Summary. Schools and the companies that sell to them operate under statutes written decades apart, overlapping unevenly, enforced by agencies with very different tools. A district can be simultaneously a FERPA-covered educational agency, a Title IX recipient, a Section 504 and IDEA obligor, a state actor subject to the First and Fourth Amendments, and a customer whose vendor contracts determine whether it has just disclosed student data unlawfully. This article works through each regime in the order it usually arises: what FERPA protects and how the school official exception makes most edtech lawful, how COPPA and state student privacy statutes reach vendors directly, what Title IX requires procedurally, how Section 504 and the IDEA differ, and where constitutional limits constrain discipline, speech, and searches.

A district adopts a reading platform. Teachers love it. The vendor's pitch mentioned that the product improves through machine learning on aggregated usage data.

Eight months later a parent asks a question the district cannot answer: who else has my child's data, and what are they doing with it?

The district's counsel finds the following. The vendor was engaged under a click-through agreement signed by a curriculum director. That agreement grants the vendor a perpetual license to use "Customer Data" — undefined — for product improvement and for "developing new offerings." The vendor's subprocessor list includes an analytics company and an advertising measurement provider. The vendor's privacy policy permits sharing de-identified data with unspecified partners. There is no provision requiring the vendor to act under the district's direct control, no restriction on secondary use, no deletion obligation, and no acknowledgment that the vendor is a school official under FERPA.

Under 34 C.F.R. § 99.31(a)(1), the vendor could have been treated as a school official with a legitimate educational interest, permitting the disclosure without parental consent — but only if the district had determined that the vendor performs a service the district would otherwise use employees for, that the vendor is under the district's direct control with respect to the use and maintenance of the records, and that the vendor uses the data only for authorized purposes and does not redisclose it. The agreement establishes none of that.

So the disclosure was not authorized. It was also, quite possibly, a violation of the state's student data privacy statute, which prohibits targeted advertising and secondary use and applies directly to the vendor. And because some users were under 13 and the vendor relied on the district's consent, COPPA questions arise as well.

Nobody acted in bad faith. A curriculum director clicked "accept," which is how most of these problems begin.

FERPA

The Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g, with regulations at 34 C.F.R. Part 99, applies to educational agencies and institutions receiving federal funds from the Department of Education — which is nearly every public school district, public college, and most private colleges.

What it protects: "education records" — records directly related to a student and maintained by the institution or a party acting for it. Exclusions matter: sole possession notes of an individual kept as a personal memory aid and not shared; law enforcement unit records created for a law enforcement purpose; employment records of an employee who is not also a student; treatment records of an eligible student made by a professional in connection with treatment; alumni records created after the student left; and grades on peer-graded papers before collection by the teacher.

Rights it confers — held by the parent until the student turns 18 or attends a postsecondary institution, at which point the student becomes an eligible student and the rights transfer:

  • Inspect and review the records within 45 days of a request.
  • Seek amendment of records that are inaccurate, misleading, or in violation of privacy rights — with a hearing if the request is denied, and a right to insert a statement of disagreement. Note that this is not a mechanism to challenge a grade or a disciplinary finding on the merits.
  • Consent to disclosure of personally identifiable information, in a signed and dated writing specifying the records, the purpose, and the recipient.
  • File a complaint with the Department's Student Privacy Policy Office — the exclusive federal remedy, since FERPA creates no private right of action.
  • Annual notification of these rights.

Disclosures permitted without consent — the list that makes schools operable:

  • School officials with a legitimate educational interest, including contractors, consultants, volunteers, and other outside parties who meet the three conditions above. This is the provision that governs virtually all edtech.
  • Other schools to which the student seeks or intends to enroll.
  • Authorized representatives for audit and evaluation of education programs, and for studies conducted for or on behalf of the school, under a written agreement.
  • Financial aid purposes.
  • Accrediting organizations.
  • Judicial order or lawfully issued subpoena, generally with a reasonable effort to notify the parent first.
  • Health or safety emergency, where knowledge is necessary to protect the health or safety of the student or others — a standard that is narrower than school officials sometimes assume, and that requires a contemporaneous record of the articulable threat.
  • Directory information, if the school has given public notice of the categories designated and a reasonable time to opt out. Directory information may include name, address, telephone, email, date and place of birth, participation in activities, dates of attendance, degrees and honors, and the most recent school attended. It may not include Social Security number, and the school may not designate as directory information anything from which a student's identity can be inferred that is not on the permitted list.
  • Disclosures to the parent of a dependent student for tax purposes.
  • Certain disciplinary results in the case of crimes of violence or non-forcible sex offenses at postsecondary institutions.

Recordkeeping. The school must maintain a record of disclosures — who received the information and their legitimate interest — available for inspection by the parent, with exceptions for school officials, directory information, and consented disclosures.

Enforcement. The ultimate sanction is termination of federal funding, which has never been imposed. Practical enforcement is investigation, findings, and corrective action. And note that FERPA violations frequently become state law problems, since many states have statutes with enforcement mechanisms FERPA lacks.

The de-identification standard, at 34 C.F.R. § 99.31(b), permits release of de-identified records where the school has made a reasonable determination that a student's identity is not personally identifiable, taking into account other reasonably available information — a standard that is more demanding than removing names, and that must account for small-cell re-identification risk in a class or a school.

The vendor layer: COPPA and state student privacy laws

COPPA — the Children's Online Privacy Protection Act, 15 U.S.C. §§ 6501–6506, and the FTC's Rule at 16 C.F.R. Part 312 — applies to operators of websites or online services directed to children under 13, or with actual knowledge that they collect personal information from children under 13.

Requirements: a clear privacy notice; verifiable parental consent before collection, use, or disclosure; a parental right to review and delete; a prohibition on conditioning participation on collecting more information than is reasonably necessary; data minimization and retention limits; and reasonable security, including vendor oversight.

The school consent mechanism. The FTC has taken the position that a school may provide consent on behalf of parents where the operator collects personal information from students for the use and benefit of the school, and for no other commercial purpose. That position — reflected in FTC guidance and reinforced in amendments to the Rule — carries conditions: the operator must provide the school with the required notice, must not use the information for its own commercial purposes such as advertising or building user profiles, must limit retention, and the school must have direct notice of what is collected and how it is used. An operator relying on school consent while also using the data to improve or market its own products is outside the safe harbor.

The 2025 amendments to the COPPA Rule strengthened several requirements, including separate consent for third-party disclosure, a written children's data security program, mandatory retention limits with a published retention policy, and clarified obligations for mixed-audience services.

State student data privacy laws are the layer that reaches vendors most directly. Beginning with California's Student Online Personal Information Protection Act and now enacted in a large majority of states, these statutes typically:

  • Apply directly to operators of sites and services designed and marketed for K-12 school purposes.
  • Prohibit targeted advertising based on covered information.
  • Prohibit creating a profile except in furtherance of school purposes.
  • Prohibit selling covered information.
  • Prohibit disclosing it except in enumerated circumstances.
  • Require reasonable security and deletion at the school's request.
  • Some require contracts with specified terms, vendor registration, data breach notification with short deadlines, and public listing of contracts.

These statutes generally have no private right of action but are enforced by state attorneys general, and several have produced enforcement actions.

The Protection of Pupil Rights Amendment, 20 U.S.C. § 1232h, adds consent and notice requirements for surveys funded by the Department that concern eight protected categories (political affiliations, mental or psychological problems, sex behavior, illegal or self-incriminating behavior, critical appraisals of family members, privileged relationships, religious practices, and income), and for the collection of student information for marketing purposes.

What a district's vendor contract should require — and what a vendor selling to districts should expect to sign:

  • Designation as a school official with a legitimate educational interest, and an acknowledgment of the district's direct control over use and maintenance.
  • Purpose limitation: use only to provide the contracted service; no secondary use, including product improvement or model training, without separate written authorization.
  • No advertising, no profiling, no sale.
  • Subprocessor disclosure and approval, with flow-down.
  • Security requirements with specificity — encryption, access control, logging, testing — and a breach notification clock measured in hours, plus cost allocation for notification.
  • Deletion and return of data on termination, within a defined period, with certification.
  • Assistance with parent access and amendment requests.
  • Audit rights or delivery of independent assessments.
  • Accessibility conformance representation.
  • Prohibition on redisclosure, and on retaining data after the contract ends.
  • Insurance and indemnity for privacy and security breaches, carved out of any liability cap.

Title IX

20 U.S.C. § 1681 prohibits discrimination on the basis of sex in any education program or activity receiving federal financial assistance. Its scope covers admissions in some contexts, athletics, employment, and — most consequentially in practice — sexual harassment and sexual violence, treated as forms of sex discrimination.

The private right of action exists by implication, and the standards for institutional liability in damages are demanding. A recipient is liable for teacher-on-student harassment only where an official with authority to institute corrective measures had actual knowledge and responded with deliberate indifference. Gebser v. Lago Vista Independent School District, 524 U.S. 274 (1998). For student-on-student harassment, liability requires actual knowledge, deliberate indifference, and harassment "so severe, pervasive, and objectively offensive that it effectively bars the victim's access to an educational opportunity or benefit." Davis v. Monroe County Board of Education, 526 U.S. 629 (1999).

Administrative enforcement by the Department's Office for Civil Rights uses a different and lower standard than the damages standard, which is why an institution can be found out of compliance administratively without being liable in damages — and why compliance should be built to the regulatory standard rather than the litigation one.

The regulatory framework has changed repeatedly, with successive administrations issuing substantially different rules on the definition of covered conduct, the geographic and programmatic scope, the standard of evidence, live hearings and cross-examination, informal resolution, and the treatment of gender identity — and with litigation vacating or enjoining rules in whole or in part. Any institution must verify which version of the regulations currently applies to it.

The elements that have been stable across versions, and that an institution should have regardless:

  • A designated Title IX Coordinator, publicly identified with contact information.
  • A published nondiscrimination notice and grievance procedures.
  • Actual knowledge / notice rules defining who must report and what triggers the institution's obligations, and training for employees on them.
  • Supportive measures available to both parties regardless of whether a formal complaint is filed — counseling, schedule changes, no-contact orders, housing changes, academic accommodations.
  • A prompt and equitable grievance process with an objective evaluation of all relevant evidence, decision-makers free from bias and conflict, a presumption of non-responsibility until a determination, written notice of allegations, an equal opportunity to present evidence and witnesses, access to the evidence, a written determination with rationale, and an appeal.
  • Emergency removal provisions with an individualized safety and risk analysis and an opportunity to challenge.
  • Anti-retaliation protection.
  • Training for coordinators, investigators, decision-makers, and informal resolution facilitators, with materials publicly posted.
  • Recordkeeping, typically seven years.

Athletics compliance is a distinct workstream governed by its own regulations and the three-part test for effective accommodation of interests and abilities, plus equal treatment across the enumerated program components and proportional athletic financial assistance.

Overlaps to manage: the Clery Act for postsecondary institutions, which imposes its own reporting, timely warning, annual security report, and victims' rights obligations; state mandatory child abuse reporting, which is not discretionary and operates independently of Title IX processes; employment claims under Title VII, which follow different procedures and deadlines; and FERPA, which constrains what may be disclosed about the process while Title IX requires disclosures to the parties — a tension the regulations resolve in favor of the required disclosures.

Disability: Section 504 and the IDEA

Two statutes cover overlapping ground, and the differences are practical.

Section 504 of the Rehabilitation Act, 29 U.S.C. § 794, prohibits discrimination on the basis of disability by recipients of federal financial assistance. Title II of the ADA imposes parallel obligations on public entities regardless of funding, and Title III reaches private schools as places of public accommodation (with a religious entity exemption).

Coverage under Section 504 uses the ADA definition: a physical or mental impairment that substantially limits a major life activity, a record of such an impairment, or being regarded as having one. The ADA Amendments Act broadened this considerably — mitigating measures other than ordinary eyeglasses are not considered, episodic conditions are evaluated in their active state, and the term is to be construed broadly.

Obligations: a free appropriate public education, which under Section 504 means regular or special education and related aids and services designed to meet the individual's needs as adequately as the needs of non-disabled students are met; reasonable accommodations and modifications; program accessibility; and procedural safeguards including notice, an opportunity to examine records, an impartial hearing, and review.

A "504 Plan" documents accommodations — extended time, preferential seating, assistive technology, modified assignments, health care plans, testing modifications.

The IDEA, 20 U.S.C. § 1400 et seq., is a funding statute with far more prescriptive requirements. It covers children with one of thirteen enumerated disability categories who, by reason thereof, need special education and related services. Both prongs are required — a diagnosis alone does not qualify a child.

Core requirements:

  • Child find — an affirmative obligation to identify, locate, and evaluate children with disabilities, including those in private schools and those who are homeless or highly mobile.
  • Evaluation in all areas of suspected disability, by a multidisciplinary team, with parental consent, within statutory timelines.
  • An individualized education program developed by a team including the parents, containing present levels of performance, measurable annual goals, services and supports with frequency and duration, participation with non-disabled peers, accommodations for assessments, and transition planning beginning by age 16.
  • The least restrictive environment — education with non-disabled peers to the maximum extent appropriate.
  • Procedural safeguards — prior written notice, consent, independent educational evaluations at public expense in defined circumstances, mediation, due process hearings, and the stay-put provision maintaining the current placement during proceedings.
  • Discipline protections — a manifestation determination before a change of placement exceeding ten school days, continued services during removal, and special rules for weapons, drugs, and serious bodily injury.

The substantive standard. Board of Education v. Rowley, 458 U.S. 176 (1982), required an IEP reasonably calculated to enable the child to receive educational benefits. Endrew F. v. Douglas County School District RE-1, 580 U.S. 386 (2017), clarified that the IEP must be "reasonably calculated to enable a child to make progress appropriate in light of the child's circumstances" — a standard "markedly more demanding" than merely more than de minimis progress.

Remedies include compensatory education, reimbursement for unilateral private placement where the public placement was inappropriate and the private one proper, and attorney's fees to a prevailing parent. Exhaustion of IDEA administrative procedures is generally required before suit, with the Supreme Court having clarified that exhaustion is not required for claims seeking relief the IDEA cannot provide, such as compensatory damages under the ADA.

Digital accessibility deserves separate mention because it is where districts and edtech vendors are most exposed. Websites, learning platforms, documents, and video must be accessible; the Department of Justice's rule under Title II establishes WCAG 2.1 Level AA as the technical standard for state and local government entities, with compliance dates tiered by population. Districts should require conformance representations and accessibility conformance reports from vendors, and vendors should expect to produce them.

Constitutional limits

Public schools are state actors, and private schools generally are not — which is the single most important distinction in this section.

Student speech. Tinker v. Des Moines Independent Community School District, 393 U.S. 503 (1969) — students do not shed their rights at the schoolhouse gate, and speech may be restricted only where it would materially and substantially disrupt the work and discipline of the school or invade the rights of others. Three exceptions permit greater regulation: lewd, vulgar, or plainly offensive speech (Bethel School District v. Fraser, 478 U.S. 675 (1986)); school-sponsored expression bearing the school's imprimatur, regulable for legitimate pedagogical concerns (Hazelwood School District v. Kuhlmeier, 484 U.S. 260 (1988)); and speech reasonably viewed as promoting illegal drug use (Morse v. Frederick, 551 U.S. 393 (2007)).

Off-campus speech. Mahanoy Area School District v. B.L., 594 U.S. 180 (2021) — schools have a diminished interest in regulating off-campus speech, though not none. The Court declined to draw a bright line but identified features that reduce the school's authority: the school rarely stands in loco parentis off campus, regulating off-campus speech plus on-campus speech would cover all the speech a student utters, and schools have an interest in protecting unpopular expression. Serious bullying and harassment, threats, and breaches of security remain regulable.

Searches. New Jersey v. T.L.O., 469 U.S. 325 (1985) — school searches require reasonable suspicion, not probable cause, and must be justified at inception and reasonable in scope. Safford Unified School District #1 v. Redding, 557 U.S. 364 (2009) — a strip search requires suspicion of danger or of concealment in underclothing; general suspicion of contraband is insufficient. Student devices raise unresolved questions, and searching a phone is different in kind from searching a backpack. Where a district issues devices, its acceptable use policy and monitoring disclosures do substantial work.

Discipline and due process. Goss v. Lopez, 419 U.S. 565 (1975) — a suspension of ten days or fewer requires notice of the charges, an explanation of the evidence, and an opportunity to present the student's side, which may be an informal conversation. Longer suspensions and expulsions require more formal process, defined largely by state law and district policy.

Other constitutional issues recurring in schools: religion in the curriculum and at school events; compelled speech; dress codes and hair policies, now constrained in many states by CROWN Act legislation; equal protection claims; and Section 1983 as the vehicle for constitutional claims, subject to qualified immunity for individual defendants and Monell limits on entity liability.

Conclusion

Three practical points cut across all of this.

The vendor contract is the district's privacy program. FERPA permits nearly everything a school needs to do with edtech, through the school official exception — but only if the contract establishes direct control, purpose limitation, no secondary use, and deletion. A click-through acceptance by a staff member establishes none of those, and it is how the majority of student data problems begin. Districts should route every service through procurement with a standard rider; vendors should build the rider into their standard terms and treat it as a sales advantage.

Process failures generate more liability than substantive ones. In Title IX, in Section 504, and in the IDEA, the recurring findings are procedural: no coordinator, no notice, no evaluation within the timeline, no manifestation determination, no written determination with rationale. The substantive judgment calls are protected by deference in a way the procedural steps are not.

Public schools are state actors, and the constitutional layer is separate. A disciplinary decision may satisfy the code of conduct, the Title IX regulations, and the IDEA, and still fail Goss, Tinker, or T.L.O. That analysis has to be run on its own.

A worked example: procuring an AI tutoring tool

A district wants to pilot an adaptive tutoring product that adjusts to each student's performance and generates written feedback. The vendor's model improves as it sees more student work. Here is the analysis, in the order it should be run.

Is the data an education record? Yes. Student names, assignment submissions, performance data, and generated feedback are records directly related to identifiable students, maintained by a party acting for the district.

Is there a lawful basis to disclose it? The school official exception, if — and only if — the district determines that the vendor performs an institutional service the district would otherwise use employees for, that the vendor is under the district's direct control as to use and maintenance, that the vendor uses the data only for authorized purposes, and that it does not redisclose.

Does model training fit inside "authorized purposes"? This is the question the pilot turns on. Training the vendor's general model on student work is a use for the vendor's benefit, not the district's, and it is not an authorized purpose unless the district authorizes it — which it can, though most state student privacy statutes independently prohibit using covered information for purposes other than school purposes, and several prohibit creating profiles. The workable answers are a contractual prohibition on training the general model, or training confined to a district-specific instance with the data deleted on termination, or genuinely de-identified training data under the § 99.31(b) standard with a written re-identification analysis.

Are any users under 13? Then COPPA applies to the vendor, and the district's consent substitutes for parental consent only where the collection is for the use and benefit of the school and no other commercial purpose. Model training for the vendor's benefit takes the arrangement outside that condition.

What does the state statute say? In most states: no targeted advertising, no sale, no profiling except for school purposes, security requirements, deletion on request, and in several states a mandatory contract with specified terms and a public listing.

What about the outputs? Generated feedback about a student, maintained by the vendor on the district's behalf, is itself an education record. Parents may inspect it, may seek amendment of it, and may ask how it was produced. If the district cannot explain the basis for an automated recommendation that affected placement or grading, that is a substantive problem as well as a privacy one.

Accessibility. The platform must conform to WCAG 2.1 AA, and the district should require an accessibility conformance report before the pilot rather than after complaints.

Equity review. If the tool influences placement, grouping, or intervention decisions, the district should evaluate whether it produces disparate outcomes by race, disability, or English learner status — both because that is a Title VI and Section 504 question and because the district, not the vendor, will answer for the placement decisions.

The pilot agreement therefore contains: school official designation, purpose limitation with an explicit prohibition on training the general model, no advertising or profiling or sale, subprocessor disclosure and approval, security specifics, a 24-hour breach notification clock with cost allocation, deletion and certification at termination, cooperation with parent access and amendment requests, an accessibility conformance representation, audit rights, insurance, and an indemnity carved out of the liability cap.

That agreement takes a few weeks to negotiate. The alternative — a click-through — takes ten seconds and produces the situation described at the top of this article.

Frequently asked questions

Can a teacher post student work publicly? Only with consent, or if it falls within properly designated directory information and the parent has not opted out. Photographs and names together are the common failure.

Can parents see everything? They can inspect education records, which excludes sole possession notes, law enforcement unit records, and certain treatment records. They cannot use the amendment process to challenge a grade on the merits.

Does FERPA give a parent the right to sue? No. The remedy is a complaint to the Department. State statutes may provide more, and a contract with a vendor may create rights the district can enforce.

Do we need a 504 plan and an IEP? A student who qualifies under the IDEA receives an IEP, and the IEP subsumes the accommodations a 504 plan would provide. A student who has a disability but does not need special education receives a 504 plan. Many districts wrongly treat 504 as a lesser tier to be tried first; the correct question is whether the child needs specially designed instruction.

Can we discipline a student for a social media post made at home? Sometimes. Mahanoy diminished but did not eliminate school authority off campus, and serious harassment, threats, and cheating remain regulable. Ordinary criticism of the school, made off campus and outside school hours, is generally protected.

Can we search a student's phone? Only on reasonable suspicion that the search will turn up evidence of a violation, and the scope must be reasonably related to the objectives. A general suspicion of misconduct does not justify reviewing everything on a device.

Which version of the Title IX regulations applies to us? Verify it directly. The rules have been amended, litigated, vacated in part, and enjoined in some jurisdictions and not others, and an institution operating on outdated procedures is exposed on the process elements that generate most findings.

For the vendor selling into schools

The obligations run in both directions, and a company that treats district compliance requirements as friction will lose deals to one that treats them as a product feature.

Build the contract terms into the standard agreement. School official designation, purpose limitation, no advertising or profiling or sale, subprocessor transparency, deletion on termination, and breach notification. A vendor whose master agreement already contains these clears procurement in weeks rather than months.

Publish a data inventory. What is collected, by whom, for what purpose, where it is stored, how long it is retained, and who else touches it. Districts increasingly must publish this; a vendor that supplies it saves the district work and removes the most common objection.

Get the security assessment done before it is asked for. A SOC 2 Type II report or an equivalent independent assessment, a penetration test within the last year, and a documented incident response plan.

Produce an accessibility conformance report against WCAG 2.1 AA, honestly, including known gaps and a remediation timeline. An honest report with gaps is far better received than a conformance claim that fails on inspection.

Register where required. Several states require operators serving their districts to register or to be listed, and a few impose direct enforcement on unregistered vendors.

Decide the model training question deliberately and disclose it plainly. If the product improves by learning from student work, say so, explain what is used and what is not, and offer a configuration that turns it off. Discovering that answer through a parent's question is the worst possible sequence for both the vendor and the district.

Related articles

This article is provided for general informational purposes and does not constitute legal advice. Title IX regulations have changed repeatedly and portions have been subject to vacatur and injunction; state student privacy statutes vary substantially. Consult qualified education counsel before adopting a vendor, revising grievance procedures, or making a placement or discipline decision.