FERPA and COPPA basics for school AI (not legal advice)

FERPA in brief

FERPA lets a school share student records with a contractor without parental consent if the contractor does work the school would otherwise do, is under the school's direct control for the use and upkeep of the records, and follows the limits on passing them on. The contractor may use the records only for the purposes they were shared for, and the school's annual notice must say who counts as a school official.

Federal guidance from 2014 says a vendor may use the data to deliver and improve the contracted service, and may use data stripped of identifiers for other purposes unless the contract forbids it; marketing, targeted ads and sale are out. An Aug 26, 2026 letter from the Education Department's Student Privacy Policy Office stresses parents' right to inspect all education records.

Are AI chats education records?

Probably, at a FERPA school. Class chats, teacher reviews and learning records a vendor stores for the school are likely education records, and FERPA does not distinguish "official" from "unofficial" records. Parents may inspect them, and FERPA gives a 45-day window to respond. So no school AI tool can promise that chats are never visible to anyone. Plan a parent-access path that runs through the school.

COPPA in brief

COPPA covers children under 13. The amended rule, published Apr 22, 2025, took effect on June 23, 2025 and applies from Apr 22, 2026. It bars keeping a child's data indefinitely and requires a written retention policy. Disclosures to train or otherwise develop AI technologies are not integral to a service and need separate parental consent.

In school settings, existing FTC guidance lets a school consent as the parent's agent, only in the educational context, and the FTC recommends that the school, not an individual teacher, make that decision. The FTC has also said it is unreasonable to keep children's data for speculative future uses.

PPRA

At schools that receive Education Department funds, PPRA bars requiring students to take a survey, analysis or evaluation that reveals protected areas, such as political beliefs, mental or psychological problems, religion or income, without prior written parental consent. The Aug 2026 letter treats instruments given by school staff as required, so an opt-out is not enough. An AI tool that analyzes student chats for mood, stress or family life is likely an "analysis" under PPRA.

CIPA

CIPA binds schools that take E-rate discounts, not vendors. They must filter obscene and harmful images, keep an internet safety policy that includes monitoring minors' online activity, and teach online safety. No FCC rule addresses AI chatbots; the FCC opened a broad E-rate review on June 25, 2026, with replies due Nov 12, 2026.

Private schools

Catholic and independent schools without federal education funds generally sit outside FERPA and PPRA. They are not outside COPPA, state laws that bind the vendor, the AI provider's terms or their own contracts. Build to the public-school standard anyway. Read AI for private and Catholic high schools.

How Nexus approaches it

Where FERPA applies, Nexus works as a school official under your school's direct control: student records serve only the services in the agreement, and parents can ask the school to inspect them. We do not sell student data, show ads or train or fine-tune models on it. Nexus is for students 13 and older, and enrolls no one under 13 without a school-authorized consent process. We will sign your data privacy agreement or the Student Data Privacy Consortium's National Data Privacy Agreement.