Is Canva for Education FERPA Compliant?

Canva for Education carries more third-party FERPA evidence than most classroom tools, yet it still is not "FERPA certified," because FERPA (20 U.S.C. § 1232g) binds schools, not vendors, and no government body certifies it. Canva holds a genuine iKeepSafe FERPA assessment and is a signatory to the U.S. National Data Privacy Agreement. Both support a district's compliance under the school-official exception (34 CFR § 99.31(a)(1)), but your district stays the responsible party.

Quick Answer: No vendor is "FERPA certified," Canva included, since FERPA regulates schools rather than software companies. What sets Canva for Education apart is the strength of its evidence: it holds an iKeepSafe FERPA certification, which is a real independent assessment rather than a self-written badge, and it signs the National Data Privacy Agreement used by many U.S. states. Both are meaningful, but neither is a government seal, and the enforceable protection for your specific school remains its own signed agreement. Canva for Education is also 100% free for verified K-12 schools and states that it does not train its AI models on education content.

This guide is the FERPA-specific companion in a set. For the content-moderation and student-safety layer, see Is Canva for Education safe for students?; for the children's-privacy consent mechanics, see Is Canva for Education COPPA compliant?. Here the focus is narrow: what Canva's FERPA evidence actually proves, what it does not, and where your district's own work still has to happen.

Canva Sits in an Unusual Spot on the FERPA Evidence Ladder

Most classroom tools back a FERPA claim with self-description plus a signed contract, and nothing more; Canva for Education adds a rung most of its peers lack, an independent third-party assessment. That is worth naming precisely rather than rounding up to "certified," because the precise version is both more accurate and more useful to a district.

FERPA compliance is not a badge a vendor wins. It is a status a district maintains, through the contracts it signs and the way it configures a tool. So the honest question is not "did Canva pass a FERPA test" but "how strong is the evidence a district can lean on when it takes responsibility for FERPA itself."

RAND's 2025 survey of U.S. teachers and principals found that 70% of principals weigh data-privacy concerns when choosing tools (RAND, 2025). A design platform often slips past that review because it feels like poster-making rather than an AI product, even though its generative features put it in the same category. Canva's third-party evidence is exactly what a principal running that review would want to see, provided it is read for what it is.

Canva's iKeepSafe FERPA Certification: A Real Assessment, Not a Government Seal

Canva for Education holds a FERPA and COPPA certification from iKeepSafe, an independent organization that reviews a vendor's education data practices against each framework's criteria (iKeepSafe, 2026). That is a genuine outside assessment, which is stronger than a self-written compliance line. It is still not a government certification, because FERPA does not offer one.

The distinction turns on a subtlety worth getting right. iKeepSafe runs two different kinds of program, and they do not carry the same weight for the two laws.

• For COPPA, iKeepSafe operates an FTC-approved Safe Harbor program under 16 CFR § 312.11, so its COPPA review aligns with a mechanism the government actually recognizes.
• For FERPA, iKeepSafe's certification is a private organization's assessment with no government recognition behind it, because FERPA law establishes no certification or Safe Harbor concept for any vendor to join.

So Canva's iKeepSafe FERPA certification is best understood as the strongest independent signal available in a category where the government offers none, not as proof that a government body blessed the product. The pillar guide, AI, FERPA & COPPA: the complete school data-privacy guide (2026), explains why that ceiling exists for every FERPA vendor claim, Canva's included.

The row that matters most is the bottom one. No vendor can occupy it, which is exactly why the iKeepSafe assessment, however real, cannot be the end of a district's diligence.

The National Data Privacy Agreement and the School-Official Exception

Canva is a signatory to the U.S. National Data Privacy Agreement, a standardized contract template drafted by the Student Data Privacy Consortium that many states and districts use to streamline vendor data-privacy contracting (Canva, 2026). For FERPA, that signature matters because a signed agreement, not a certification, is what satisfies the school-official exception.

FERPA's exception at 34 CFR § 99.31(a)(1) lets a school share education records with a vendor, without individual parental consent, only when four conditions all hold. The NDPA, or a district-specific Data Processing Addendum where a state has not adopted the NDPA, is where those conditions become binding.

The practical upshot is that Canva gives a district two useful documents to lean on, the iKeepSafe assessment and a ready contract template, but the district still has to execute one of them. A signatory list is not a signature; a school is covered when its own agreement is on file, not merely because Canva participates in the NDPA framework.

What Counts as an Education Record Inside a Design Tool

An education record is content directly related to an identifiable student and maintained by the school or a party acting for it, and a design platform generates a distinct set of them worth mapping. Because Canva is a creation tool rather than a gradebook, its records look different from those in a system like Google Classroom.

• A student name and roster assignment, provisioned through a verified class or a district single sign-on integration.
• Design content a student creates and saves, which lives in a class workspace tied to that student.
• Magic Studio prompts, the text a student types to generate an image or caption, which is data tied to the account even when the prompt reads as generic.
• Usage activity, the routine record of a student creating and editing designs.

Each of those traces back to a school-controlled provisioning decision, which is the structural reason the school-official pathway works for an under-13 account. It is also the reason a personal, consumer Canva account a teacher repurposes for a class does not carry the same FERPA posture; the records exist, but outside the education-tier agreement that is supposed to govern them.

Say you teach a Grade 5 class building slideshows about local history, using the AI image generator for a title slide. The saved designs and the prompts behind them are records tied to identifiable students, which is why the assignment belongs inside a verified Canva for Education class covered by a signed agreement, not a colleague's personal login.

Displaying Student Designs Is a FERPA Disclosure Decision

Because a saved design tied to a named student is an education record, publishing or sharing it outside the class is a FERPA disclosure, which makes the sharing setting on an assignment a compliance lever, not just a convenience one. A design set to public is a different FERPA question than one scoped to the class.

FERPA generally requires consent before a school discloses identifiable records to third parties, with narrow exceptions. A student design featured on a public school website, a shared gallery, or an open link is a disclosure that either needs consent or has to fit an exception such as directory information.

• Class-only sharing keeps a design inside the school-official relationship, sidestepping the third-party disclosure question entirely.
• A public gallery or an open share link is an outward disclosure, where consent or a directory-information designation has to be in place first.
• A student name shown alongside a published design can itself be the identifiable element, even when the design content is innocuous.

School and district admins can control whether student work can be shared publicly or only within the teacher-managed class, and defaulting to class-only for elementary grades keeps the disclosure question from arising by accident. The safety companion covers these controls from an exposure angle; the FERPA point here is narrower, that sharing a record is a disclosure decision the law actually governs.

Say you want to showcase a Grade 4 water-cycle poster project. Featuring the posters without student names, or with parental consent, respects the disclosure rule; posting named student work to a public page without either steps outside it, however celebratory the intent.

Does "No AI Training on Education Content" Help the FERPA Case?

Canva states that content created in education accounts is not used to train or improve its AI models, and that students cannot opt into that training (Canva, 2026). For FERPA, that commitment maps onto the "authorized purpose only" condition, since training a general model on student work would be a use beyond the school's educational purpose.

It is genuinely helpful, but two caveats keep it honest and belong in a FERPA review.

1. A no-training promise is about model improvement, not about whether data is processed at all. Generating an image still requires processing the prompt, so the commitment limits reuse rather than eliminating processing.
2. A public policy is not a contract. The FERPA-relevant version of this promise is the one written into your district's signed agreement, where it becomes enforceable rather than a statement on a policy page.

The admin-level ability to restrict which generative features reach which grade bands, covered in the safety companion, doubles as a practical way to limit how much prompt-level data a younger cohort generates in the first place. Narrowing the AI surface for early grades is a FERPA data-minimization move as much as a safety one.

Certification Plus Contract: Why You Still Need Your Own Agreement

The most common FERPA misread of Canva is treating the iKeepSafe certification and the NDPA signature as if either one, by itself, makes a district compliant. They are strong inputs; they are not substitutes for the district's own executed agreement.

The reason is structural. FERPA holds the school responsible, so the school needs a contract it can enforce against the vendor, specific to its own students and configuration. A certification proves an outside reviewer checked the vendor's practices; a signatory framework proves a template exists. Neither is the enforceable instrument your own students are protected by.

Three artifacts, three different jobs:

• The iKeepSafe certification shows an independent body reviewed the education data practices.
• The NDPA framework provides a standardized contract many states already accept.
• Your district's executed agreement is the only one FERPA actually enforces on your behalf.

Common Sense Media's 2025 family research found that 83% of parents said their school had not communicated with them about how classroom tools use student data (Common Sense Media, 2025). Being able to tell a family that the district holds a signed agreement, that designs stay inside the class, and that student work is not used to train AI is a concrete way to close part of that gap, and it depends on the signed agreement actually existing.

A FERPA Verification Checklist for a Canva Rollout

Work through these before treating Canva for Education as FERPA-ready for a building, and get written answers rather than assumptions. Each maps back to the school-official exception rather than to a badge.

1. Confirm the district has a signed NDPA or DPA with Canva on file, separate from the public Trust Center language.
2. Verify the iKeepSafe certification is current for the specific product tier your school uses, rather than assuming a certification never expires or gets re-scoped.
3. Check that the agreement covers Magic Studio prompt data, not only the platform's non-AI account activity, especially if it was signed before generative features launched.
4. Provision students through a verified class or SSO, never a personal consumer account, so records fall under the education-tier agreement.
5. Set sharing defaults to class-only so student designs, which are records, are not exposed beyond the class.
6. Check your state statute, since California's SOPIPA or Illinois's SOPPA can require more than FERPA and a federal-level certification cover.

For the underlying worksheet, quiz, or slide content a class designs around, as distinct from the design layer itself, you could use EduGenius to generate that material from a class profile you configure with grade level and subject, then export it to PDF, DOCX, or PowerPoint and bring it into Canva for the visual step. Because the generation happens from a teacher-configured profile without individual student accounts, the content-creation stage adds no new student-facing login to secure before the design work begins.

Related Reading

• AI, FERPA & COPPA: The Complete School Data-Privacy Guide (2026)
• Is Canva for Education COPPA Compliant?
• Canva for Education and Student Data Privacy: What Teachers Should Know
• Is Curipod FERPA Compliant?
• Is Khanmigo COPPA Compliant?
• Diffit and Student Data Privacy: What Teachers Should Know