Edtech App Vetting: A Step-by-Step Process for Districts
Every app on a student device is a decision about learning, privacy and safety. This process looks at each app through six lenses and ends with a score and a written record.
What is app vetting?
The phrase covers several different reviews. Knowing which one you are running keeps the work in scope.
In a school district
App vetting is a structured review of an app before students use it. It checks whether the app helps learning, what it does with student data, who can use it, and what the vendor has agreed to. It ends with a status and a reason on file.
NIST SP 800-163 Revision 1, published in April 2019, covers vetting apps for security flaws against an organization's own requirements. It is one input, not the whole K-12 review.
Software platforms review add-ons before listing them for customers. Same word, different job: the platform protects its own users.
If you searched for APP vetting from the College of Policing: APP there means Authorised Professional Practice, guidance on vetting people in policing. It is not about mobile apps.
The six lenses of edtech app vetting
Each lens has one main question. If a reviewer cannot answer it from evidence, the app is not ready for a decision.
Instructional value
Does the app support a learning goal in the curriculum, and does it do so better than apps already approved?
Student privacy
What personal data does it collect from students, and is that limited to what the learning task needs?
Accessibility
Can students who use screen readers, captions, larger text or keyboard navigation use the app fully?
Age rating and content
Is the App Store age rating and the vendor's minimum age compatible with the grades that will use it?
Data sharing
Who else receives student data: advertisers, analytics companies, AI model training, or partners?
Contract and terms
Will the vendor sign your data privacy agreement, and do the terms limit use, sale, retention and changes?
The vetting process, step by step
Ten steps, each with an owner and an output. Small apps move through quickly. Apps with student accounts, chat or AI features get every step.
Intake and triage
Check the request against the approved list. If an approved app does the same job, offer it first and close the request.
Identify the exact product
Record the iOS bundle ID, App Store ID, Android package, web domain and developer. Look-alike apps share names, so the ID is the identity.
Instructional review
A curriculum lead scores fit with standards, teacher controls, and whether it works with your learning platform and rostering.
Privacy review
Read the privacy policy for student-specific terms. Note what is collected, how long it is kept and how deletion works.
Technical and data sharing checks
Install it on a test device. Check permissions, sign-in options, ads, chat between users and any AI features that take student input.
Accessibility check
Ask for the vendor's accessibility conformance report, then test the main student tasks with a screen reader and larger text.
Age rating and content check
Compare the age rating as listed in the App Store and the vendor's own minimum age with the grade bands requested.
Contract and agreement
Send your data privacy agreement or check whether the vendor already signed one in your state. Free apps need terms reviewed too.
Score and decide
Add up the weighted rubric, apply knockout rules, then set one of the statuses with grade bands and conditions.
Record, deploy, set re-review
Write the decision to the approved apps list, deploy or block the app, and set the next review date.
A weighted scoring rubric for edtech apps
Seven criteria, each scored 0 to 3 and multiplied by its weight. The top possible score is 60. Adjust the weights to your district's priorities, but write them down before you start scoring.
| Criterion | Weight | 0 points | 1 point | 2 points | 3 points |
|---|---|---|---|---|---|
| Instructional fit | x3 | No clear learning goal | Loose link to a subject | Supports a stated standard | Fills a gap no approved app covers, with teacher controls |
| Data collected from students | x3 | Collects far more than the task needs, such as contacts or precise location | Broad profile data | Name, school account and work only | Minimal data, pseudonymous use possible |
| Data sharing and advertising | x3 | Ads or sharing with advertisers | Third-party analytics with unclear purpose | Named service providers only | Service providers only, no use of student data for model training or marketing |
| Security and account controls | x2 | Personal accounts only, open chat with strangers | Personal accounts, chat limited | School sign-in available | School sign-in, admin console, no open chat |
| Accessibility | x2 | Main tasks fail with a screen reader | Partial support, no report | Report provided, minor gaps | Report provided, main tasks pass hands-on tests |
| Age rating and content | x2 | Rating or vendor minimum age above the grade band | Borderline for the youngest users | Fits the grade band | Fits, with content controls for teachers |
| Contract and agreement | x3 | Vendor refuses any agreement | Terms only, no agreement | Agreement signed with some gaps | Full agreement signed, deletion and breach terms included |
Example: an app scoring 3, 2, 3, 2, 2, 3, 2 earns 9 + 6 + 9 + 4 + 4 + 6 + 6 = 44, which lands in "approve with conditions". A knockout below overrides any total.
Knockout rules that end a review early
Some findings make the score irrelevant. Check these first and save the committee's time.
The vendor sells student data or uses it to target ads at students or families.
No way to delete student data when the district asks or the contract ends.
Your state requires a signed agreement and the vendor will not sign one.
Open chat or contact with unknown adults, with no way for the school to turn it off.
The app's age rating or the vendor's minimum age is above every grade that would use it.
The app sits in a category the district blocks outright, such as VPN and proxy apps or gambling.
Privacy and data sharing checks IT can run
Reviewers do not need a lab. A test device, the store listing and the privacy policy answer most questions in under an hour.
Store privacy details
Read the App Store privacy label and the Google Play data safety section. Both are declared by the developer, so treat them as claims to compare with the policy.
Student terms in the policy
Search the privacy policy for "student", "school" and "education". A general consumer policy with no school section is a warning sign.
Sign-in options
Prefer school sign-in through your identity provider. Apps that require personal email accounts create data the district cannot manage.
Permissions requested
Note requests for camera, microphone, location, contacts and photos. Each one should match a feature students actually need.
Ads and tracking
Use the app for ten minutes as a student. Any ads, tracking prompts or upsells to students lower the data sharing score.
AI features
Check if students can chat with an AI feature and whether their input is used to train models. See our page on AI apps on student devices.
Social features
Look for public profiles, friend requests, open chat and sharing outside the class. These change an app's risk more than any other feature.
Retention and deletion
Find how long data is kept and how a district requests deletion. The policy should give a process, not only a promise.
Our app category lookup shows the developer, age rating and categories for any app in a few seconds. For a wider view of data practices, see apps that share data.
Accessibility: what to check and the federal dates
Public school districts are covered by Title II of the ADA. The 2024 federal rule on web content and mobile apps uses WCAG 2.1 Level AA as its standard.
Compliance dates as of late 2026
Hands-on checks for reviewers
- Complete the main student task with VoiceOver on iPad or TalkBack on Android.
- Turn on larger text and check that nothing is cut off.
- Play a video and confirm captions are available.
- On Chromebooks, finish the task with the keyboard only.
- Check color contrast on buttons and feedback messages.
- Ask the vendor for an accessibility conformance report and its date.
Age rating: store ratings and vendor terms
Apple moved to 4+, 9+, 13+, 16+ and 18+ tiers in 2025, with developers answering a new questionnaire by January 31, 2026. Older devices and records may still show 12+ and 17+.
| Grade band | Typical ceiling to start from | Also check |
|---|---|---|
| K to 2 | 4+ | No chat, no external links students can follow, no in-app purchases |
| 3 to 5 | 9+ | Teacher-managed accounts, content filters inside the app |
| 6 to 8 | 13+, or 12+ on older listings | Vendor minimum age in the terms, often 13 |
| 9 to 12 | 16+, or 17+ on older listings, case by case | Parental consent rules in the vendor terms for users under 18 |
The store rating and the vendor's terms can disagree. A chat app rated 12+ in older listings may still require users to be 13 and need parent consent under 18. Record both, and use the stricter one.
Contract and data privacy agreement checklist
Free apps carry terms of service too. Check that the agreement, or the terms if there is no agreement, cover each of these points.
The legal background for these clauses is on student data privacy and apps.
A sample vetting record
One page per app, stored with the list entry. This example uses a made-up reading app to show the format.
Fast track or full review?
Not every request deserves the same depth. Route each one by risk so the committee spends its time where student data and contact with others are involved.
| Request type | Route | Steps you can shorten |
|---|---|---|
| Offline tool, no accounts, no data leaves the device | Fast track | Privacy and contract checks become a short note on file |
| Vendor already signed your state's shared agreement | Fast track | Contract step is a lookup; still test the app and its age rating |
| New vendor, school sign-in, student work stored | Full review | None |
| Any chat, social feature or AI assistant for students | Full review plus pilot | None; run a small teacher-led pilot before wide release |
| Update to an approved app adds a new feature | Re-check | Only the lenses the new feature touches |
Requests that turn out to be apps students installed themselves belong in a separate conversation about shadow IT on mobile devices.
What changed for app vetting in 2025 and 2026
If your rubric was written a few years ago, these changes are worth folding in before the next review cycle.
New questions to add
- Has the app added an AI assistant since the last review, and can the district turn it off?
- Is student input used to train or improve AI models?
- Does the vendor publish a data retention schedule?
- Which age rating does the current store listing show?
- Has the vendor's minimum age in its terms changed?
Who belongs on the review team
Five roles cover every lens. In small districts one person may hold two roles, but the review should still record each lens separately.
Curriculum lead
Scores instructional fit and picks between similar apps.
Privacy officer
Reads policies and owns agreements with vendors.
Device team
Tests the app and handles deployment or blocking.
Special education
Checks accessibility and accommodations.
Teacher rep
Brings classroom reality and pilot feedback.
App vetting questions
What is app vetting?
A structured review of an app before an organization allows it. In K-12 it covers value, privacy, data sharing, accessibility, age rating and contract, and ends with a recorded decision.
How long should edtech app vetting take?
It depends on the app. A product with a signed agreement in your state may need a short check. A new vendor with student accounts and chat needs the full review. Publish a target for each type.
Is there an edtech app vetting tool?
Tools speed up the facts: app IDs, developer, age rating and categories. Our bundle ID lookup does that for free a few times a day. The judgment on value and contract terms stays with your team.
How is K-12 app vetting different from NIST mobile app vetting?
NIST SP 800-163 Revision 1 (April 2019) is about finding security flaws against an organization's requirements. K-12 vetting adds teaching value, student privacy law, age suitability and accessibility.
What does APP vetting mean in UK policing?
APP stands for Authorised Professional Practice, the College of Policing guidance. Its vetting guidance is about people who work in policing, not about mobile apps.
Do we need to re-vet apps we already approved?
Yes. Once a year, and whenever an app changes owner, privacy terms, age rating or adds chat or AI features. A short re-check against the old record is usually enough.
Can we check many request forms against app data automatically?
Yes. The app categorization API returns categories, age rating, developer and the twin ID on the other store for a bundle ID, App Store ID or Android package.
Vet the apps you want. Block the categories you do not.
Our blocklists cover VPN and proxy apps, AI chat, social media, games, gambling, dating and more, with files for every major MDM and monthly updates.
Apple, iPad, App Store and VoiceOver are trademarks of Apple Inc. Google Play, Android, TalkBack and Chromebook are trademarks of Google LLC. NIST is an agency of the US Department of Commerce. College of Policing is the professional body for policing in England and Wales.
Names are used only to identify the products and organizations discussed. AppBlockList is not affiliated with, sponsored or endorsed by these companies or organizations.