Privacy Frameworks

Learning Outcomes

By the end of this lesson, you will be able to:

• Explain why federal privacy law alone doesn’t fully protect student data — and why that gap matters for educators.
• Recognize how state privacy laws raise the bar beyond federal requirements and what that means for the tools you use.
• Locate your district’s approved-tools list and understand the data privacy agreements that put products on it.
• Decide whether a new AI tool is safe to use in a school context — and know what to do when you’re not sure.

State Laws Go Further Than Federal Minimums

Federal law sets a baseline for student data privacy, but many states layer on significantly stricter requirements that vendors and districts must meet independently.

• California’s SOPIPA prohibits ed-tech vendors from using student data for targeted advertising and imposes tight limits on how that data can be shared or sold.
• New York’s Education Law 2-d requires schools to publish data privacy policies, conduct vendor due diligence, and obtain signed agreements before sharing any student or teacher data with a third party.
• A generic privacy policy is not enough. A one-size-fits-all statement from a vendor does not satisfy state-specific mandates — formal, signed agreements with explicit protections are required.

The Approved-Tools List

Before You Use an AI Tool: A Quick Compliance Check

• ✓
  Is the tool on the district’s approved list?
  Start here every time. If the tool appears on your district’s approved list, it has already been vetted for student data compliance.
• ✓
  Has the vendor signed a data privacy agreement?
  Approval typically means the vendor has signed a CSDPA or equivalent agreement committing to protect student data under federal and state law.
• ✓
  Did you confirm with an administrator if you’re unsure?
  When a tool isn’t on the list or you can’t verify its status, check with your administrator before using it with students.
• ✓
  If it isn’t cleared, are you keeping student data out of it?
  An uncleared tool may still be usable for non-student tasks. The firm rule: no student names, records, or identifying information enters a tool that hasn’t been approved.