AI in the Classroom and FERPA: What Teachers Need to Know Before Using AI Tools

Before using an AI tool with students, teachers should confirm it is approved by their district, because FERPA lets schools share student education records with a vendor without parental consent only under specific conditions. The tool must serve a school function, stay under the school's direct control, and use data only for the authorized purpose. Never paste identifiable student information into an unapproved AI tool.

Why does FERPA matter for AI in the classroom?

FERPA matters because many AI tools work by sending what you type or upload to a vendor's servers. If that content includes personally identifiable information from student education records, such as names with grades, essays, or behavior notes, sharing it is a disclosure that FERPA governs.

The rule is not new, but generative AI makes the risk easier to trigger. A teacher who pastes a class roster with reading scores into a free chatbot to draft groupings may have disclosed student records to a company the district has no agreement with.

This article explains what the rules say and offers a practical checklist. It is not legal advice; confirm specifics with your district's privacy officer or legal counsel.

Are teachers getting school AI policy guidance?

Many are not. Reporting on a 2026 Gallup and Walton Family Foundation survey, Axios found that around eight in ten US K-12 teachers said they had received no formal guidance on using AI tools in their work. The same report notes that 71% had no guidance on using AI for feedback or coaching on their teaching, and 69% had none on using AI for one on one tutoring. Guidance that did exist was often informal, and teachers in wealthier schools were more likely to receive it.

Students are already using these tools. In a Hanover Research survey published on K12 Dive in October 2026, 54% of parents and staff said students use AI tools for schoolwork, while 56% of staff said safeguards are in place to protect privacy and data when AI is used at school. The survey covered nearly 300 parents and educators, so treat it as a snapshot rather than a national measure.

The gap is clear: use is ahead of policy. Until your district publishes generative AI guidance for teachers, the safest default is to treat any tool that touches student data as needing approval.

What does FERPA say about sharing student data with AI tools?

FERPA generally requires parental consent before a school discloses personally identifiable information from education records, with exceptions. The one that covers most edtech, including AI tools, is the school official exception.

According to the Department of Education's FAQ on who counts as a school official under FERPA, an outside vendor can qualify only when it:

1. Performs a service or function the school would otherwise use its own employees for.
2. Is under the school's direct control regarding the use and maintenance of education records.
3. Uses the information only for the purpose it was disclosed for, and follows the rules on redisclosure.
4. Meets the criteria in the school's annual FERPA notification for school officials with a legitimate educational interest.

The Department's Privacy Technical Assistance Center guidance on protecting student privacy while using online educational services adds that providers using FERPA protected data under this exception may not sell it or use it for targeted advertising.

Can a teacher just click "I agree" on an AI tool's terms?

Usually not on their own. The same PTAC guidance on online educational services explains that clicking "accept" on a provider's terms of service can create a binding agreement for the school. It recommends that districts limit who may accept such click wrap terms and run free tools through the same approval process as paid ones.

That guidance also flags metadata, such as time on task and click patterns. Once fully de identified, metadata is not protected by FERPA, and a provider may reuse it unless the agreement says otherwise. This is one reason written data agreements matter.

What about students under 13 and COPPA?

For younger students, the Children's Online Privacy Protection Act also applies to the vendor. The Federal Trade Commission's COPPA guidance for edtech companies and schools says a school can consent on behalf of parents only for a school authorized educational purpose, not for commercial uses such as targeted advertising or building profiles. It adds that the school must be able to review and have deleted the information collected from its students.

Many consumer AI chatbots also set their own minimum age in their terms. Check those terms before assigning any AI tool to students.

What does federal guidance say about AI in schools?

Federal guidance encourages responsible use rather than banning it. In July 2025, the Department of Education issued a Dear Colleague letter on AI use in schools stating that federal grant funds may support uses such as AI enhanced instructional materials and tutoring, provided they follow existing requirements. It lists attention to user privacy and engaging parents among its principles for responsible adoption.

In other words, the same privacy rules apply to AI as to any other edtech. The question for teachers is not "is AI allowed?" but "is this specific tool approved for this specific use of student data?"

How do you vet an AI or video tool for student data privacy?

Use this checklist before you bring any AI tool, or any video platform with AI features, into your classroom:

1. Is it on the district's approved list? If not, ask your technology or privacy office to review it before use.
2. Is there a signed data privacy agreement? Look for one that names what data is collected, how it is used, and when it is deleted.
3. Is student data used to train the vendor's AI models? Get the answer in writing.
4. Who can see what? Check role based access, so students see only what they should and analytics stay with teachers.
5. Can the school get data deleted? Both FERPA practice and COPPA guidance point to this.
6. Does it show ads or build profiles? Either is a red flag for student use.
7. Does a person review AI output? For tools that draft quizzes, summaries, or feedback, the teacher should approve content before students see it.
8. Is it accessible? Ask about WCAG conformance and captions.
9. Does it have independent security credentials? Certifications such as ISO 27001 are a useful signal, not a substitute for the agreement.

As an example of what to look for, Annoto's Lumo AI drafts quiz questions and summaries from a video for a teacher to review, and the company documents its approach to FERPA, GDPR, and accessibility and security. Whatever tool you consider, ask every vendor the same questions.

What can teachers do while waiting for a district AI policy?

Teachers can lower risk right away with a few habits:

• Never paste student names, IDs, grades, or written work into a tool your district has not approved.
• Use AI for planning tasks that need no student data, such as drafting a generic rubric or brainstorming discussion questions.
• De identify carefully if you must work with examples, and remember that small details can identify a student.
• Tell students which tools are allowed for which tasks. Our post on AI literacy for students has ideas for those conversations.

Key takeaways

• FERPA allows sharing student records with a vendor without consent only under the school official exception.
• Clicking "I agree" on an AI tool can bind your school, so use district approved tools.
• COPPA limits school consent for students under 13 to educational purposes.
• Gallup survey reporting suggests most teachers have had no formal AI guidance, so ask your district directly.
• Vet every AI or video tool for data use, model training, deletion, and teacher review of AI output.

Frequently asked questions

Is it a FERPA violation to put student work into ChatGPT?

It can be, if the work contains personally identifiable information from education records and the tool is not covered by a district agreement under the school official exception. Check with your district before sharing any identifiable student work with an AI tool.

Does FERPA ban AI in schools?

No. FERPA governs how student education records are disclosed, not which technologies schools use. Federal guidance from 2025 encourages responsible AI use while following existing privacy requirements.

Who decides which AI tools teachers can use?

Usually the district, through its technology, privacy, or curriculum office. Federal guidance recommends that districts control who can accept vendor terms on the school's behalf.

What should a school AI policy include?

At minimum, it should list approved tools, define what student data may be entered, set expectations for human review of AI output, and explain how families are informed. Confirm details with your district's counsel.

To see how an interactive video platform approaches student data, AI review, and accessibility in schools, visit Annoto's K-12 page.