Student data privacy for teachers

1 What counts as student data

Student data is any information about a student that you hold because you teach them. Some of it is obvious, like grades and test scores. Much of it is easy to forget: the class list on your desk, a behavior note in your planner, a photo of a project with a face in it, the reading levels on a group chart, the email a parent sent about a diagnosis, the login names on a sticky note by the computer.

A useful test is to ask: could someone use this to identify a student, or learn something about them that the family would expect the school to keep private? If yes, treat it with care. A first name on the board during a game is usually fine. A first name next to a reading level, a behavior chart or a test score is a different matter.

• Identifiers: full names, student ID numbers, birth dates, addresses, phone numbers, login names and passwords, photos and video.
• School records: grades, test scores, report cards, attendance, discipline records, special education and 504 documents, reading and math levels.
• Sensitive details: health information, family circumstances, anything a student or family told you in confidence.

2 FERPA in plain words

The Family Educational Rights and Privacy Act (FERPA) is a federal law about student education records. It applies to schools and districts that receive funds under programs run by the U.S. Department of Education. If you teach in a public school, assume it applies to you.

FERPA gives parents three main rights over their children's education records: the right to see them, the right to ask for them to be corrected, and some control over who else sees personally identifiable information from them. When a student turns 18, or enters a college or other postsecondary school at any age, those rights pass from the parents to the student.

Education records are, broadly, records directly related to a student that the school keeps. Grades, report cards, attendance, test results, discipline files and special education documents are all education records.

There are exceptions that let schools share records without written consent in some situations. Two matter most in daily school life. Staff inside the school who have a legitimate educational interest can see the records they need for their work. And a school may publish "directory information", such as a student's name in a play program, if it has told families what it counts as directory information and given them the chance to opt out. Whether an outside company can be given records, and on what terms, is a decision for the district, not for an individual teacher.

What FERPA means for your day

• Don't post or display grades, scores or levels next to students' names where other students or visitors can see them.
• Don't discuss one student's grades, behavior or needs with another student's parent, even in a friendly hallway chat.
• Send records requests from parents or outside people to the office, rather than handing over copies yourself.
• Share records with colleagues only when they work with the student and need the information.
• Check whether a family has opted out of directory information before you put a student's name or photo in a newsletter or on a website.

3 COPPA and the apps you use

The Children's Online Privacy Protection Act (COPPA) is a federal law enforced by the Federal Trade Commission. It applies to operators of commercial websites and online services that are directed to children under 13, or that know they are collecting personal information from children under 13. Before such a service collects, uses or shares a child's personal information, it generally needs a parent's verifiable consent.

Schools come into it because so many classroom apps ask students to make accounts. The FTC's guidance says a school can act as the parent's agent and consent for the parent, but only in the educational context: the company must collect the information for the use and benefit of the school, and for no other commercial purpose. If a company wants to use student information for its own purposes, such as advertising, the school cannot consent on the parent's behalf.

The FTC also suggests that decisions about which sites and apps may collect students' information are best made at the school or district level, rather than by individual teachers. That is the practical point for you: the app a colleague recommends may be wonderful, but it is your district that decides whether students may sign up for it.

What COPPA means for your day

• Use the apps and websites on your district's approved list. If a tool isn't on it, ask before students make accounts.
• Don't sign students up for a new service with your own personal account, or ask them to use a personal email address.
• Prefer tools that need no student accounts at all. A timer, a wheel or a word search on the projector collects nothing from students.
• If a family asks what a classroom app collects, point them to the district's list and the company's notice, which the FTC suggests schools make available to parents.

4 PPRA and classroom surveys

The Protection of Pupil Rights Amendment (PPRA) is the federal law teachers hear least about, and it matters whenever you want students to fill in a survey. It governs surveys, analyses and evaluations given to students that concern certain protected areas.

The U.S. Department of Education lists eight protected areas. They include political affiliations or beliefs of the student or parent; mental or psychological problems of the student or family; sex behavior or attitudes; illegal, anti-social, self-incriminating or demeaning behavior; critical appraisals of close family members; privileged relationships, such as with lawyers and physicians; and income, except where the law requires it to decide eligibility for a program. The full list is on the Department's page, linked in the sources below.

Parents' rights under PPRA pass to the student at 18, or to an emancipated minor under state law. What the law requires in a given case, such as notice to parents or their consent, depends on who funds and runs the survey, so it is a question for your school before the survey goes out.

What PPRA means for your day

• Before you hand out a survey or questionnaire that asks about feelings, home life, family members or behavior, show it to your administrator.
• Keep classroom check-ins general and optional: "How is your morning going?" on a feelings chart is a different thing from a questionnaire about a student's family.
• Use the school's own process for any wellbeing or climate survey rather than writing your own.

5 State laws and your district's policy

Federal law is only part of the picture. Many states have their own student privacy laws, and some of them go further than the federal ones, for example by limiting what education technology companies may do with student data. Districts often sign data privacy agreements with the companies they use, setting out what the company may collect and when it must delete it.

You don't need to know every law. You do need to know where your district writes the rules down, and who to ask. Look for these in your staff handbook or on the district's website, and keep the answers in your planner:

• The district's list of approved apps and websites, and how to ask for a new one to be reviewed.
• The district's acceptable use policy for staff, and the one students and families sign.
• The policy on photos and video of students, and how to find out which families have opted out.
• The rules for emailing and messaging families, including which system to use.
• Who to tell if student information is lost, stolen or sent to the wrong person.
• The policy on using artificial intelligence tools with any student information.
• Who in your building answers privacy questions: often the principal, the technology coordinator or the district's privacy officer.

6 Everyday habits that protect students

Most privacy problems in schools are not dramatic. They are a grade sheet left on a copier, a class list emailed to the wrong parent, a projector showing an inbox during a lesson. A handful of habits prevent most of them.

On screens and the projector

• Lock your computer whenever you walk away from it, even for a minute.
• Close your email and gradebook before you turn on the projector, and turn off pop-up notifications during lessons.
• Use first names only on anything the class sees: the name wheel, groups, the seating chart, the helper list.
• Never show reading levels, scores or behavior charts with names on the board.

On paper

• Keep grade books, testing materials and student files in a drawer or cabinet, not on your desk.
• Collect your printing straight away, and shred papers with student information instead of putting them in recycling.
• Keep the sub folder to what a substitute needs: first names, routines and who to ask. Medical details stay where your school says they should.

In messages and online

• Use the school's own email and messaging system for families, not your personal phone or account.
• When writing to a group of families, use the blind copy line or the school's group messaging tool so addresses aren't shared.
• Never put student names, grades or details into a personal cloud folder or an online tool your district hasn't approved, including artificial intelligence tools.
• Check the photo opt-out list before any picture of a student goes in a newsletter, on a class page or on social media, and never tag students.
• Use a strong password and two-step sign-in on school accounts if your district offers it.

Peabody Teach is built for this: our random name picker, wheel, group maker and seating chart maker keep class lists in your own browser, and never send them to us. Our privacy page explains how.

7 Before you try a new app or website

New tools appear every week, and many are excellent. The safest habit is to ask before students use one, and to know the questions your district will ask. These come from the FTC's guidance on what schools should find out before they consent to an app collecting students' information:

1. What personal information will the app collect from students?
2. How will the company use it?
3. Does the company use or share the information for commercial purposes that have nothing to do with the service the school asked for?
4. Can the school review the information collected and have it deleted?
5. What does the company do to keep the information secure?
6. How long does the company keep the information, and when does it delete it?

If you can't find the answers in the company's privacy notice, that is itself an answer. Send the link to your technology coordinator with a sentence on why you want to use it, and wait for the reply before students sign up.

Some tools need no review because students never touch them: a timer on your screen, a worksheet you print, a puzzle you make and hand out on paper. When you only need something for the projector or the printer, choose a tool that asks students for nothing.

What to say"I'd like to use this site for spelling practice. Students would make accounts with their first names. Could you check whether it's approved, or tell me how to request a review?"

8 If something goes wrong

Mistakes happen to careful people: a spreadsheet attached to the wrong email, a laptop left on a bus, a photo posted before you checked the opt-out list. What matters most is what you do in the next hour.

1. Tell your administrator straight away, the same day, even if it seems small. Districts have a procedure for this, and they may need to act quickly.
2. Write down what happened while you remember it: what information, whose, sent or shown to whom, and when.
3. Don't try to fix it quietly. Don't contact the families yourself, or ask the person who received the information to delete it, unless your administrator asks you to. Your school will decide who says what.
4. Change your password if an account may have been exposed, and report a lost device to your technology department.

Afterward, think about what would have prevented it, and change one habit. After an email goes to the wrong parent, for example, switching off address auto-fill stops it happening the same way twice.

9 Talking with families about privacy

Families ask good questions about privacy, and a clear, calm answer builds trust. You don't need to be an expert; you need to know where the answers live.

• "Can I see my child's records?" Yes, under FERPA parents have the right to see their child's education records. Point them to the office, which handles requests.
• "What does this app collect about my child?" Point them to the district's list of approved tools and the company's privacy notice, and tell them who in the school can answer further questions.
• "Why was my child's photo in the newsletter?" Check the opt-out list, apologize if it was missed, take it down where you can, and tell your administrator.
• "Can you tell me how another child is doing?" No. Explain kindly that you would protect their child's information in the same way.

At the start of the year, a sentence in your welcome letter goes a long way: which tools the class uses, that they are on the district's approved list, and who to contact with questions. Families who know you take privacy seriously are more forgiving when you need to ask for consent later.

What to say"Everything we use in class is on the district's approved list, and I keep grades and notes about your child in the school's own systems. If you ever have a question about what's collected, I'm happy to find out for you."