Student Data Privacy: What Schools Collect, Share, and Are Required to Protect

What Data Schools Actually Collect

From the moment a child enrolls, schools begin assembling a detailed record. Academic transcripts, attendance logs, disciplinary actions, and standardized test scores are the most familiar categories. But the full picture is broader.

Many schools also collect health and immunization records, special education evaluations and Individualized Education Programs (IEPs), free-and-reduced lunch eligibility data, demographic information, and — increasingly — digital activity from school-issued devices and learning management platforms. Ed-tech tools used for reading programs, online assessments, or virtual tutoring can generate detailed behavioral and performance data that never appears on a traditional report card.

It is worth noting that the scope of data collection can differ significantly between districts, as local policies, technology budgets, and state laws all shape what is gathered and retained.

The Federal Framework: FERPA, COPPA, and Beyond

The cornerstone of U.S. student data privacy law is FERPA, which grants parents the right to inspect, review, and request amendments to their child's education records. Schools must generally obtain written consent before disclosing records to outside parties, with several important exceptions.

Those exceptions include disclosures to school officials with a legitimate educational interest, transfers to a new school, compliance with a court order, and sharing in health or safety emergencies. A frequently misunderstood provision allows schools to release directory information — name, photo, grade level, and similar details — without consent, unless a family has formally opted out.

For younger children, the Children's Online Privacy Protection Act (COPPA) restricts how online services can collect data from children under 13, which affects many ed-tech tools used in elementary classrooms. Schools acting as intermediaries must ensure vendors comply.

For a broader look at how personal data flows and who profits from it, the data broker industry overview offers useful context on the commercial ecosystem surrounding personal information.

Third-Party Vendors and Ed-Tech Platforms

Modern classrooms rely heavily on outside technology providers. Reading apps, video platforms, assessment tools, and learning management systems are often built and maintained by private companies. Under FERPA, these vendors can receive student data only when they are functioning as a "school official" — meaning the school has outsourced a task it would otherwise handle itself, and the vendor operates under direct control and is prohibited from using data for commercial purposes.

In practice, oversight can be inconsistent. A 2023 report from the nonprofit Center for Democracy and Technology found that many school app ecosystems lack adequate contract review processes — meaning schools may not always verify how vendor data policies align with legal requirements. Parents and educators concerned about digital privacy practices can request a list of vendors their district contracts with and review the associated data-sharing agreements.

Understanding these risks connects to broader questions about digital privacy. The introduction to online privacy is a useful starting point for families less familiar with how personal data moves across the internet.

What Families Can Do

Parents and guardians have more leverage than they may realize. Under FERPA, they can formally request to review all education records the school holds on their child. If an error is found, they can request a correction. If the school disagrees, families are entitled to a hearing.

Opting out of directory information sharing is a concrete step many families overlook. It requires submitting a written request — typically at the start of a school year — to the principal or district office. Without that opt-out, the school may release basic identifying details to yearbook publishers, parent organizations, or even military recruiters (for high schoolers, under the No Child Left Behind era provisions).

State laws often extend protections beyond FERPA. California's Student Online Personal Information Protection Act (SOPIPA), for example, prohibits ed-tech companies from using student data for targeted advertising. Families are encouraged to look up what their state provides in addition to the federal baseline.

For students with disabilities, records related to special education services carry additional legal weight. Special education rights families may not know about offers a detailed breakdown of those protections.