Gradescope and Student Data Privacy: What Teachers Should Know
The privacy decisions that matter most in day-to-day Gradescope use aren't the ones covered in a legal contract, they're the ones a teacher makes every time a stack of paper exams gets scanned, a gradebook gets exported, or an anonymous-grading toggle gets left off. Whether Gradescope's contractual FERPA and COPPA posture is sound is a separate legal question. This one is about the workflow choices sitting entirely inside a teacher's own control.
Quick Answer: A scanned paper exam carries a student's name and handwriting into Gradescope's cloud storage the moment it's uploaded, and a gradebook CSV export includes full names, student IDs, and email addresses by default. Two features change that: the assignment-level "Do Not Store" repository option and, separately, Gradescope's built-in anonymous grading toggle, which hides student identity from the grader entirely. Neither is enabled automatically. Most of the practical privacy exposure in a Gradescope classroom comes from a default nobody turned off, not from a gap in the vendor's contract.
If you're looking for the legal side of this question, whether Gradescope satisfies COPPA for under-13 students and how its FERPA contract with your institution actually works, that's covered in depth in the companion piece, Is Gradescope COPPA Compliant?. This article stays on the ground: the actual scanning, exporting, and roster-management decisions a teacher makes every week.
Why Workflow-Level Privacy Habits Matter More Than a Vendor's Contract
A signed institutional agreement sets the legal floor for how Gradescope may handle student data, but most of what a family actually experiences day to day comes from the workflow choices made inside an individual classroom, not the contract's fine print. Common Sense Media's 2025 family research found that 83% of parents said their child's school had not communicated with them about how classroom AI and edtech tools use student data at all (Common Sense Media, 2025), a gap that a well-run classroom workflow can partly close even before a district-level policy catches up.
That's the practical case for treating this as a teacher-level responsibility rather than something to defer entirely to IT. A parent is far more likely to ask "what happens to the picture of my child's test" than "what does the Data Processing Agreement say," and the workflow habits below are what actually answer that question.
What Actually Happens When You Scan a Paper Exam
A scanned exam page carries whatever a student wrote on it, including their name if it's written on the paper, directly into Gradescope's cloud storage the moment it's uploaded, with no automatic redaction step in between. That's worth pausing on, because it's easy to think of a "digital tool" as inherently more private than paper, when the scanning step is actually where a physical document first becomes a cloud-stored file.
A few practical realities of the scan-and-upload workflow:
- Bubble-sheet and template-based exams link a scanned page to a student by name or ID field, printed directly on the page before it's ever scanned.
- A batch scan uploaded as one PDF gets automatically split and matched to individual students using the name or ID Gradescope reads from each page, a process that occasionally mismatches a page and requires manual correction.
- The original scanned image remains available to instructors and TAs after grading, unless anonymous grading is enabled for that specific assignment.
None of this is a flaw in Gradescope's design. It's simply the tradeoff of a scan-based grading tool: efficiency at the cost of every submission becoming a stored, identity-linked image file rather than a piece of paper that gets handed back and forgotten.
What the Mobile App Submission Workflow Adds to the Picture
When a student submits homework through Gradescope's mobile app instead of a teacher scanning a batch of papers, the same privacy questions apply, but the data now originates from the student's own phone camera rather than a classroom scanner. The app lets a student photograph each page of handwritten work directly, with a built-in edge-detection overlay that captures the page without needing a separate scanner or a third-party scanning app.
That shifts a few practical details worth knowing:
- The photo itself, not just the graded result, becomes part of the submission record, meaning image quality, lighting, and whatever else happens to be in frame around the page all get uploaded along with the actual work.
- A student assigns their own submission to specific questions after scanning, a step that puts a small amount of manual organization directly in the student's hands rather than an instructor's.
- Students can review their own submission and feedback afterward through the same app, which is a convenience but also means grade and feedback data now lives on a personal device's app in addition to the web platform.
For a middle or early-high-school class where students are submitting from personal or family devices rather than school-managed ones, it's worth a brief classroom conversation about photographing only the assignment page itself, not, for example, a desk covered in other visible personal materials, before the scan is taken.
The Anonymous Grading Feature Most Teachers Never Turn On
Gradescope includes a genuine anonymous grading option, set per assignment, that replaces a student's name with a randomized identifier throughout the entire grading workflow, but it has to be turned on deliberately before an assignment opens for submissions. Few instructors outside grading-fairness research seem to use it by default, based on how the feature is documented as an opt-in setting rather than a platform default.
| What anonymous grading does | What it does not do |
|---|---|
| Replaces the student's name and email with a randomized ID on every grading screen | Change what the student sees on their own submission |
| Disables the "download original submission" button for graders | Anonymize the assignment after grading is complete and names are revealed |
| Removes names, IDs, and emails from the exported grade CSV for that assignment | Apply automatically to every assignment in a course; it's set individually |
| Uses a different randomized ID per assignment, so grading patterns can't be tracked across a term | Prevent an instructor from turning it back off and revealing names at any point |
The fairness case for turning it on is straightforward: an instructor grading without seeing a name in advance is less likely to have prior expectations about a specific student influence a grade, a documented concern in general grading-bias research. The privacy case is just as direct: for any assignment where a teacher doesn't need to see a name mid-grading, for example a multiple-choice unit test being graded purely by answer key, there's no reason identity needs to be visible at all during that step.
What Your Gradebook Export Actually Contains
A standard Gradescope grade export includes each student's full name, student ID, email address, and every score, all in one CSV file, which is far more identifying information than most downstream uses of that file actually require. A teacher exporting grades to upload into a district gradebook system needs exactly that level of detail. A teacher exporting the same file to share aggregate class performance with a curriculum coordinator, or to analyze which questions the class struggled with most, usually doesn't.
Before sharing any Gradescope export outside your own gradebook workflow, a short checklist avoids the most common overexposure:
- Ask what the recipient actually needs. A department chair analyzing which exam questions were hardest across sections rarely needs individual student names attached.
- Strip identifying columns before sharing a file for analysis purposes, keeping only question-level score data if that's genuinely all that's needed.
- Never forward a raw export over an unencrypted personal email, even internally; use your school's approved file-sharing system instead.
- Delete a local copy once it's served its purpose, rather than letting exported CSVs accumulate in a personal downloads folder across a school year.
Managing a Roster With Mixed Student Ages
A single course roster synced from your school's learning management system can quietly include students of meaningfully different ages, especially in an accelerated, combined, or dual-enrollment section, which matters because it's the actual trigger for whether COPPA's under-13 consent pathway applies to any specific student in that class. The companion legal article covers why Gradescope's typical AP-level and college user base makes this uncommon overall; it doesn't make it impossible for your specific roster.
A practical habit worth adopting each term: when your course roster syncs automatically from your LMS, spend two minutes confirming it matches the actual enrolled students, rather than assuming the sync pulled exactly the right group. A stale sync can leave a withdrawn student's data active in Gradescope longer than necessary, or, less commonly, add a student to a course they were never actually enrolled in.
What Happens to Student Work After the Term Ends
Student-uploaded assignment submissions and instructor grading records generally remain accessible within a Gradescope course after the term closes, unless the course itself is deleted, and a course must have its assignments removed before it can be deleted at all. That means "the semester ended" is not, on its own, a data-deletion event.
For a teacher thinking about end-of-term cleanup, three questions are worth asking your department or IT office directly, since the answers depend on your institution's own retention policy layered on top of Gradescope's platform defaults:
- Does our institution have a standard retention timeline for past-course Gradescope data, or does it default to indefinite retention until someone manually deletes a course?
- Who has the authority to delete a completed course's assignments and data, the individual instructor or a department administrator?
- Is there a documented process for a graduating or transferring student to request their data be removed, consistent with the deletion-on-request commitment described in Gradescope's own privacy policy?
Talking to Parents About the Scanned-Handwriting Question
A parent asking "why does a cloud service have a scanned copy of my child's handwriting" deserves a direct, non-technical answer, and it's a fair question given how much more visceral a scanned image feels than an abstract "data collection" statement. A useful response covers three things plainly: what gets scanned, who can see it, and how long it's expected to stay there.
A workable script for that conversation: the scanned exam exists so it can be graded consistently and so a student can review specific feedback on their own answers; the image is visible only to the instructor, teaching assistants, and the student themselves, not to other students or to the public; and retention follows your institution's own policy, which you can point a parent toward more precisely than the platform's general default.
A Classroom Scenario
Say you teach 10th grade chemistry and you're about to give a stoichiometry unit test that includes both multiple-choice questions and free-response calculation problems. You could set the multiple-choice section as a separate, anonymously graded assignment, since grading it is a pure answer-key match with zero benefit to seeing a name, while leaving the free-response section under standard (non-anonymous) grading, since you want to recognize a specific student's recurring error pattern across the term to plan a targeted follow-up.
That split, anonymous grading where identity adds nothing, standard grading where it genuinely helps your teaching, is a workflow decision entirely inside your own account settings, independent of whatever your department's broader Gradescope licensing agreement says about FERPA or COPPA.
Where a Content Generator Fits Into the Same Workflow
Gradescope grades what a teacher has already built; it doesn't generate the original stoichiometry problem set, the answer key, or a template formatted for clean scanning. A teacher preparing that same 10th grade chemistry unit test could use EduGenius to generate a differentiated problem set aligned to a class profile, export it as a PDF formatted with a clear student-ID field for scanning, and then run the completed exams through Gradescope for grading, keeping content creation entirely on the teacher's side of the workflow before any student data touches Gradescope at all.
Pro Tips for a Privacy-Conscious Gradescope Workflow
- Turn on anonymous grading by default for any assignment graded purely against an answer key, and reserve standard grading for work where recognizing the student genuinely improves your feedback.
- Build a habit of deleting local exported CSVs once they've served their purpose, rather than letting a folder of past grade exports accumulate across years.
- Spend two minutes confirming an LMS-synced roster each term, rather than assuming an automatic sync always matches actual enrollment exactly.
- Ask your department chair, once a year, what your institution's actual Gradescope data-retention policy is, since it's genuinely useful to know before a parent or a departing student asks first.
A Workflow-Stage Privacy Checklist
Mapping each stage of a typical Gradescope assignment to a specific privacy habit makes the practices above easier to actually follow week to week, rather than something to remember all at once.
| Workflow stage | Privacy habit worth building | Why it matters |
|---|---|---|
| Before creating the assignment | Decide whether anonymous grading fits this assignment type | Costs nothing to enable and removes identity from the grading step entirely |
| At scanning or upload | Check that only the assignment page is visible in each scan or photo | Keeps unrelated personal material out of the stored submission image |
| During grading | Confirm your roster sync matches actual current enrollment | Prevents outdated or incorrectly added student data from lingering in the course |
| At export time | Strip identifying columns if the file is leaving your own gradebook use | Limits how far full names, IDs, and emails travel beyond their original purpose |
| At term's end | Ask whether your institution has a retention or deletion timeline | Confirms whether "the semester is over" actually triggers anything, since it doesn't by default |
What to Avoid
- Assuming a digital scan is automatically more private than the paper it replaced. A cloud-stored, identity-linked image can be a larger exposure surface than a returned paper exam, not a smaller one.
- Sharing a full gradebook export, names and all, when only aggregate question-level data was actually needed. Strip identifying columns before sending a file outside your own gradebook use.
- Leaving anonymous grading off for assignments where it costs you nothing to turn on. A pure answer-key grading task rarely benefits from seeing a name mid-grade.
- Treating "the semester is over" as equivalent to "the data is deleted." Retention is a separate, institution-level setting that doesn't reset automatically at term's end.
Key Takeaways
- Scanning a paper exam moves a student's name and handwriting into Gradescope's cloud storage immediately, with no automatic redaction, making the scan step itself the most overlooked privacy moment in the whole workflow.
- Gradescope's anonymous grading feature genuinely hides student identity from the grader, including in the exported CSV, but it's an opt-in, per-assignment setting, not a platform default.
- A standard grade export includes full names, student IDs, and emails, more identifying detail than most downstream sharing actually requires; strip identifying columns before sending a file for aggregate analysis.
- Course data generally persists after a term ends until a course is explicitly deleted, so "the semester is over" is not itself a deletion event.
- An LMS-synced roster deserves a quick manual check each term, since a stale sync is the most common way outdated student data lingers inside a course.
- A short, direct explanation to parents, what's scanned, who can see it, and how long it stays, resolves most concerns about submitted handwritten work far better than a link to a privacy policy.
- For the underlying legal and COPPA/FERPA compliance analysis, see the companion article, Is Gradescope COPPA Compliant?, which this piece deliberately leaves to that dedicated guide.
Frequently Asked Questions
Does Gradescope automatically hide student names from the person grading?
No, not by default. Standard grading shows the instructor or TA each student's name throughout the process. Anonymous grading is a separate, opt-in setting enabled per assignment, and once turned on it replaces names with a randomized identifier on every grading screen and in the exported CSV.
What information is included when a teacher exports grades from Gradescope?
A standard export includes each student's full name, student ID, email address, and their score on every question, along with submission timestamps. That's more identifying detail than most secondary uses of the file need, so stripping identifying columns before sharing it outside your own gradebook is a reasonable practice.
Is a scanned paper exam more or less private than handing back the original paper?
In some ways less. The original paper stays with the student once returned; a scanned copy becomes a stored, identity-linked digital file inside Gradescope's cloud system, retained according to your institution's policy rather than disappearing once grading is finished.
Does student work stay in Gradescope forever?
Not necessarily, but there's no automatic deletion at the end of a term. Course data generally remains accessible until an instructor or administrator deletes the course, which requires first removing its assignments, so retention depends on your institution's own policy, not a Gradescope-set expiration date.
Is submitting homework through the Gradescope mobile app less private than a teacher scanning a paper copy?
Not meaningfully less private, but the data path is different. A mobile-app photo submission uploads directly from a student's own device, capturing whatever is in frame around the assignment page, while a teacher-run batch scan happens on school equipment. Either way, the resulting image becomes a stored, identity-linked file inside the course.