Almost every AI product sold to a school relies on one narrow regulatory exception, usually named in a single sentence of the vendor’s security page. The exception has conditions, one of which the vendor’s own standard terms of service routinely breach.
The default is consent
The Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g, with implementing regulations at 34 C.F.R. Part 99, conditions federal funding on an educational agency or institution not having a policy or practice of disclosing personally identifiable information from education records without written consent from the parent or the eligible student. Section 99.30 sets out what that consent looks like: signed and dated, specifying the records, the purpose and the party.
Per-disclosure written consent is unworkable for a district running a learning platform, so Part 99 contains a list of exceptions at § 99.31. The one every education technology vendor lives under is § 99.31(a)(1) — disclosure to school officials with a legitimate educational interest.
“Education records” is broad: records directly related to a student and maintained by the institution or a party acting for it. For an AI product this reaches more than grades. A tutoring assistant’s conversation history about a named student is a record directly related to that student, maintained by a party acting for the school. So is a risk score, an engagement metric, or a flag raised by a proctoring system.
FERPA compliance turns on the institution’s own annual notification and policies as much as on the regulation, and states impose additional student-privacy duties. This page describes the federal regulation and is not legal advice; check with the institution’s counsel and the Department of Education’s Student Privacy Policy Office.
The three conditions, and the fourth requirement
A contractor is not automatically a school official. Section 99.31(a)(1)(i)(B) sets three conditions, all of which must hold, for an outside party to be treated as one:
- The party performs an institutional service or function for which the agency or institution would otherwise use employees. This is a real limit. Grading, tutoring, scheduling, counselling triage and record-keeping pass it. A vendor collecting student data to build a product the school would never have staffed does not.
- The party is under the direct control of the agency or institution with respect to the use and maintenance of education records. This is the condition that fails most often, and the next section is about it.
- The party is subject to the requirements of § 99.33(a) governing the use and redisclosure of personally identifiable information from education records.
Two further requirements sit outside that subparagraph and are just as binding on the institution. Under § 99.7(a)(3)(iii) the annual notification of FERPA rights must specify the criteria for determining who constitutes a school official and what constitutes a legitimate educational interest — so a district whose notice does not contemplate contractors cannot rely on the exception for one. And § 99.31(a)(1)(ii) requires the institution to use reasonable methods to ensure school officials obtain access only to education records in which they have a legitimate educational interest, with the regulation noting that an institution that does not restrict access technologically must ensure administrative policy for controlling access is effective.
That last sentence is the one to bring to a system design review. A vendor granted a district-wide integration with read access to every student’s record, in order to serve a product used by one department, is difficult to square with it.
Direct control versus a training licence
“Direct control with respect to the use and maintenance of education records” means the institution decides what the vendor does with the data. The vendor acts on instruction. It is close in spirit to the processor concept in European law, though the mechanics differ.
Now read a typical AI vendor’s terms of service. They will contain a licence to use submitted content to operate, maintain and improve the services, frequently including training or evaluating models, sometimes with an opt-out available on request or on an enterprise tier. A right the vendor holds under its own terms, that the school cannot direct and did not specify, is by definition not use under the school’s direct control. If that clause survives into the executed agreement, the school official exception is not available, and the disclosure to the vendor needed consent it did not obtain.
The failure is quiet in a specific way that makes it worth checking for. Nothing errors. The product works. The gap only surfaces when a parent asks what happens to their child’s data, or when a district’s privacy review reaches the incorporated online terms rather than the negotiated master agreement. Practical checks:
- Find every document incorporated by reference — online terms, acceptable use policy, model terms — and confirm the negotiated agreement overrides them, in terms.
- Confirm the training prohibition covers the subprocessor actually running the model, not only the application vendor. A vendor that promises not to train is not making a promise about the foundation-model provider it calls unless it says so.
- Confirm deletion on termination reaches derived artefacts — embeddings, indices, fine-tuned adapters — and not just the record store.
- Confirm the institution can direct deletion of an individual student’s data mid-term, which it needs in order to honour a record amendment under § 99.20 or a withdrawal.
Redisclosure and the § 99.33 limit
Section 99.33(a) provides that a party receiving personally identifiable information from education records may disclose it to another party only on behalf of the educational agency or institution, and only if the institution has met its own notification requirements. The third condition of the school official exception imports that restriction directly.
Applied to an AI stack, this is the subprocessor question again with different words. Sending student data to a model provider is a disclosure by the vendor. It is permitted only as an act on behalf of the school, which requires that the school knows it is happening and that the downstream party is bound by the same restriction. A vendor that changes model providers without notice has, on this reading, changed who holds the records without the institution’s knowledge. Requiring a maintained subprocessor list with advance notice is not vendor-management hygiene here; it is what makes the redisclosure lawful.
Note also that § 99.31(b) permits disclosure of properly de-identified information without consent, subject to the standard in that paragraph — the institution must make a reasonable determination that a student’s identity is not personally identifiable, taking account of other reasonably available information. Vendors sometimes reach for this to justify training on “anonymised” student interactions. Free-text student writing is unusually resistant to de-identification, and the standard is about reasonable identifiability rather than about removing names.
How this is enforced, and by whom
FERPA has no private right of action. The Supreme Court held in Gonzaga University v. Doe, 536 U.S. 273 (2002), that its nondisclosure provisions do not create rights enforceable under 42 U.S.C. § 1983. Enforcement runs through the Department of Education’s Student Privacy Policy Office, which investigates complaints and seeks voluntary compliance; the statutory sanction at 20 U.S.C. § 1232g(f) is the withdrawal of federal funding, an instrument so severe it is effectively never used.
It would be a mistake to read that as low risk, for three reasons. Section 99.33(e) allows the Department to prohibit an institution from disclosing to a party that improperly redisclosed for at least five years, which is a sanction aimed squarely at the vendor’s business. State student-privacy statutes — California’s SOPIPA and its many imitators — regulate the vendor directly and carry their own enforcement, generally by a state attorney general. And a district’s contractual remedies and its willingness to renew are, in practice, the enforcement that vendors actually feel.
For products aimed at younger children, FERPA is also not the only instrument in play: a service directed to children under 13 is subject to the Children’s Online Privacy Protection Rule as well, with a different consent mechanism and a regulator that does impose civil penalties. That interaction, including the school-consent path the FTC recognises, is covered in the COPPA page.
Top comments (0)