Student Data Privacy and Apps: FERPA, COPPA and Data Privacy Agreements
Three layers decide what an app may do with student data: federal law, state law and the contract you sign. Here is how each one works, and what IT can check before approving an app.
This page describes the laws in plain terms for IT planning. It is not legal advice. Laws, rules and their dates change, so check with your counsel before relying on any of it for a decision.
FERPA and apps: the school official route
FERPA is the federal law, dating from 1974, that protects student education records at schools receiving US Department of Education funds. Most edtech apps reach student records through one of its exceptions.
What it covers
Education records: records directly related to a student and kept by the school or someone acting for it. Student work stored in an app can fall under this.
Whose rights
Parents hold the rights until the student turns 18 or enters postsecondary school. The rights then pass to the student, who becomes an "eligible student".
Directory information
Some details, such as a name, may be shared as directory information if the district gives notice and an opt-out. It is not a blanket route for app vendors.
The school official test
A vendor can receive records without parent consent when it acts as a school official. These are the conditions districts usually check.
- 1The vendor does a job the district would otherwise have its own staff do.
- 2The district keeps direct control over how the records are used and kept.
- 3The data is used only for the purpose the district authorized.
- 4The vendor does not pass records on to others except as allowed.
What this means for IT: "direct control" usually lives in the contract. Terms that let a vendor change its privacy policy at will, or reuse student data for its own products, make that control hard to show.
COPPA and the 2025 rule changes
COPPA is a federal law enforced by the FTC. It covers operators of apps and sites directed to children under 13, or that know they collect data from children under 13. The FTC amended its COPPA rule in 2025.
Separate consent for sharing
Operators need separate parental consent before disclosing a child's data to third parties for purposes that are not integral to the service, such as targeted advertising.
Written retention policy
Operators must keep a written data retention policy, publish it in their privacy notice, and may not keep children's data indefinitely.
Written security program
A written information security program is required, with a named coordinator, regular risk assessments and testing of safeguards.
Wider personal information
The definition now includes biometric identifiers, such as fingerprints, voiceprints and facial templates, and government-issued identifiers.
More detailed notices
Privacy notices must name the third parties, or their categories, that receive children's data, and explain the purposes.
New consent methods
Approved methods now include knowledge-based questions, matching a parent's photo to a government ID, and a text message method in limited cases.
School consent: the FTC proposed writing a school authorization exception into the rule but left it out of the final version, citing possible changes to FERPA rules. Its existing guidance on schools consenting for educational use remains the reference.
FERPA, COPPA and state law side by side
The three layers overlap but answer different questions. A quick comparison helps when a teacher asks "is this app allowed?"
| Question | FERPA | COPPA | State student privacy laws |
|---|---|---|---|
| Who must follow it? | Schools and districts that receive Department of Education funds | Operators of apps and sites for children under 13, or that know they collect from them | Usually operators of K-12 services, often districts as well |
| Which students? | All students, with rights passing to the student at 18 | Children under 13 | Usually all K-12 students |
| Who enforces it? | US Department of Education | Federal Trade Commission, plus state attorneys general | State agencies or attorneys general, depending on the law |
| What it means for app approval | Show the vendor qualifies as a school official, usually through the contract | For under-13 users, check how consent and data sharing are handled | Check agreement, posting and advertising rules in your state |
State student privacy laws: three well-known examples
Most states have their own student privacy rules, and several followed California's model. These three show the main patterns. Check the current status of your own state's law.
| Law | Year | Who it binds | Core rules for apps |
|---|---|---|---|
| California SOPIPA | Signed 2014, in effect January 2016 | Operators of online services used mainly for K-12 school purposes, with or without a contract | No targeted advertising based on student data, no selling student information, no profiles for non-school purposes, deletion on request |
| Illinois SOPPA | Amended version in effect July 2021 | Schools and the operators they share student data with | Written agreement before sharing covered information, public posting of operators and agreements, breach notification duties |
| New York Education Law 2-d | Law from 2014, Part 121 rules in effect January 2020 | Educational agencies and their third-party contractors | Parents' bill of rights posted and attached to contracts, supplemental information for each contract published, no selling or marketing use of student data |
| Your state | Varies | Often operators, sometimes districts too | Look for agreement requirements, posting duties, breach timelines and limits on advertising. Check the current status with your state education agency. |
Pattern to notice: SOPIPA-style laws bind the vendor directly, even for free apps teachers find themselves. Agreement-style laws put duties on the district to sign, post and track.
Data privacy agreements (DPAs)
A DPA is the contract that turns legal duties into specific promises from one vendor. In many states, district alliances share a common agreement so a vendor signs the same terms once and others can join.
Why the DPA matters most
Laws set the floor. The DPA is where the district shows direct control, sets deletion timelines and gets breach notice terms in writing.
Keep signed DPAs next to the app's row on your approved apps list, with the expiry date.
App Store and Google Play privacy details
Both stores show privacy information on each app's listing. It is a fast first look, but both are declared by the developer, so read them as claims to verify.
| Store | What it shows | Useful for | Limits |
|---|---|---|---|
| App Store privacy section | Data used to track people across other companies' apps and sites, data linked to the user's identity, and data not linked to them | Spotting tracking and broad data collection before installing | Self-declared; independent studies have found labels that did not match app behavior |
| Google Play data safety section | Data collected and shared, security practices and whether deletion can be requested; required since July 2022 | Seeing whether data from third-party code in the app is declared | Self-declared; wording differs from Apple's, so compare carefully |
| The vendor's privacy policy | The full legal terms | Student-specific terms, retention and deletion | Often long; search for "student", "school" and "education" |
Privacy policy for educational apps: strong signs and warning signs
A vendor's privacy policy tells you a lot in ten minutes if you know what to look for. Put the two columns side by side when you read.
Strong signs
A separate section or policy for school customers, written for districts rather than consumers.
A clear statement that student data is used only to provide the service and is never sold or used for ads.
A retention period in months or years, and a deletion process with a contact address.
A named list of service providers, with a promise of notice before material changes.
What IT can check before approving an app
You do not need to be a lawyer to find most problems. These checks take an hour with a test device, and they feed straight into the edtech app vetting rubric.
- Developer name matches the vendor you expect
- Developer website domain is the vendor's own
- Age rating as listed in the App Store fits the grades
- Privacy section shows no tracking
- No look-alike app with a similar name
- Has a section for schools or students
- States what is collected and why
- Gives a retention period
- Explains deletion requests
- Lists or describes subprocessors
- Permissions match real features
- School sign-in works
- No ads or tracking prompts for students
- No open chat with strangers
- AI features can be switched off
- DPA signed, or the vendor has signed your state's shared agreement
- Posting duties met where your state requires them
- Expiry and review date recorded
- Contact for breach notices on file
Our free app category lookup shows the developer, developer website, age rating and categories for an app in seconds.
When a family asks about app data
Requests from parents or eligible students usually come to the school, not the vendor. A short internal route keeps answers consistent and on time.
"What does this app hold about my child?"
Find the app on the approved list, check the agreement for the vendor's access process, and request an export through the district contact named in it.
"Please delete my child's data"
Check whether the data is part of an education record the district must keep. If not, send a written deletion request to the vendor and log the confirmation.
"My child should not use this app"
Note the opt-out in the student system, offer an approved alternative for the task, and remove the app from that student's device group if your MDM allows it.
Keep a simple log of each request: date, app, what was asked, what the vendor confirmed. It is the record you will want if the same question comes back a year later.
MDM data privacy: what your own tools hold
Device management systems hold student data too. Treat your MDM like any other vendor, and keep what it stores to what device support needs.
Avoid full student names
Name devices by asset tag or student ID instead of first and last name. Names on devices show up in network logs and on lock screens.
Use location for lost devices only
Many MDMs can locate a device in a lost mode. Write down when staff may use it and who approves it.
App inventory is student data
The list of apps on a 1:1 device can reveal a lot about a student. Limit who can see it and how long reports are kept.
Role-based admin access
School staff need their own schools only. Give district-wide rights to a small team and review them each year.
A DPA for the MDM vendor
Your device platform processes student device data. It belongs in the same agreement process as classroom apps.
Our files hold app data only
AppBlockList files list app IDs, names and categories. Nothing about your students is sent to us when you import them.
App types that put student privacy at risk
Some categories cause privacy problems no matter how good the rest of your process is. Blocking them by category keeps clones and new arrivals out too.
VPN and proxy apps
They send all of a device's traffic through a company the district has no agreement with. See the VPN and proxy apps list.
Third-party keyboards
On iPad, a keyboard given "Allow Full Access" can send what students type to its developer. Review keyboards like any other app.
AI chat apps
Students paste essays, names and personal stories into chat boxes. Policy options are on AI apps on student devices.
Vault apps
Apps such as Private Photo Vault (com.enchantedcloud.photovault) hide content from the device owner, which is the district on a 1:1 device.
For a closer look at data practices across app types, see apps that share data.
Privacy events that should trigger a re-review
An approval is a snapshot. These events change the facts behind it, so put a re-check on the calendar the day you hear about one.
When an app fails a re-review, move it to "retired" on the list, remove it from devices, and send the vendor a written deletion request under your agreement.
Student data privacy questions
What is FERPA in the Common App?
When students invite recommenders, the Common App asks them to complete a FERPA release authorization and choose whether to waive the right to see recommendation letters. It covers those letters only.
Does COPPA apply to high school students?
COPPA protects children under 13. High school students are generally outside it, but FERPA, state laws and your agreements still cover their data.
Can a school consent for parents under COPPA?
FTC guidance allows schools to consent in a limited educational context where data is used only for school purposes. The 2025 amendments did not write this into the rule, so the guidance remains the reference.
Do free apps need a data privacy agreement?
Price does not decide it. If a free app collects student data, the same rules apply, and several state laws require a written agreement with any operator receiving covered information.
Is the App Store privacy label enough?
No. Store privacy details are declared by the developer. Use them as a first look, then weigh the privacy policy, the contract and a device test more heavily.
What should our own district app's privacy policy cover?
What it collects and why, who receives data, how long it is kept, how families can see or delete it, which service providers are involved, and a contact. Have it reviewed before publishing.
Does CIPA apply to apps as well as websites?
CIPA is about internet safety and filtering for E-rate funded schools and libraries. How it touches mobile devices is covered in CIPA and mobile devices.
What about personal devices students bring in?
District rules for personal phones and tablets differ from rules for district devices. See the BYOD app policy page for the options.
Keep risky app categories off student devices
Category blocklists for iOS, iPadOS and Android, with separate files per school on the district plan and monthly updates that catch new look-alike apps.
Apple, iPad and App Store are trademarks of Apple Inc. Google Play is a trademark of Google LLC. Common App is a trademark of The Common Application, Inc. Private Photo Vault is a trademark of its owner.
Names are used only to identify the products discussed. AppBlockList is not affiliated with, sponsored or endorsed by these companies.