When a student uses an AI tool through school, the vendor can end up holding information about that student, and the rules on who may receive it differ by country. Under the U.S. Family Educational Rights and Privacy Act (FERPA), a school may share education records with an outside contractor only if the contractor does a job the school would otherwise staff itself, is under the school's direct control over how the records are used and maintained, and is bound by FERPA's limits on reuse and redisclosure. In Ontario and Québec, privacy officials tell schools to assess a tool's risks before it touches student information.
Key takeaways
- FERPA's school official exception, in 34 CFR 99.31(a)(1)(i)(B), has three conditions for outside parties, and a vendor must meet all of them.
- Student information counts as personally identifiable if it is linkable to a specific student, even when no name appears.
- The FTC's amended COPPA Rule had a compliance date of April 22, 2026, but the FTC did not finalize its proposed school authorization provisions.
- Ontario's Digital Privacy Charter for Ontario Schools has 12 commitments that schools and boards can choose to adopt, including assessing privacy risks before adopting a digital tool.
- Québec's education ministry advises against entering personal information into a generative AI system unless the school organization approves that use.
The FERPA test for outside vendors
FERPA generally requires consent before a school discloses personally identifiable information from education records. One exception lets a school treat a contractor or other outsourced party as a "school official." The regulation at 34 CFR 99.31 sets out three conditions: the party performs an institutional service or function for which the school would otherwise use employees; it is under the school's direct control with respect to the use and maintenance of education records; and it is subject to the use and redisclosure limits in 34 CFR 99.33(a). Under those limits, the party may use the information only for the purposes for which the disclosure was made and may not pass it on without consent.
Two definitions in 34 CFR 99.3 matter for AI tools. Education records are records directly related to a student and maintained by the school or a party acting for it. Personally identifiable information includes names and identifiers, indirect identifiers such as a date of birth, and any information that, alone or in combination, is linked or linkable to a specific student so that a reasonable person in the school community could identify the student with reasonable certainty. A pasted essay with no name on it can still qualify if the surrounding details point to one student. Whether a particular product's terms meet the direct-control condition is a legal question for the school's counsel.
COPPA and children under 13
The Federal Trade Commission's Children's Online Privacy Protection Rule covers operators that collect personal information from children under 13. The FTC published amendments on April 22, 2025, effective June 23, 2025, with a compliance date of April 22, 2026 for most provisions. In its 2024 proposal the FTC had suggested codifying an exception allowing schools to authorize collection in place of parents. The final rule states that the Commission is "not finalizing at this time" the proposals related to school authorization. School authorization of collection from students under 13 is therefore not addressed in the amended rule's text, and schools and vendors should confirm the current position with the FTC or counsel.
Ontario: a voluntary charter
The Information and Privacy Commissioner of Ontario finalized the Digital Privacy Charter for Ontario Schools in June 2024, after an eight-month consultation, and announced its launch on October 23, 2024. The charter has 12 commitments in two groups. The protection group includes limiting collection, use, and disclosure of student information to what is necessary for educators' responsibilities, requiring strong privacy protections from third-party providers, assessing privacy risks before adopting digital tools, making privacy-protective settings the default, and informing students and families of significant breaches. The empowerment group includes plain-language notices and guidance for students on protecting their own information.
The IPC describes many commitments as grounded in the Municipal Freedom of Information and Protection of Privacy Act. School administrators and boards can sign a pledge, and adoption is a choice for each school or board. The charter names artificial intelligence among the technologies that created new privacy risks, but it is not a guide to AI tools in particular.
Québec: do not enter personal information without approval
Québec's 2026 guide for teaching staff on generative AI devotes a section to personal information. It states that personal information is confidential and that a public body is responsible for what it holds under the provincial access and privacy statute. Teachers should not enter personal information into a generative AI system unless the school organization's security officer has approved that specific use. The guide warns that a student's answers to an assessment can identify the student indirectly when combined, and advises checking with the organization's privacy officer. A footnote adds that data typed into some systems may be kept for training and later disclosed in response to another user's request.
Questions to ask about any classroom AI tool
The table links each practical question to the rule or guidance that frames it. It is an orientation aid, not a compliance checklist.
| Question | Where it comes from |
|---|---|
| Does the vendor act as a school official under the school's direct control? | 34 CFR 99.31(a)(1)(i)(B), United States |
| Could a student be identified from what is entered, even without a name? | 34 CFR 99.3 definition of personally identifiable information; Québec guide on indirect identification |
| May the vendor reuse student input to train its models or share it onward? | 34 CFR 99.33(a) limits; Québec guide footnote on retention for training |
| Are students under 13 involved? | COPPA Rule, 16 CFR Part 312, as amended in 2025 |
| Has a privacy risk assessment been done before adoption? | Ontario Digital Privacy Charter commitment |
| Was the system approved by the school organization for this use? | Québec guide, step before use |
This article gives general information about regulation and does not recommend a product. Legal duties for a specific school or district are for its privacy officer and counsel to decide.
FAQ
Does FERPA ban AI tools in classrooms?
No. FERPA governs when personally identifiable information from education records may be disclosed. A school can use a vendor under the school official conditions, or with consent, but the conditions apply to AI vendors the same way they apply to other contractors.
Is the Ontario charter a law?
No. Schools and boards choose to sign on to it, although the IPC says many of its commitments are grounded in statutory requirements under the Municipal Freedom of Information and Protection of Privacy Act.
Can a teacher paste student work into a chatbot?
Québec's guide says personal information should not go into a generative AI system without approval from the school organization, and student responses can be identifying in combination. In the United States, pasting identifiable student work into an outside tool can be a disclosure of education records. Local policy decides what is allowed.
Did the FTC's 2025 COPPA update settle school consent?
Not in the text of the rule. The FTC said it was not finalizing its school authorization proposals at that time, so the question was left outside the amended rule.
Related reading
- AI chatbots in schools
- ChatGPT in teaching and learning
- Whether AI could replace teachers
- AI and the student experience
More in AI in education.
Last verified: October 2026
Sources
- 34 CFR 99.3, 99.31, and 99.33, Family Educational Rights and Privacy Act regulations, Electronic Code of Federal Regulations, U.S. Department of Education
- Children's Online Privacy Protection Rule, final rule amendments, Federal Trade Commission, Federal Register, April 22, 2025
- Charter page and pledge text, Ontario privacy commissioner's office, 2024
- Strengthening privacy protections for students: IPC launches digital privacy charter, Information and Privacy Commissioner of Ontario, October 23, 2024
- Commissioner's blog on the Digital Privacy Charter, Information and Privacy Commissioner of Ontario, 2024
- Québec education ministry guide for teaching staff on generative AI, 2026 update (French-language PDF)