Towered Tech

For teachers and parents

Student data privacy basics

Every app a class uses collects some information about students. A few laws set the ground rules. This is a short orientation, not legal advice, so always check your school or district policy.

Why it matters

Student data can include names, contact details, grades, attendance, behaviour notes, special educational needs, photos and the work itself, as well as usage data such as logins and clicks. Once shared with a company it can be hard to recall. Privacy rules exist so that this information is used for education, kept secure and not turned into marketing.

FERPA (United States)

The Family Educational Rights and Privacy Act is a federal law that protects the privacy of student education records at schools that receive funding from the US Department of Education. In brief:

  • Parents have the right to inspect their child's education records and to ask for corrections.
  • Schools generally need written consent before disclosing personally identifiable information from those records, with listed exceptions, such as sharing with school officials who have a legitimate educational interest.
  • Schools may release limited "directory information" if they tell families in advance and let them opt out.
  • The rights pass to the student at age 18 or when they attend a college or university.

When a school uses an online service, it often relies on the school-official exception, which means the vendor must stay under the school's control and use the data only for the purpose it was shared for.

COPPA (United States)

The Children's Online Privacy Protection Act is enforced by the Federal Trade Commission. It applies to operators of commercial websites and online services directed at children under 13, or that knowingly collect personal information from them. Such operators generally need verifiable parental consent before collecting that information.

FTC guidance has allowed schools to give consent on parents' behalf in limited cases, where the data is used only for the school's educational purpose and not for any commercial one. The FTC amended the COPPA Rule in 2025, so check the FTC's current guidance for the latest position on school consent.

Many US states also have their own student privacy laws, some stricter than the federal ones.

GDPR (European Union)

The General Data Protection Regulation covers personal data across the EU and EEA, and the UK keeps a closely matching version known as the UK GDPR. Points that matter most in schools:

  • Every use of personal data needs a lawful basis. Schools often rely on carrying out a public task rather than on consent.
  • Children's data merits specific protection, and privacy information should be written so that children can understand it.
  • Where an online service relies on a child's consent, the default age is 16, and each country may set a lower age, but not below 13.
  • People have rights to access their data and, in some situations, to have it corrected or erased.
  • Public authorities, including state schools, must appoint a data protection officer, and higher-risk processing calls for a data protection impact assessment.

Questions to ask before using a new app

  1. Is this tool already approved by the school or district? If not, who reviews it?
  2. What student data does it collect, and is all of it needed?
  3. Is there a signed data agreement covering storage, security, deletion and breach notice?
  4. Does it show ads, build profiles or sell data? It should not.
  5. Can students use it without creating a personal account, or through school sign-in?
  6. How will families be told, and can they see or delete the data?

This page summarises the general shape of these laws as of 2026. It is not legal advice. Your school or district policy, and its data protection lead, are the authority for what you can use.

For parents

You can usually ask your school for its list of approved apps and its privacy notice. Read the privacy settings on any account your child creates for school, and ask whether a school-managed account is available instead. Our guide to setting up a family device covers accounts at home.