Free preview. This lesson is part of a paid course that earns the ETA Specialist: AI in Education credential. About this course
Student privacy and AI tools
In this lesson you'll
- Explain how FERPA and COPPA apply when educators use AI tools
- Decide which student information can go into which tools
- Use made-up or de-identified data for practice and planning
Welcome
Welcome to AI in Education from the Enterprise Technology Association (ETA). Educators were among the first professionals to feel AI's effects, from essays written by chatbots to new tools for planning and feedback. This course is about using AI well for your own work as an educator, and about helping learners use it well too. It assumes you've completed Level 1: Foundations of the ETA Certified AI Empowered Professional.
- Step 1: Assess
Is this a good task for AI, and what's at stake?
- Step 2: Direct
Brief the AI clearly: goal, context, constraints, done criteria.
- Step 3: Assure
Check the output before you rely on it.
- Step 4: Protect
Keep people, data and your organization safe.
- Step 5: Tune
Iterate, then save what works for next time.
Use the steps in order on every task, and loop back to Tune when results fall short.
The privacy rules that apply
FERPA (the Family Educational Rights and Privacy Act) protects students' education records at schools and colleges that receive federal education funding. Grades, assignments with names, IEP and 504 information, discipline records and many other records are covered. Schools can share records with vendors that act as "school officials" with a legitimate educational interest, under the school's direct control, usually through a contract or data privacy agreement. A teacher signing up for a free AI tool on their own doesn't create that arrangement.
COPPA (the Children's Online Privacy Protection Act) limits how online services collect personal information from children under 13. Many AI tools' terms don't allow use by young children at all.
Many states have their own student privacy laws, and districts and colleges set approved tool lists and data privacy agreements. Workforce training programs have their own rules, including privacy terms in grants and employer partnerships.
Practical data rules
Passwords, access codes, security keys and other credentials
- Personal information
Social Security numbers, birth dates, home addresses, personal phone numbers
- Health information
Diagnoses, medical leave details, patient records
- Financial account details
Bank and card numbers, individual pay records
- Student records
Grades, discipline and other student information
- Confidential business and client information
Unreleased results, pricing, contracts, legal matters, anything under a confidentiality agreement
Some organizations approve specific tools for some of this data. That decision belongs to your organization, not to you. If you're unsure, treat it as off-limits and ask. You rarely need real details: redact, substitute or generalize.
| Usually OK in an approved tool | Ask first | Never |
|---|---|---|
| Your own lesson materials, standards, public texts, made-up examples | Student work without names, class-level data, anonymized survey comments | Student names with grades, IEP or 504 details, discipline, health, immigration or family information, anything in an unapproved tool |
When in doubt, remove identifiers and ask whether the task needs student data at all. Most planning and materials work needs none.
Workplace example: a middle school English department
A teacher wanted AI help writing feedback on 120 essays. She checked the district's approved list: the district's AI tool was approved under a data privacy agreement, but only with names removed. She exported essays with student ID numbers replaced by codes, and kept the key in the gradebook. The department adopted her method as its standard.
Try it
Find your organization's approved AI tools list and student data rules (ask your technology director, privacy officer or instructional technology team). Then, using no real student data, ask your approved tool:
Create 5 made-up student paragraphs answering this prompt: [your prompt]. Make them realistic for [grade or level], with a range of quality and typical errors. Label each "SAMPLE: NOT A REAL STUDENT."Save them for practice in this course.
Key takeaways
- FERPA protects education records; vendors need a proper agreement and the school's control, not a teacher's personal sign-up.
- COPPA, state laws and your institution's approved tools list also apply.
- Most planning work needs no student data; remove identifiers and practice with made-up samples.
Sources