Every app you use in your classroom collects student data. Names. Ages. Email addresses. Location. Activity logs. Test scores. Sometimes even voice recordings and browsing behavior.
Most teachers don’t think about this until something goes wrong. A district gets breached. A parent asks what data is being shared. An admin sends a panicked email about compliance.
This guide covers what you need to know about student data privacy, which laws apply, and how to make safer choices when choosing classroom tools.
The Laws You Need to Know
Student data privacy is governed by federal and state laws. Your district likely has policies built on these laws.
FERPA (Family Educational Rights and Privacy Act) covers educational records maintained by schools. Schools must get parental consent before sharing personally identifiable information. Parents have the right to see their child’s records. You can’t share student grades, test scores, or behavior data without consent. Don’t post student work with full names publicly unless you have permission. FERPA allows data sharing for “school officials with legitimate educational interest.” This is how EdTech companies access student data.
COPPA (Children’s Online Privacy Protection Act) covers websites and apps collecting data from children under 13. Parental consent is required before collecting, using, or sharing personal information from kids under 13. Companies must clearly disclose what data they collect and how it’s used. Schools can provide consent on behalf of parents for educational tools. Look for apps that say they’re “COPPA compliant” or have a privacy policy for schools. Red flag: apps that require students to provide birthdates, email addresses, or photos without clear privacy policies.
State laws vary but many go beyond FERPA and COPPA. California’s SOPIPA bans targeted advertising to students and prohibits creating profiles based on student behavior outside of educational purposes. New York’s Education Law 2-d requires contracts between schools and vendors and gives parents the right to see what data is collected. The Student Privacy Pledge is a voluntary commitment signed by over 400 EdTech companies promising not to sell student data, use it for ads, or create profiles for non-educational purposes. It’s self-regulated with no enforcement. Check if your state has additional privacy laws. Your district’s instructional technology department should know which apps are approved.
What Data Do EdTech Tools Collect?
Not all data collection is bad. Some is necessary for the tool to work. The question is: what’s being collected, and what’s being done with it?
Directory information (name, grade, school) is low risk unless combined with other data. Contact information (email, phone, address) is medium risk. Educational records (grades, test scores, attendance, IEP status) are high risk. Behavioral data (time on task, clicks, page views, app usage) ranges from medium to high risk. Biometric data (fingerprints, facial recognition, voice recordings) is very high risk. Location data (GPS, IP address, device location) is high risk. Content created by students (essays, videos, artwork, recordings) has medium risk depending on sensitivity.
Example: A 3rd-grade teacher uses a reading app. The app collects the student’s name, grade, reading level, time spent on each book, quiz scores, and click patterns. The data is used to personalize recommendations. The company says it doesn’t sell data, but it does share anonymized usage trends with publishers. Is this okay? It depends. Is the benefit worth the data collection? Does the district have a contract in place? Can parents opt out?
Red Flags to Watch For
Every app should have a clear privacy policy. If you can’t find it, don’t use the tool. Good privacy policies are written in plain language, specify what data is collected and why, explain how data is stored and who has access, include contact information for privacy questions, and mention compliance with FERPA, COPPA, or state laws. Bad privacy policies are full of legal jargon, say data may be shared with “third parties” without explaining who, include phrases like “we may update this policy at any time,” and don’t mention educational privacy laws.
If an app asks kindergarteners to sign up with personal email addresses, that’s a problem. Students under 13 shouldn’t need individual accounts unless there’s a strong educational reason. Better alternatives include single sign-on through Google or Microsoft, class-wide login credentials, or teacher-managed accounts using school email addresses.
Does a math practice app need access to your camera and microphone? Probably not. Review permissions before installing apps. If something seems unnecessary, find a different tool.
If a tool is free and you can’t figure out how the company makes money, the answer is probably: they’re selling data or ads. Ask yourself: Is this tool free for teachers but paid for districts? Does it show ads? Does the company say how it’s funded?
Can you delete student data when the school year ends? If the answer is no, the tool isn’t compliant with best practices.
How to Protect Student Data in Your Classroom
Use this checklist before introducing a tool to your classroom: Is this tool on my district’s approved list? If yes, you’re good to go. If no, keep asking questions. Does it have a clear privacy policy? If no, stop here. What data does it collect? Check the privacy policy and permissions. Is it FERPA and COPPA compliant? Look for explicit statements. Does it use student data for advertising or profiling? If yes, find an alternative. Can data be deleted? If no, be cautious. Does my district have a contract with this vendor? Do I need parental consent? For tools that collect sensitive data, consider sending a permission form.
Use school-issued accounts. Students should use school Google, Microsoft, or Apple accounts for all classroom tools. Don’t have students sign up with personal email addresses. School accounts are covered by district agreements. Personal accounts are not.
Don’t require students to share personal information. Avoid assignments that ask students to share home addresses, phone numbers, family details, or photos of themselves. Example: A project asks students to create a “digital identity” poster. Instead of using real addresses and phone numbers, teach them to use placeholder information. This also reinforces digital safety.
Review app permissions. Before installing an app on classroom devices, check what permissions it requests. Deny permissions that seem excessive. On iOS: Settings → Privacy → [App Name]. On Android: Settings → Apps → [App Name] → Permissions. On Chromebook: Extensions → Details → Permissions.
Turn off sharing features unless needed. Many apps have built-in social features: profiles, messaging, public galleries. If you don’t need them, turn them off. Example: A drawing app lets students publish artwork to a public gallery. The teacher disables this feature so student work stays private.
Teach students about data privacy. Students should understand what data is, why it matters, and how to protect it. Cover: What information should you never share online? Why do apps ask for your location or contacts? How can you tell if a website is safe? What is a strong password?
Communicate with parents. Send a letter or email at the start of the year explaining what tools you’ll use, why you chose them, what data is collected, and how parents can opt out if they have concerns.
Small Choices Add Up
Student data privacy is not optional. It’s a responsibility.
You don’t need to be paranoid or avoid all technology. You just need to be informed. Ask questions. Read privacy policies (or at least skim them). Use approved tools. Teach students to protect their own information.
Each time you choose a privacy-respecting tool, you’re protecting your students. Each time you pause to check permissions or ask your tech coordinator about a new app, you’re being the first line of defense. Most teachers don’t think about data privacy until something goes wrong. You’re already ahead by reading this guide.
Start small. Pick one practice from this article and implement it this week. Next month, add another. The goal isn’t perfection. It’s awareness and intention.