Does FERPA let us put student records into an AI tutor?

01 / The answer

The short answer

Only if a FERPA exception applies, usually the school-official exception. Under 34 CFR 99.31, a vendor counts as a school official only if it performs a service the school would otherwise use its own staff for, is under the school's direct control over how records are used and kept, and follows the use and redisclosure limits in 99.33. The school must also limit access to records with a legitimate educational interest. A vendor that uses the records to train its own models or for purposes outside its contract is likely outside that exception.

02 / The rule

What FERPA requires

FERPA bars schools from disclosing personally identifiable information from education records without parent or eligible-student consent unless an exception applies. Most school AI tools that touch student records depend on the 'school official' exception, which carries strict control and use limits for vendors.

1. 01Get written consent before disclosing personally identifiable information from education records, unless a listed exception applies.
2. 02Treat an AI vendor as a 'school official' only if it performs an institutional function, under direct school control over use and maintenance of records.
3. 03Limit vendors' use and redisclosure of records to the authorized purpose (34 CFR 99.33).
4. 04Use reasonable methods so school officials, including vendors, access only records with a legitimate educational interest.

03 / Records

Records to keep

1. 01Vendor contracts with school-official, use-limit and deletion terms
2. 02Annual FERPA notice defining school officials
3. 03Record of disclosures kept under 34 CFR 99.32
4. 04Access-control settings and data deletion confirmations from vendors

SOURCES

Go back to the source

RELATED

Related: FERPA: the full guide