AI Tools That Don't Train on Student Data
Quick Answer: No AI tool can prove to a blog post that it "doesn't train on student data." What you can check is whether the vendor states this in a binding contract (a Data Protection Agreement, or DPA), whether that promise covers its AI subprocessors too, and whether an independent auditor (like a SOC 2 report) has ever verified the company's controls. A handful of platforms, including Khan Academy's Khanmigo, Google's Gemini for Education, Microsoft 365 Copilot, OpenAI's ChatGPT Edu, Anthropic's Claude for Education, SchoolAI, and MagicSchool, publish specific no-training language. Districts still have to verify it.
"Doesn't train on student data" has become the single most common claim on an ed-tech privacy page in 2026. Instructure's LearnPlatform found that districts now have access to an average of nearly 3,000 distinct edtech tools a year (Instructure, 2025), and a growing share of them are wrapped around a large language model. Every one of those vendors knows that "we don't train on your data" is the sentence a nervous administrator wants to read.
The trouble is that the sentence is a promise, not a fact you can independently verify by reading it. This guide breaks down what the claim actually means, which named platforms make it in writing, and the specific steps a school or district should take before accepting any vendor's word for it.
What "Doesn't Train on Student Data" Actually Means
A no-training claim is a statement about future model updates, not about whether your data is processed today. Every AI tool has to process a student's input to generate a response. The question a no-training claim answers is narrower: does that input ever get folded into the dataset used to improve the underlying model for other customers?
This distinction gets blurred constantly, so it helps to separate three different things a vendor might mean:
- Processing: the model reads the input and generates an output. This always happens; there is no way to use an AI tool without it.
- Retention: the vendor stores the conversation afterward, for support, abuse review, or analytics. This is a separate setting from training.
- Training: the vendor (or the model provider behind it) feeds the conversation into a future training run so the underlying model literally learns from it.
A tool can retain your data indefinitely and still never train on it. A tool can also promise not to train while still logging every conversation for a year. Read a privacy page slowly enough to notice which of the three it's actually addressing.
A Quick Example: Same Sentence, Three Different Meanings
Say a district technology director reads "we don't use your data to improve our models" on three different vendor pages in the same afternoon. On paper, the sentences look identical. In practice, they can mean very different things.
- Vendor A means the underlying foundation model is contractually barred from training on any customer data, full stop, and can produce a signed attestation from its model provider.
- Vendor B means its own team doesn't manually review conversations to fine-tune anything, but hasn't addressed whether its upstream API provider's default settings apply.
- Vendor C means training is opt-out at the account level, and a district that never checked the settings could be opted in by default.
The sentence is the same; the enforceability behind it is not. That's why the next section treats contracts, not marketing copy, as the real source of truth.
Contracts are how this becomes enforceable rather than aspirational. A marketing page can say anything. A Data Protection Agreement (DPA), the kind school districts sign through frameworks like the Student Data Privacy Consortium's National Data Privacy Agreement, is a legal document that specifies what the vendor and its subprocessors may and may not do with student records. The Student Data Privacy Consortium (SDPC), part of the nonprofit Access 4 Learning community, reports that more than 275,000 standard DPAs have been executed since 2016, with its public registry now hosting over 130,000 signed agreements between roughly 12,000 school systems and more than 6,600 providers (SDPC/A4L, 2025). If a no-training promise isn't in that document, it isn't binding on the vendor, no matter how prominently it's displayed on the website.
Why the AI Subprocessor Layer Is the Part Districts Miss
Most classroom AI tools are not themselves large language model builders. SchoolAI, MagicSchool, and dozens of similar platforms build a classroom-facing product on top of a foundation model from OpenAI, Anthropic, or Google. That means a no-training promise only holds if it extends through the entire chain, not just the layer the district contracted with directly.
A useful question for any vendor demo: "Does your no-training commitment bind your underlying model provider too, and can you show me that in writing?" A vendor that can produce a signed attestation from its model provider (rather than a verbal assurance) is demonstrating exactly the kind of subprocessor transparency this section is about.
Why This Claim Matters More in 2026 Than It Did a Few Years Ago
Parents and teachers are not equally reassured by vendor promises, and their skepticism has data behind it. Common Sense Media's 2025 family research found that 84% of parents and 76% of children reported concern about AI tools misusing student data, while 83% of parents said their child's school had not communicated with them about generative AI use at all (Common Sense Media, 2025).
Educators are catching up more slowly than the tools are spreading. RAND's 2025 survey of U.S. teachers and principals found that about a quarter of teachers used AI tools for instructional planning during the 2023–2024 school year, and that 70% of principals cited data privacy concerns as a major or minor factor shaping their AI decisions (RAND, 2025). That's a lot of principals making judgment calls with limited technical staff to help them.
Three forces are converging at once:
- Regulatory tightening. The FTC finalized its first COPPA Rule amendments since 2013 on April 22, 2025, adding requirements around separate parental consent for third-party data sharing (FTC, 2025).
- Vendor sprawl. Districts are managing thousands of nominally available tools even though students and teachers actually use only a few dozen each in a given year (Instructure, 2025).
- A costly reminder of what's at stake. PowerSchool's December 2024 breach, which TechCrunch's reporting through early 2025 traced to a single compromised support-portal credential, exposed records that were later reported to affect more than 62 million students and 9.5 million teachers, including names, addresses, and Social Security numbers (TechCrunch, 2025). PowerSchool is a student information system, not an AI product, but the breach is a sharp reminder that a vendor's data-handling promises are only as good as its security practices behind them.
None of this means a school should avoid AI tools entirely. It means the "we don't train on your data" line has become table stakes marketing copy rather than a differentiator, which is exactly why it needs independent scrutiny rather than a quick skim before a purchase order gets signed.
Not All Evidence Is Equal: What Each Signal Actually Proves
Vendors stack several different signals on a single privacy page, and it's easy to read them as one big reassurance instead of separate claims that prove separate things.
| Signal | What it actually proves | What it does NOT prove |
|---|---|---|
| Privacy policy statement | The vendor's stated intent, in its own words | Nothing enforceable on its own; not legally binding the way a signed contract is |
| Signed DPA / NDPA clause | A contractual, enforceable commitment specific to your district | Whether the vendor's subprocessors are bound by the same terms, unless the DPA says so explicitly |
| SOC 2 Type II report | Independently audited security controls (encryption, access management, monitoring) over a period of time | Whether the vendor trains on your data; SOC 2 is a security audit, not a privacy certification |
| FTC-approved Safe Harbor seal (iKeepSafe, PRIVO, kidSAFE) | Independent, government-recognized review of COPPA-specific practices | Coverage of FERPA or state student-privacy law, which fall outside COPPA's scope |
| Model-provider attestation (e.g., "Zero Data Retention") | That the specific upstream AI provider named has certified it does not retain or train on the traffic in question | Whether the vendor's own systems, logs, or analytics layer behave the same way |
The takeaway from this table is simple: no single signal covers everything. A vendor with a SOC 2 report and a strong privacy policy but no third-party COPPA certification is not lying to you, but it is asking you to trust its self-description on the one claim (training) that matters most.
What Named AI Platforms State About Training on Student Data
The table below summarizes what each vendor states, in its own published materials, as of 2026. Every row is framed as what the company says, not as an independently confirmed fact. Where a claim has third-party backing (an audit, a certification body, a signed attestation from a model provider), that's noted separately from a vendor's self-description.
| Platform | What it states about training | Source type |
|---|---|---|
| Khan Academy (Khanmigo) | States its underlying LLM providers are not permitted to train on student conversations, and that names and identifying details are stripped before content reaches the model | Self-published (Khan Academy Help Center) |
| Google Gemini for Education | States prompts and responses in the education tier are not human-reviewed or used to train Google's foundation models, and that it operates as a "school official" under FERPA | Self-published (Google Workspace privacy documentation) |
| Microsoft 365 Copilot (education tier) | States prompts, uploaded content, and responses are not used to train the underlying foundation LLMs | Self-published (Microsoft Learn documentation) |
| OpenAI ChatGPT Edu | States that by default, ChatGPT Edu inputs and outputs are not used to train or improve OpenAI's models | Self-published (OpenAI enterprise privacy pages) |
| Anthropic Claude for Education | States conversations are not used for model training and are exempt from the consumer opt-in/opt-out training toggles introduced in September 2025 | Self-published (Anthropic Privacy Center) |
| SchoolAI | States student data is never used to train AI models, and that its contracts with AI subprocessors explicitly bar pretraining or fine-tuning on that data | Self-published (SchoolAI Trust & Safety pages); SOC 2 Type II noted on the same pages |
| MagicSchool | States it never trains on personally identifiable information, and that OpenAI and Anthropic have provided signed Zero Data Retention attestations covering MagicSchool's traffic | Self-published (MagicSchool Trust pages), with a third-party iKeepSafe COPPA Safe Harbor certification noted separately |
One line in that table matters more than the others. MagicSchool is the only platform in this list where a named third-party certifier, iKeepSafe, publicly lists the product on its own site as a participant in its FTC-approved COPPA Safe Harbor program (iKeepSafe, 2026). That's a materially different level of assurance than a vendor describing its own compliance on its own website, even a well-documented one. It doesn't make the other platforms untrustworthy; it just means their no-training claims currently rest on the vendor's word plus (in SchoolAI's case) a SOC 2 audit of security controls, which is not the same thing as third-party privacy certification.
How to Verify a No-Training Claim Before You Sign
A privacy page is a starting point for a conversation with a vendor, not the end of one. Use this sequence during procurement:
- Ask for the DPA, not the privacy policy. The privacy policy is marketing-adjacent; the DPA is the enforceable document. If a no-training promise only appears on the website and not in the contract, treat it as unverified.
- Ask which model providers sit behind the product. A classroom AI tool built on top of OpenAI, Anthropic, or Google APIs inherits that provider's training policy unless the vendor's own contract overrides it. Get the subprocessor list in writing.
- Ask whether any third party has certified the privacy claim, not just the security controls. A SOC 2 report audits security and availability controls; it does not certify that a company doesn't train on your data. iKeepSafe, PRIVO, and kidSAFE are the FTC-approved organizations that certify COPPA-specific practices; ask directly whether the vendor participates in one of these programs.
- Ask what happens to data already sent before a policy changes. Some vendors reserve the right to update terms going forward; find out whether that could ever retroactively apply to student data already on file.
- Check the state layer, not just federal law. Several states, including California, Colorado, and New York, have student data privacy laws that go beyond FERPA and COPPA. A vendor's federal-only claim doesn't automatically satisfy state requirements.
Picture a middle school curriculum coordinator piloting a new AI writing assistant for an eighth-grade English class. The vendor's homepage says "student data is never used to train our models." Before the pilot goes district-wide, the coordinator could request the DPA and confirm that same sentence appears in it, ask which model provider sits underneath the product, and check whether that provider (not just the classroom-facing vendor) has published its own attestation. That's the difference between a five-minute website read and a real procurement review, and it's a difference a school can build into its normal purchasing workflow rather than treating as a one-time special project.
A district evaluating classroom content tools alongside classroom chat tools can apply the same checklist. For a platform like EduGenius, which is used for generating quizzes, worksheets, and other instructional materials rather than for open-ended student conversation, the relevant question shifts slightly: teachers can build a class profile with grade level and subject inside the platform to shape the content it generates, and the same procurement questions above (what's in the DPA, who processes the data, what's independently verified) still apply before rolling it out district-wide.
Mistakes to Avoid When Reading a "We Don't Train on Your Data" Claim
- Treating "compliant" as a synonym for "certified." A vendor can accurately describe itself as FERPA and COPPA compliant based on its own internal review without having been assessed by an outside certifier. Both can be true statements; they are not equally strong evidence.
- Assuming the promise covers every feature. A tool might not train on chat conversations but could still use uploaded documents differently, or treat a free tier differently than a paid district license. Ask specifically about the tier your school will actually use.
- Skipping the subprocessor question because the vendor "seems small and safe." Smaller ed-tech companies are exactly the ones most likely to be built entirely on someone else's foundation model, which makes the subprocessor chain more important, not less.
- Confusing SOC 2 with a privacy certification. SOC 2 Type II is a real, meaningful audit of security controls (access management, encryption, monitoring). It says almost nothing about whether the vendor trains models on your data.
- Never re-checking after the first year. DPAs get renewed, model providers get swapped, and terms change. A no-training promise verified at signing is not guaranteed to still be accurate at renewal unless someone rechecks it.
Key Takeaways
- "Doesn't train on student data" is a contractual claim, not an inspectable fact: verify it in the signed DPA, not just the privacy page.
- Separate processing, retention, and training when reading any vendor's language; they are three different promises that often get blurred into one sentence.
- The AI subprocessor layer is where most no-training claims quietly break down, since many classroom tools sit on top of OpenAI, Anthropic, or Google models rather than building their own.
- Third-party certification (like iKeepSafe's COPPA Safe Harbor program, which MagicSchool participates in) is stronger evidence than a vendor's own website, though a vendor's own SOC 2 report or DPA language is still meaningful.
- Regulatory and parental pressure are both rising: the FTC's 2025 COPPA amendments and Common Sense Media's 2025 finding that 84% of parents worry about AI misusing student data both push vendors toward clearer written commitments.
- A named vendor's claim (Khanmigo, Gemini for Education, Copilot, ChatGPT Edu, Claude for Education, SchoolAI, MagicSchool) should always be read as "this company states," never as an independently audited guarantee, unless a specific third-party certifier is named alongside it.
- Re-verify at contract renewal, not just at initial signing, since model providers and terms can change.
Frequently Asked Questions
Is there a government seal that certifies an AI tool "doesn't train on student data"?
No. FERPA has no vendor certification program at all; it's a federal law that makes schools and districts, not vendors, the responsible party. COPPA has no "certified no-training" seal either, though the FTC does approve a small number of Safe Harbor organizations, like iKeepSafe, PRIVO, and kidSAFE, that certify specific compliance practices.
Which AI tools have published the clearest no-training language?
Khan Academy's Khanmigo, Google's Gemini for Education, Microsoft 365 Copilot, OpenAI's ChatGPT Edu, and Anthropic's Claude for Education all publish specific statements that student or user conversations are not used to train their models. Each is a vendor self-statement; MagicSchool's claim is additionally backed by iKeepSafe's third-party COPPA Safe Harbor certification.
Does SOC 2 certification mean a vendor doesn't train on student data?
Not directly. SOC 2 Type II audits security controls like encryption, access management, and monitoring over a sustained period. It's meaningful, independently verified evidence of operational maturity, but it doesn't specifically certify a company's data-training practices, which is a separate question a privacy-focused review or contract would need to answer.
What should a district ask for before signing with a new classroom AI tool?
Ask for the signed Data Protection Agreement (not just the privacy policy), the list of AI subprocessors behind the product, and whether any FTC-approved Safe Harbor organization has reviewed its COPPA practices. Treat a website claim as a starting point for that conversation, not the final answer.
Can a "no-training" promise change after a school district signs a contract?
It's possible if the vendor's terms allow unilateral updates or if it switches underlying model providers. That's exactly why the DPA, not the marketing page, needs to specify what happens to previously submitted data if the policy changes, and why annual re-verification matters.
For a broader look at how FERPA and COPPA apply to AI tools generally, see the pillar guide, AI, FERPA & COPPA: The Complete School Data-Privacy Guide (2026). For a deeper look at one specific classroom platform, read Is SchoolAI Safe for FERPA and COPPA? For a step-by-step vetting checklist, see FERPA-Compliant AI Tools for Teachers: A 2026 Checklist Anthropic's own posture is covered in Is Claude FERPA Compliant? and a side-by-side look at two popular classroom assistants is available in SchoolAI vs Khanmigo: Which Is Better for Teachers?