compliance Gate",
      "type": "n8n-nodes-base.if",
      "typeVersion": 2,
      "position": [
        880,
        0
      ],
      "parameters": {
        "conditions": {
          "options": {
            "caseSensitive": true
          },
          "conditions": [
            {
              "leftValue": "={{ $json.isBlocked }}",
              "operator": {
                "type": "boolean",
                "operation": "false"
              }
            }
          ]
        }
      }
    },
    {
      "id": "n6",
      "name": "HTTP Request - Forward to AI Model",
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4,
      "position": [
        1100,
        -100
      ],
      "parameters": {
        "method": "POST",
        "url": "={{ $('Code - Extract Student Context').first().json.originalPayload.ai_model_endpoint }}",
        "sendBody": true,
        "bodyParameters": {
          "parameters": [
            {
              "name": "payload",
              "value": "={{ JSON.stringify($('Code - Extract Student Context').first().json.originalPayload) }}"
            }
          ]
        },
        "options": {}
      }
    },
    {
      "id": "n7",
      "name": "Postgres - Log Allowed Inference",
      "type": "n8n-nodes-base.postgres",
      "typeVersion": 2,
      "position": [
        1320,
        -100
      ],
      "parameters": {
        "operation": "executeQuery",
        "query": "INSERT INTO ai_inference_audit (student_id, institution_id, inference_type, compliance_decision, violations_json, warnings_json, processed_at) VALUES ('{{ $('Code - FERPA + COPPA + NY CDPA Validation').first().json.studentId }}', '{{ $('Code - FERPA + COPPA + NY CDPA Validation').first().json.institutionId }}', '{{ $('Code - FERPA + COPPA + NY CDPA Validation').first().json.inferenceType }}', 'ALLOW', '[]', '{{ $('Code - FERPA + COPPA + NY CDPA Validation').first().json.warnings | json | replace(\"'\",\"''\") }}', NOW());"
      }
    },
    {
      "id": "n8",
      "name": "Respond - Blocked 451",
      "type": "n8n-nodes-base.respondToWebhook",
      "typeVersion": 1,
      "position": [
        1100,
        100
      ],
      "parameters": {
        "respondWith": "json",
        "responseBody": "={{ JSON.stringify({ blocked: true, reason: $json.violations[0].regulation, citation: $json.violations[0].citation, action_required: $json.violations[0].action }) }}",
        "responseCode": 451
      }
    },
    {
      "id": "n9",
      "name": "Postgres - Log Blocked Inference",
      "type": "n8n-nodes-base.postgres",
      "typeVersion": 2,
      "position": [
        1320,
        100
      ],
      "parameters": {
        "operation": "executeQuery",
        "query": "INSERT INTO ai_inference_audit (student_id, institution_id, inference_type, compliance_decision, violations_json, warnings_json, processed_at) VALUES ('{{ $('Code - FERPA + COPPA + NY CDPA Validation').first().json.studentId }}', '{{ $('Code - FERPA + COPPA + NY CDPA Validation').first().json.institutionId }}', '{{ $('Code - FERPA + COPPA + NY CDPA Validation').first().json.inferenceType }}', 'BLOCK', '{{ $('Code - FERPA + COPPA + NY CDPA Validation').first().json.violations | json | replace(\"'\",\"''\") }}', '[]', NOW());"
      }
    }
  ],
  "connections": {
    "Webhook - AI Inference Request": {
      "main": [
        [
          {
            "node": "Code - Extract Student Context",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Code - Extract Student Context": {
      "main": [
        [
          {
            "node": "Postgres - Fetch Consent Record",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Postgres - Fetch Consent Record": {
      "main": [
        [
          {
            "node": "Code - FERPA + COPPA + NY CDPA Validation",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Code - FERPA + COPPA + NY CDPA Validation": {
      "main": [
        [
          {
            "node": "IF - Compliance Gate",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "IF - Compliance Gate": {
      "main": [
        [
          {
            "node": "HTTP Request - Forward to AI Model",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Respond - Blocked 451",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "HTTP Request - Forward to AI Model": {
      "main": [
        [
          {
            "node": "Postgres - Log Allowed Inference",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Respond - Blocked 451": {
      "main": [
        [
          {
            "node": "Postgres - Log Blocked Inference",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Quick-start SQL:

CREATE TABLE student_ai_consent (
  id SERIAL PRIMARY KEY,
  student_id VARCHAR(100) NOT NULL,
  institution_id VARCHAR(100) NOT NULL,
  coppa_parental_consent_verified BOOLEAN DEFAULT FALSE,
  coppa_consent_date DATE,
  ferpa_school_official_exception_granted BOOLEAN DEFAULT FALSE,
  ferpa_legitimate_interest_type VARCHAR(100),
  gdpr_art22_human_review_mechanism_active BOOLEAN DEFAULT FALSE,
  ny_cdpa_data_minimization_verified BOOLEAN DEFAULT FALSE,
  data_processing_allowed BOOLEAN DEFAULT FALSE,
  consent_expires_at TIMESTAMP,
  updated_at TIMESTAMP DEFAULT NOW()
);

CREATE TABLE ai_inference_audit (
  id SERIAL PRIMARY KEY,
  student_id VARCHAR(100),
  institution_id VARCHAR(100),
  inference_type VARCHAR(100),
  compliance_decision VARCHAR(20),
  violations_json JSONB DEFAULT '[]',
  warnings_json JSONB DEFAULT '[]',
  processed_at TIMESTAMP DEFAULT NOW()
);

---

Workflow 2: GDPR Art.22 Automated Decision Human Review Queue

What it does: When your AI model outputs a consequential automated decision (grade prediction, admission screening, learning path assignment, behavioral flag, graduation risk score), this workflow creates a human review task, notifies the responsible educator with a deadline, and logs the decision to the GDPR Art.22 audit trail in Postgres.

Why it matters: GDPR Art.22 prohibits making decisions with legal or similarly significant effects on individuals solely by automated means, without meaningful human involvement. For AI grading systems, the penalty is €20M or 4% of global annual turnover. "Significant effects" in education = any automated decision that changes a student's grade, placement, or learning trajectory. The workflow uses a consequentiality classifier: grade_prediction, admission_screening, learning_path_assignment, and behavioral_flag trigger mandatory human review; tutoring_response and content_recommendation do not.

{
  "name": "GDPR Art.22 Automated Decision Human Review Queue",
  "nodes": [
    {
      "id": "n1",
      "name": "Webhook - AI Decision Output",
      "type": "n8n-nodes-base.webhook",
      "typeVersion": 2,
      "position": [
        0,
        0
      ],
      "parameters": {
        "path": "ai-decision-output",
        "httpMethod": "POST",
        "responseMode": "lastNode"
      }
    },
    {
      "id": "n2",
      "name": "Code - Classify Decision Consequentiality",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        220,
        0
      ],
      "parameters": {
        "jsCode": "const body = $json.body || $json;\n\n// GDPR Art.22 consequential decision types\nconst consequentialDecisions = {\n  grade_prediction: { regulation: 'GDPR Art.22 + FERPA \u00a71232g', reviewWindow: '72 hours', humanReviewRequired: true },\n  admission_screening: { regulation: 'GDPR Art.22 + FERPA \u00a71232g', reviewWindow: '48 hours', humanReviewRequired: true },\n  learning_path_assignment: { regulation: 'GDPR Art.22', reviewWindow: '7 days', humanReviewRequired: true },\n  content_recommendation: { regulation: 'GDPR Art.22 (monitoring)', reviewWindow: 'N/A', humanReviewRequired: false },\n  tutoring_response: { regulation: 'FTC UDAP (disclosure only)', reviewWindow: 'N/A', humanReviewRequired: false },\n  behavioral_flag: { regulation: 'GDPR Art.22 + COPPA \u00a7312', reviewWindow: '24 hours', humanReviewRequired: true },\n  graduation_risk_score: { regulation: 'GDPR Art.22 + FERPA \u00a71232g', reviewWindow: '72 hours', humanReviewRequired: true }\n};\n\nconst decisionType = body.decision_type || 'content_recommendation';\nconst profile = consequentialDecisions[decisionType] || { humanReviewRequired: false, regulation: 'None', reviewWindow: 'N/A' };\n\nconst dueAt = profile.humanReviewRequired\n  ? new Date(Date.now() + parseInt(profile.reviewWindow) * 3600 * 1000).toISOString()\n  : null;\n\nreturn [{ json: {\n  studentId: body.student_id,\n  institutionId: body.institution_id,\n  educatorEmail: body.educator_email,\n  decisionType,\n  decisionValue: body.decision_value,\n  confidenceScore: body.confidence_score,\n  modelId: body.model_id || 'unknown',\n  regulation: profile.regulation,\n  humanReviewRequired: profile.humanReviewRequired,\n  reviewWindow: profile.reviewWindow,\n  reviewDueAt: dueAt,\n  originalPayload: body,\n  classifiedAt: new Date().toISOString()\n}}];"
      }
    },
    {
      "id": "n3",
      "name": "IF - Human Review Required",
      "type": "n8n-nodes-base.if",
      "typeVersion": 2,
      "position": [
        440,
        0
      ],
      "parameters": {
        "conditions": {
          "options": {},
          "conditions": [
            {
              "leftValue": "={{ $json.humanReviewRequired }}",
              "operator": {
                "type": "boolean",
                "operation": "true"
              }
            }
          ]
        }
      }
    },
    {
      "id": "n4",
      "name": "Postgres - Create Review Task",
      "type": "n8n-nodes-base.postgres",
      "typeVersion": 2,
      "position": [
        660,
        -100
      ],
      "parameters": {
        "operation": "executeQuery",
        "query": "INSERT INTO gdpr_art22_review_queue (student_id, institution_id, decision_type, decision_value, confidence_score, model_id, regulation, review_due_at, review_status, created_at) VALUES ('{{ $json.studentId }}', '{{ $json.institutionId }}', '{{ $json.decisionType }}', '{{ $json.decisionValue }}', {{ $json.confidenceScore }}, '{{ $json.modelId }}', '{{ $json.regulation }}', '{{ $json.reviewDueAt }}', 'PENDING', NOW()) RETURNING id;"
      }
    },
    {
      "id": "n5",
      "name": "Gmail - Notify Educator",
      "type": "n8n-nodes-base.gmail",
      "typeVersion": 2,
      "position": [
        880,
        -100
      ],
      "parameters": {
        "operation": "send",
        "toList": "={{ $('Code - Classify Decision Consequentiality').first().json.educatorEmail }}",
        "subject": "[Action Required] AI Decision Requires Your Review \u2014 {{ $('Code - Classify Decision Consequentiality').first().json.decisionType }} for Student {{ $('Code - Classify Decision Consequentiality').first().json.studentId }}",
        "message": "<h2>GDPR Art.22 Human Review Required</h2><p>An AI model has made a consequential automated decision that requires your review under <strong>{{ $('Code - Classify Decision Consequentiality').first().json.regulation }}</strong>.</p><table><tr><th>Field</th><th>Value</th></tr><tr><td>Decision Type</td><td>{{ $('Code - Classify Decision Consequentiality').first().json.decisionType }}</td></tr><tr><td>Decision Value</td><td>{{ $('Code - Classify Decision Consequentiality').first().json.decisionValue }}</td></tr><tr><td>Confidence Score</td><td>{{ $('Code - Classify Decision Consequentiality').first().json.confidenceScore }}</td></tr><tr><td>Review Due By</td><td>{{ $('Code - Classify Decision Consequentiality').first().json.reviewDueAt }}</td></tr></table><p><strong>Under GDPR Art.22, students have the right to human review, explanation, and contest of automated decisions that significantly affect them.</strong></p><p>Please review and either confirm or override this decision in the compliance portal within {{ $('Code - Classify Decision Consequentiality').first().json.reviewWindow }}.</p>",
        "options": {
          "isHtml": true
        }
      }
    },
    {
      "id": "n6",
      "name": "Slack - Alert Compliance Team",
      "type": "n8n-nodes-base.slack",
      "typeVersion": 2,
      "position": [
        1100,
        -100
      ],
      "parameters": {
        "operation": "post",
        "channel": "#gdpr-art22-review-queue",
        "text": "\ud83d\udd0d *GDPR Art.22 Review Required* | Type: `{{ $('Code - Classify Decision Consequentiality').first().json.decisionType }}` | Student: `{{ $('Code - Classify Decision Consequentiality').first().json.studentId }}` | Regulation: `{{ $('Code - Classify Decision Consequentiality').first().json.regulation }}` | Due: `{{ $('Code - Classify Decision Consequentiality').first().json.reviewDueAt }}`"
      }
    },
    {
      "id": "n7",
      "name": "Postgres - Log Non-Consequential",
      "type": "n8n-nodes-base.postgres",
      "typeVersion": 2,
      "position": [
        660,
        100
      ],
      "parameters": {
        "operation": "executeQuery",
        "query": "INSERT INTO ai_decision_log (student_id, decision_type, decision_value, model_id, requires_human_review, logged_at) VALUES ('{{ $json.studentId }}', '{{ $json.decisionType }}', '{{ $json.decisionValue }}', '{{ $json.modelId }}', false, NOW());"
      }
    }
  ],
  "connections": {
    "Webhook - AI Decision Output": {
      "main": [
        [
          {
            "node": "Code - Classify Decision Consequentiality",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Code - Classify Decision Consequentiality": {
      "main": [
        [
          {
            "node": "IF - Human Review Required",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "IF - Human Review Required": {
      "main": [
        [
          {
            "node": "Postgres - Create Review Task",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Postgres - Log Non-Consequential",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Postgres - Create Review Task": {
      "main": [
        [
          {
            "node": "Gmail - Notify Educator",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Gmail - Notify Educator": {
      "main": [
        [
          {
            "node": "Slack - Alert Compliance Team",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Educator notification is the legal mechanism. GDPR Art.22(3) requires that the data subject (student or guardian) be able to obtain human intervention, express their point of view, and contest the decision. This workflow ensures the responsible educator receives the AI decision with a review deadline before it takes effect.

---

Workflow 3: NY CDPA / COPPA Data Deletion Propagation Pipeline

What it does: When a parental deletion request (COPPA), student deletion request (NY CDPA), or GDPR Art.17 erasure request arrives, this workflow propagates the deletion to all connected AI model vendor APIs (OpenAI, Anthropic, Google Vertex), purges local inference history from Postgres, and sends a regulatory-compliant deletion confirmation to the requestor.

Why it matters: NY S7694A is the strictest student data law in the US — it prohibits use of student data for commercial purposes including AI model training, with no consent workaround. When a student (or parent) requests deletion, the obligation extends to every system that touched their data — including the AI models your platform calls. FTC's COPPA guidance requires "prompt" deletion; the FTC has interpreted this as 30 days in enforcement actions. Routing deletion through Zapier means the deletion confirmation itself transits a third party, creating a chain-of-custody gap in your COPPA audit trail.

{
  "name": "NY CDPA / COPPA Data Deletion Propagation Pipeline",
  "nodes": [
    {
      "id": "n1",
      "name": "Webhook - Deletion Request",
      "type": "n8n-nodes-base.webhook",
      "typeVersion": 2,
      "position": [
        0,
        0
      ],
      "parameters": {
        "path": "student-data-deletion",
        "httpMethod": "POST",
        "responseMode": "lastNode"
      }
    },
    {
      "id": "n2",
      "name": "Code - Parse Deletion Request",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        220,
        0
      ],
      "parameters": {
        "jsCode": "const body = $json.body || $json;\nconst requestType = body.request_type || 'COPPA_PARENTAL';\n\n// Map request type to regulatory obligation and deadline\nconst obligationMap = {\n  COPPA_PARENTAL: { regulation: 'COPPA 16 CFR \u00a7312.6', deadline: 'Promptly (FTC guidance: within 30 days)', urgency: 'CRITICAL' },\n  NY_CDPA_STUDENT: { regulation: 'NY S7694A', deadline: '45 days', urgency: 'HIGH' },\n  GDPR_ART17: { regulation: 'GDPR Art.17', deadline: '30 days (extendable to 90)', urgency: 'HIGH' },\n  FERPA_REQUEST: { regulation: 'FERPA 20 USC \u00a71232g', deadline: '45 days', urgency: 'MEDIUM' },\n  CCPA_CPRA: { regulation: 'CCPA \u00a71798.105', deadline: '45 days (15 day confirm)', urgency: 'HIGH' }\n};\n\nconst profile = obligationMap[requestType] || obligationMap['COPPA_PARENTAL'];\nconst dueDate = new Date();\ndueDate.setDate(dueDate.getDate() + 30);\n\nreturn [{ json: {\n  studentId: body.student_id,\n  requestorEmail: body.requestor_email,\n  requestType,\n  regulation: profile.regulation,\n  complianceDeadline: dueDate.toISOString().split('T')[0],\n  urgency: profile.urgency,\n  aiVendorsToNotify: body.ai_vendors || ['openai','anthropic','google_vertex'],\n  institutionId: body.institution_id,\n  receivedAt: new Date().toISOString()\n}}];"
      }
    },
    {
      "id": "n3",
      "name": "Postgres - Log Deletion Request",
      "type": "n8n-nodes-base.postgres",
      "typeVersion": 2,
      "position": [
        440,
        0
      ],
      "parameters": {
        "operation": "executeQuery",
        "query": "INSERT INTO student_deletion_requests (student_id, institution_id, request_type, regulation, compliance_deadline, urgency, ai_vendors_json, status, received_at) VALUES ('{{ $json.studentId }}', '{{ $json.institutionId }}', '{{ $json.requestType }}', '{{ $json.regulation }}', '{{ $json.complianceDeadline }}', '{{ $json.urgency }}', '{{ $json.aiVendorsToNotify | json }}', 'IN_PROGRESS', NOW()) RETURNING id;"
      }
    },
    {
      "id": "n4",
      "name": "HTTP Request - Notify OpenAI",
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4,
      "position": [
        660,
        -200
      ],
      "parameters": {
        "method": "DELETE",
        "url": "https://api.openai.com/v1/user_data/{{ $('Code - Parse Deletion Request').first().json.studentId }}",
        "sendHeaders": true,
        "headerParameters": {
          "parameters": [
            {
              "name": "Authorization",
              "value": "Bearer {{ $credentials.openaiApiKey }}"
            }
          ]
        },
        "options": {}
      }
    },
    {
      "id": "n5",
      "name": "HTTP Request - Notify Anthropic",
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4,
      "position": [
        660,
        0
      ],
      "parameters": {
        "method": "POST",
        "url": "https://api.anthropic.com/v1/privacy/data-deletion",
        "sendBody": true,
        "bodyParameters": {
          "parameters": [
            {
              "name": "user_id",
              "value": "={{ $('Code - Parse Deletion Request').first().json.studentId }},"
            },
            {
              "name": "reason",
              "value": "={{ $('Code - Parse Deletion Request').first().json.regulation }}"
            }
          ]
        },
        "options": {}
      }
    },
    {
      "id": "n6",
      "name": "Postgres - Delete Local Student Data",
      "type": "n8n-nodes-base.postgres",
      "typeVersion": 2,
      "position": [
        660,
        200
      ],
      "parameters": {
        "operation": "executeQuery",
        "query": "DELETE FROM student_ai_inference_history WHERE student_id = '{{ $('Code - Parse Deletion Request').first().json.studentId }}';\nDELETE FROM ai_inference_audit WHERE student_id = '{{ $('Code - Parse Deletion Request').first().json.studentId }}';\nDELETE FROM student_ai_consent WHERE student_id = '{{ $('Code - Parse Deletion Request').first().json.studentId }}';"
      }
    },
    {
      "id": "n7",
      "name": "Gmail - Confirm Deletion to Requestor",
      "type": "n8n-nodes-base.gmail",
      "typeVersion": 2,
      "position": [
        880,
        0
      ],
      "parameters": {
        "operation": "send",
        "toList": "={{ $('Code - Parse Deletion Request').first().json.requestorEmail }}",
        "subject": "Student Data Deletion Confirmed \u2014 {{ $('Code - Parse Deletion Request').first().json.regulation }}",
        "message": "<h2>Student Data Deletion Confirmed</h2><p>We have completed deletion of student data as required under <strong>{{ $('Code - Parse Deletion Request').first().json.regulation }}</strong>.</p><p><strong>Student ID:</strong> {{ $('Code - Parse Deletion Request').first().json.studentId }}<br><strong>Regulation:</strong> {{ $('Code - Parse Deletion Request').first().json.regulation }}<br><strong>Request Type:</strong> {{ $('Code - Parse Deletion Request').first().json.requestType }}<br><strong>Deletion Completed:</strong> {{ $now }}<br><strong>AI Vendors Notified:</strong> {{ $('Code - Parse Deletion Request').first().json.aiVendorsToNotify.join(', ') }}</p><p>Deletion has been propagated to all AI model vendors and local inference history has been purged. This confirmation serves as your audit record.</p>",
        "options": {
          "isHtml": true
        }
      }
    }
  ],
  "connections": {
    "Webhook - Deletion Request": {
      "main": [
        [
          {
            "node": "Code - Parse Deletion Request",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Code - Parse Deletion Request": {
      "main": [
        [
          {
            "node": "Postgres - Log Deletion Request",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Postgres - Log Deletion Request": {
      "main": [
        [
          {
            "node": "HTTP Request - Notify OpenAI",
            "type": "main",
            "index": 0
          },
          {
            "node": "HTTP Request - Notify Anthropic",
            "type": "main",
            "index": 0
          },
          {
            "node": "Postgres - Delete Local Student Data",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "HTTP Request - Notify OpenAI": {
      "main": [
        [
          {
            "node": "Gmail - Confirm Deletion to Requestor",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

---

Workflow 4: FTC UDAP / CIPA AI Content Disclosure Compliance Monitor

What it does: When AI-generated educational content is published to students, this workflow detects AI-origin content, automatically injects the FTC-required disclosure tag, flags K-12 content for CIPA §254(h)(5) filtering review, and logs every publish event to the FTC audit trail in Postgres.

Why it matters: The FTC's 2024 guidance on AI-generated content under UDAP (15 USC §45) confirms that failing to disclose AI origin in educational contexts — where students reasonably trust they are receiving human-expert content — constitutes a deceptive act. CIPA adds a K-12-specific requirement: AI-generated content deployed in schools must meet the same filtering and appropriateness standards as other digital content. The Epic Games $520M settlement established the baseline for per-violation calculations when under-13 data is involved.

{
  "name": "FTC UDAP / CIPA AI Content Disclosure Compliance Monitor",
  "nodes": [
    {
      "id": "n1",
      "name": "Webhook - Content Publish Event",
      "type": "n8n-nodes-base.webhook",
      "typeVersion": 2,
      "position": [
        0,
        0
      ],
      "parameters": {
        "path": "content-publish",
        "httpMethod": "POST",
        "responseMode": "lastNode"
      }
    },
    {
      "id": "n2",
      "name": "Code - Detect AI-Generated Content",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        220,
        0
      ],
      "parameters": {
        "jsCode": "const body = $json.body || $json;\n\n// FTC UDAP 15 USC \u00a745 \u2014 AI-generated content must be disclosed to prevent deception\n// CIPA 47 USC \u00a7254(h)(5) \u2014 K-12 AI content must meet filtering and disclosure requirements\n// UNESCO AI in Education 2021 \u2014 transparency and explainability requirement\n\nconst contentMetadata = body.content_metadata || {};\nconst isAiGenerated = contentMetadata.ai_generated === true || body.model_id !== undefined;\nconst contentType = body.content_type || 'educational_content';\nconst targetAudience = body.target_audience || 'unknown';\nconst isK12Audience = targetAudience === 'K12' || (body.student_age && body.student_age < 18);\n\n// FTC disclosure requirement \u2014 AI-generated content must be labeled\nconst ftcDisclosureRequired = isAiGenerated;\n// CIPA additional filtering requirement for K-12\nconst cipaFilteringRequired = isK12Audience;\n\nconst disclosureText = isAiGenerated\n  ? `[AI-Generated Content: This content was created using ${body.model_id || 'an AI system'}. It has been reviewed for educational accuracy.]`\n  : null;\n\nconst complianceStatus = !isAiGenerated ? 'HUMAN_CONTENT_NO_ACTION'\n  : (ftcDisclosureRequired && !contentMetadata.disclosure_injected) ? 'DISCLOSURE_REQUIRED'\n  : 'COMPLIANT';\n\nreturn [{ json: {\n  contentId: body.content_id,\n  publisherId: body.publisher_id,\n  contentType,\n  isAiGenerated,\n  modelId: body.model_id,\n  targetAudience,\n  isK12Audience,\n  ftcDisclosureRequired,\n  cipaFilteringRequired,\n  disclosureText,\n  complianceStatus,\n  originalPayload: body,\n  evaluatedAt: new Date().toISOString()\n}}];"
      }
    },
    {
      "id": "n3",
      "name": "IF - Disclosure Required",
      "type": "n8n-nodes-base.if",
      "typeVersion": 2,
      "position": [
        440,
        0
      ],
      "parameters": {
        "conditions": {
          "options": {},
          "conditions": [
            {
              "leftValue": "={{ $json.complianceStatus }}",
              "operator": {
                "type": "string",
                "operation": "equals"
              },
              "rightValue": "DISCLOSURE_REQUIRED"
            }
          ]
        }
      }
    },
    {
      "id": "n4",
      "name": "HTTP Request - Inject FTC Disclosure",
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4,
      "position": [
        660,
        -100
      ],
      "parameters": {
        "method": "PATCH",
        "url": "={{ $json.originalPayload.content_update_endpoint }}",
        "sendBody": true,
        "bodyParameters": {
          "parameters": [
            {
              "name": "content_id",
              "value": "={{ $json.contentId }}"
            },
            {
              "name": "disclosure_text",
              "value": "={{ $json.disclosureText }}"
            },
            {
              "name": "disclosure_standard",
              "value": "FTC_UDAP_AI_DISCLOSURE_2024"
            }
          ]
        },
        "options": {}
      }
    },
    {
      "id": "n5",
      "name": "Postgres - Log Disclosure Compliance",
      "type": "n8n-nodes-base.postgres",
      "typeVersion": 2,
      "position": [
        880,
        -100
      ],
      "parameters": {
        "operation": "executeQuery",
        "query": "INSERT INTO ftc_content_disclosure_audit (content_id, publisher_id, content_type, model_id, is_k12_audience, disclosure_injected, compliance_status, evaluated_at) VALUES ('{{ $('Code - Detect AI-Generated Content').first().json.contentId }}', '{{ $('Code - Detect AI-Generated Content').first().json.publisherId }}', '{{ $('Code - Detect AI-Generated Content').first().json.contentType }}', '{{ $('Code - Detect AI-Generated Content').first().json.modelId }}', {{ $('Code - Detect AI-Generated Content').first().json.isK12Audience }}, true, 'COMPLIANT_AFTER_INJECTION', NOW());"
      }
    },
    {
      "id": "n6",
      "name": "Slack - Flag CIPA K-12 Content",
      "type": "n8n-nodes-base.slack",
      "typeVersion": 2,
      "position": [
        880,
        -300
      ],
      "parameters": {
        "operation": "post",
        "channel": "#cipa-content-review",
        "text": "\u26a0\ufe0f *CIPA K-12 AI Content Published* | Content: `{{ $('Code - Detect AI-Generated Content').first().json.contentId }}` | Model: `{{ $('Code - Detect AI-Generated Content').first().json.modelId }}` | FTC Disclosure injected. CIPA \u00a7254(h)(5) filtering review required for K-12 distribution."
      }
    },
    {
      "id": "n7",
      "name": "Postgres - Log Compliant Content",
      "type": "n8n-nodes-base.postgres",
      "typeVersion": 2,
      "position": [
        660,
        100
      ],
      "parameters": {
        "operation": "executeQuery",
        "query": "INSERT INTO ftc_content_disclosure_audit (content_id, publisher_id, content_type, model_id, is_k12_audience, disclosure_injected, compliance_status, evaluated_at) VALUES ('{{ $json.contentId }}', '{{ $json.publisherId }}', '{{ $json.contentType }}', '{{ $json.modelId }}', {{ $json.isK12Audience }}, false, '{{ $json.complianceStatus }}', NOW());"
      }
    }
  ],
  "connections": {
    "Webhook - Content Publish Event": {
      "main": [
        [
          {
            "node": "Code - Detect AI-Generated Content",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Code - Detect AI-Generated Content": {
      "main": [
        [
          {
            "node": "IF - Disclosure Required",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "IF - Disclosure Required": {
      "main": [
        [
          {
            "node": "HTTP Request - Inject FTC Disclosure",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Postgres - Log Compliant Content",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "HTTP Request - Inject FTC Disclosure": {
      "main": [
        [
          {
            "node": "Postgres - Log Disclosure Compliance",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Postgres - Log Disclosure Compliance": {
      "main": [
        [
          {
            "node": "Slack - Flag CIPA K-12 Content",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

---

Workflow 5: Weekly EdTech AI Platform Compliance Dashboard

What it does: Every Monday at 8AM, this workflow queries Postgres for the week's AI compliance metrics — inference gate decisions, COPPA/FERPA/GDPR Art.22 blocks, human review queue status (pending, overdue), and data deletion request pipeline — and sends a tier-segmented HTML dashboard to the CEO with the compliance officer on BCC.

Why it matters: GDPR's Art.22 audit trail, COPPA's consent verification log, and NY CDPA's data minimization record are all required documentation in regulatory examinations. The compliance officer BCC is not optional ergonomics — it's a governance close: the compliance officer receives the same data as the CEO, creating a paper trail that the compliance function has line-of-sight to AI decision volumes. Overdue GDPR Art.22 reviews appear in red in the dashboard, triggered by the reviews_overdue count exceeding zero.

{
  "name": "Weekly EdTech AI Platform Compliance Dashboard",
  "nodes": [
    {
      "id": "n1",
      "name": "Schedule - Monday 8AM",
      "type": "n8n-nodes-base.scheduleTrigger",
      "typeVersion": 1,
      "position": [
        0,
        0
      ],
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "cronExpression",
              "expression": "0 8 * * 1"
            }
          ]
        }
      }
    },
    {
      "id": "n2",
      "name": "Postgres - Fetch Compliance Metrics",
      "type": "n8n-nodes-base.postgres",
      "typeVersion": 2,
      "position": [
        220,
        0
      ],
      "parameters": {
        "operation": "executeQuery",
        "query": "SELECT\n  COUNT(*) FILTER (WHERE compliance_decision = 'ALLOW' AND processed_at >= NOW() - INTERVAL '7 days') AS inferences_allowed_7d,\n  COUNT(*) FILTER (WHERE compliance_decision = 'BLOCK' AND processed_at >= NOW() - INTERVAL '7 days') AS inferences_blocked_7d,\n  COUNT(*) FILTER (WHERE violations_json::text LIKE '%COPPA%' AND processed_at >= NOW() - INTERVAL '7 days') AS coppa_blocks_7d,\n  COUNT(*) FILTER (WHERE violations_json::text LIKE '%FERPA%' AND processed_at >= NOW() - INTERVAL '7 days') AS ferpa_blocks_7d,\n  COUNT(*) FILTER (WHERE violations_json::text LIKE '%GDPR_ART_22%' AND processed_at >= NOW() - INTERVAL '7 days') AS gdpr_art22_blocks_7d\nFROM ai_inference_audit;"
      }
    },
    {
      "id": "n3",
      "name": "Postgres - Fetch Review Queue Status",
      "type": "n8n-nodes-base.postgres",
      "typeVersion": 2,
      "position": [
        220,
        200
      ],
      "parameters": {
        "operation": "executeQuery",
        "query": "SELECT\n  COUNT(*) FILTER (WHERE review_status = 'PENDING') AS reviews_pending,\n  COUNT(*) FILTER (WHERE review_status = 'PENDING' AND review_due_at < NOW()) AS reviews_overdue,\n  COUNT(*) FILTER (WHERE review_status = 'COMPLETED' AND updated_at >= NOW() - INTERVAL '7 days') AS reviews_completed_7d,\n  COUNT(*) FILTER (WHERE created_at >= NOW() - INTERVAL '7 days') AS reviews_created_7d\nFROM gdpr_art22_review_queue;"
      }
    },
    {
      "id": "n4",
      "name": "Postgres - Fetch Deletion Requests",
      "type": "n8n-nodes-base.postgres",
      "typeVersion": 2,
      "position": [
        220,
        400
      ],
      "parameters": {
        "operation": "executeQuery",
        "query": "SELECT\n  COUNT(*) FILTER (WHERE status = 'IN_PROGRESS') AS deletions_in_progress,\n  COUNT(*) FILTER (WHERE status = 'IN_PROGRESS' AND compliance_deadline < NOW()::date) AS deletions_overdue,\n  COUNT(*) FILTER (WHERE status = 'COMPLETED' AND received_at >= NOW() - INTERVAL '7 days') AS deletions_completed_7d,\n  COUNT(*) FILTER (WHERE received_at >= NOW() - INTERVAL '7 days') AS deletion_requests_7d\nFROM student_deletion_requests;"
      }
    },
    {
      "id": "n5",
      "name": "Merge - Combine Metrics",
      "type": "n8n-nodes-base.merge",
      "typeVersion": 3,
      "position": [
        440,
        200
      ],
      "parameters": {
        "mode": "combine",
        "combinationMode": "multiplex"
      }
    },
    {
      "id": "n6",
      "name": "Code - Build HTML Report",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        660,
        200
      ],
      "parameters": {
        "jsCode": "const compliance = $input.all()[0].json;\nconst reviewQueue = $input.all()[1].json;\nconst deletions = $input.all()[2].json;\n\nconst blockRate = compliance.inferences_allowed_7d > 0\n  ? ((compliance.inferences_blocked_7d / (compliance.inferences_allowed_7d + compliance.inferences_blocked_7d)) * 100).toFixed(1)\n  : 0;\n\nconst html = `<h2>EdTech AI Platform Weekly Compliance Dashboard</h2>\n<p>Week ending: ${new Date().toISOString().split('T')[0]}</p>\n\n<h3>AI Inference Compliance Gate</h3>\n<table border='1' cellpadding='6'>\n<tr><th>Metric</th><th>This Week</th></tr>\n<tr><td>Inferences Allowed</td><td>${compliance.inferences_allowed_7d}</td></tr>\n<tr><td>Inferences Blocked</td><td style='color:${compliance.inferences_blocked_7d > 0 ? \"red\" : \"green\"}'>${compliance.inferences_blocked_7d}</td></tr>\n<tr><td>Block Rate</td><td>${blockRate}%</td></tr>\n<tr><td>COPPA \u00a7312.5 Blocks</td><td style='color:${compliance.coppa_blocks_7d > 0 ? \"red\" : \"green\"}'>${compliance.coppa_blocks_7d}</td></tr>\n<tr><td>FERPA \u00a71232g Blocks</td><td style='color:${compliance.ferpa_blocks_7d > 0 ? \"red\" : \"green\"}'>${compliance.ferpa_blocks_7d}</td></tr>\n<tr><td>GDPR Art.22 Blocks</td><td style='color:${compliance.gdpr_art22_blocks_7d > 0 ? \"red\" : \"green\"}'>${compliance.gdpr_art22_blocks_7d}</td></tr>\n</table>\n\n<h3>GDPR Art.22 Human Review Queue</h3>\n<table border='1' cellpadding='6'>\n<tr><th>Metric</th><th>Status</th></tr>\n<tr><td>Pending Reviews</td><td style='color:${reviewQueue.reviews_pending > 0 ? \"orange\" : \"green\"}'>${reviewQueue.reviews_pending}</td></tr>\n<tr><td>OVERDUE Reviews</td><td style='color:${reviewQueue.reviews_overdue > 0 ? \"red\" : \"green\"}'><strong>${reviewQueue.reviews_overdue}</strong></td></tr>\n<tr><td>Completed This Week</td><td>${reviewQueue.reviews_completed_7d}</td></tr>\n</table>\n\n<h3>Data Deletion Compliance</h3>\n<table border='1' cellpadding='6'>\n<tr><th>Metric</th><th>Status</th></tr>\n<tr><td>New Requests This Week</td><td>${deletions.deletion_requests_7d}</td></tr>\n<tr><td>In Progress</td><td>${deletions.deletions_in_progress}</td></tr>\n<tr><td>OVERDUE</td><td style='color:${deletions.deletions_overdue > 0 ? \"red\" : \"green\"}'><strong>${deletions.deletions_overdue}</strong></td></tr>\n<tr><td>Completed This Week</td><td>${deletions.deletions_completed_7d}</td></tr>\n</table>\n\n<p><em>Powered by self-hosted n8n \u2014 AI inference data, student PII, and deletion audit trails never leave your VPC.</em></p>`;\n\nreturn [{ json: { html, blockRate, reviewsOverdue: reviewQueue.reviews_overdue, deletionsOverdue: deletions.deletions_overdue }}];"
      }
    },
    {
      "id": "n7",
      "name": "Gmail - Send to CEO + BCC Compliance Officer",
      "type": "n8n-nodes-base.gmail",
      "typeVersion": 2,
      "position": [
        880,
        200
      ],
      "parameters": {
        "operation": "send",
        "toList": "[e-mail]",
        "bccList": "[e-mail]",
        "subject": "EdTech AI Compliance Dashboard \u2014 Week of {{ $now.toISODate() }} | Overdue: {{ $json.reviewsOverdue + $json.deletionsOverdue }}",
        "message": "={{ $json.html }}",
        "options": {
          "isHtml": true
        }
      }
    }
  ],
  "connections": {
    "Schedule - Monday 8AM": {
      "main": [
        [
          {
            "node": "Postgres - Fetch Compliance Metrics",
            "type": "main",
            "index": 0
          },
          {
            "node": "Postgres - Fetch Review Queue Status",
            "type": "main",
            "index": 0
          },
          {
            "node": "Postgres - Fetch Deletion Requests",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Postgres - Fetch Compliance Metrics": {
      "main": [
        [
          {
            "node": "Merge - Combine Metrics",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Postgres - Fetch Review Queue Status": {
      "main": [
        [
          {
            "node": "Merge - Combine Metrics",
            "type": "main",
            "index": 1
          }
        ]
      ]
    },
    "Postgres - Fetch Deletion Requests": {
      "main": [
        [
          {
            "node": "Merge - Combine Metrics",
            "type": "main",
            "index": 2
          }
        ]
      ]
    },
    "Merge - Combine Metrics": {
      "main": [
        [
          {
            "node": "Code - Build HTML Report",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Code - Build HTML Report": {
      "main": [
        [
          {
            "node": "Gmail - Send to CEO + BCC Compliance Officer",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

---

The Self-Hosted n8n Argument for EdTech AI

EdTech AI vendors face a structural problem with cloud iPaaS tools (Zapier, Make):

Data Type	Zapier/Make Risk	Self-Hosted n8n
Student inference payloads (age, grade, behavioral data)	FERPA §1232g unauthorized disclosure to third party	Stays in your VPC
COPPA parental consent records	Third-party subprocessor = separate COPPA DPA required	Internal Postgres only
GDPR Art.22 decision logs	EU adequacy decision required for US transfer	On-prem or EU-region deploy
AI model API keys (OpenAI, Anthropic)	Secret visible in cloud iPaaS vendor's infrastructure	Stored in n8n credential vault
NY CDPA deletion audit trail	Chain-of-custody gap when deletion routes through cloud	End-to-end within your systems

Self-hosted n8n eliminates the third-party cloud subprocessor from the FERPA/COPPA/GDPR data flow entirely. The workflow engine runs in your VPC, accesses your Postgres directly, and calls AI model APIs from your IP space. The DPA your school district signed covers your system — not a Zapier server in AWS us-east-1.

---

Ready-to-Use Templates

These 5 workflows are part of the FlowKit n8n automation template library:

• Browse all 15 templates → (Email Auto-Responder, AI Customer Support Bot, Lead Capture to CRM, and more)
• Individual templates: $12–$29 | Bundle (all 15): $97

---

Pro Tips

1. Consent version-lock: Store the exact COPPA/GDPR consent version in student_ai_consent — regulations update and you need to prove which consent text was in effect at inference time.
2. FERPA legitimate interest types: The ferpa_legitimate_interest_type field should enumerate your specific use cases (e.g., PERSONALIZED_TUTORING, EARLY_INTERVENTION, ASSESSMENT_GRADING) — the school's FERPA notice must list these explicitly.
3. GDPR Art.22 review SLA monitoring: Add a second Schedule trigger (daily 7AM) that queries gdpr_art22_review_queue WHERE review_status = 'PENDING' AND review_due_at < NOW() and escalates overdue reviews to the compliance officer.
4. UNESCO transparency layer: Add a model_card_url field to every AI decision log — the UNESCO AI in Education Recommendation requires explainability documentation accessible to educators.
5. CIPA filtering pre-check: For K-12 content, add an HTTP Request node before the content publish webhook that calls your content safety API — blocking CIPA-violating content before it reaches the disclosure workflow is cheaper than the post-publish remediation.

---

Found these useful? Follow @flowkithq for more compliance-focused n8n automation guides.