Does FERPA Apply to AI Tools Used in the Classroom?

FERPA Protects the Data, Not a Specific Technology

The Family Educational Rights and Privacy Act (FERPA) is built around protecting student education records, defined by the kind of information involved and how it’s maintained, rather than around any specific technology used to handle that information. This means FERPA’s core protections generally do apply when an AI tool is processing student education records, just as they would apply to a traditional, non-AI system handling the same kind of information. The introduction of AI into a classroom tool doesn’t create an exemption from existing student privacy law.

That said, applying a law written before generative AI tools existed to genuinely new kinds of data processing — like an AI tutor generating an ongoing behavioral or learning profile from open-ended student interactions — is a more complex and actively discussed question than applying FERPA to a simple, static grade record.

How Schools Typically Share Data With AI Vendors Under FERPA

In practice, one of the most important mechanisms governing how schools can legally give ed-tech vendors, including AI tool providers, access to student data is FERPA’s “school official” exception. Under this exception, a school can share otherwise protected education records with a third-party vendor without needing separate parental consent for each disclosure, provided certain conditions are met: the vendor performs a service or function the school would otherwise perform itself, remains under the school’s direct control regarding how the data is used, and uses the data only for the authorized educational purpose defined in its agreement with the school — not for unrelated purposes like general product development or advertising.

This exception is the legal backbone that allows schools to adopt AI tools that need access to student data to function, while still keeping that data use tethered to FERPA’s underlying protections. It also means the specific contract between a school and a vendor plays a critical role in translating FERPA’s general requirements into enforceable, specific obligations.

Where the Responsibility Actually Sits

Because FERPA compliance in this context depends heavily on how a school structures its relationship with a given vendor, primary responsibility for ensuring compliance generally sits with the school or district, not solely with the AI company. This is why school and district data privacy offices, where they exist, play an important role in vetting new AI tools before adoption and in negotiating contract terms that clearly limit how a vendor can use student data. Schools without this kind of formal review process in place may be at greater risk of inadvertently adopting tools with data practices that don’t align well with FERPA’s requirements.

Bottom Line

FERPA generally does apply to AI tools used in the classroom, since it protects student education records regardless of the underlying technology, and schools commonly rely on FERPA’s “school official” exception, backed by specific vendor contracts, to legally share student data with AI tool providers — placing significant responsibility on schools to vet vendors and structure agreements carefully rather than assuming compliance happens automatically.