Is Claude FERPA Compliant?
No AI product, including Claude, can be "FERPA compliant" as a standalone fact, because FERPA (20 U.S.C. § 1232g) places the legal obligation on schools and districts, not on the companies that build software. Anthropic offers commercial terms, a data processing agreement, and a Claude for Education program that a district can use to help meet its own FERPA duties, but the compliance outcome depends on which Claude product your school actually contracts for.
Quick Answer: Claude is not FERPA-certified, and neither is any competing chatbot; FERPA doesn't certify software at all. What matters is whether your district uses Anthropic's commercial terms (Claude for Work, Claude Enterprise, or Claude for Education, all covered by a signed agreement) rather than a personal, consumer Claude.ai account, which carries no district-level contract.
This article sits alongside EduGenius's AI, FERPA & COPPA: The Complete School Data-Privacy Guide (2026) and applies the same legal test to Anthropic specifically. Unlike a straightforward tier comparison, the Claude story has an extra wrinkle worth understanding on its own: Anthropic changed its consumer data-training defaults in 2025, and that change is exactly the kind of detail a district's AI policy needs to track.
The Short Answer: No AI Product Passes or Fails FERPA by Itself
FERPA is a law about what schools do, not what software does. It applies to "educational agencies and institutions" receiving U.S. Department of Education funding, per the Department's own guidance at studentprivacy.ed.gov, and it governs how those institutions handle "education records," records that contain information directly tied to an identifiable student.
There's no FERPA inspector who visits Anthropic's offices and issues a certificate. The phrase "FERPA compliant AI tool" is, strictly speaking, a category error, the same way "a FERPA-compliant stapler" would be. What a vendor can do is offer a district the legal terms that let the district's own use of the tool be compliant. Anthropic does this through its Commercial Terms of Service, which cover Claude for Work, Claude Enterprise, Claude for Education, and Claude Gov.
The single fact worth remembering: if your district's only relationship with Claude is a teacher's personal Claude.ai login, there is no contract behind that use at all, and therefore nothing FERPA-relevant to point to if a parent or auditor asks how student data is protected.
Claude's age requirement changes the K-12 question entirely
Here's a detail specific to Claude that a district evaluating it against ChatGPT or Gemini needs to know upfront: Anthropic's Consumer Terms of Service require users to be at least 18 years old to create a personal Claude.ai account. That's a hard floor, not a soft recommendation, and Anthropic has been actively enforcing it, including locking accounts it identifies as belonging to users under 18.
Practically, that means no K-12 student, even a 17-year-old senior, is meant to be interacting with the consumer Claude.ai product directly on their own account. Any K-12 use has to route through a different path: a teacher using Claude themselves to draft materials, or a district-licensed product that embeds Anthropic's API under Anthropic's separate guidelines for "organizations serving minors," which impose additional safety obligations on the organization doing the embedding. This is a meaningfully different shape than ChatGPT for Teachers, which is built as a direct, teacher-supervised classroom product for K-12; Claude's education push, as the next section covers, has so far centered on higher education instead.
What Changed in 2025: Anthropic's Consumer Privacy Flip
Understanding Claude's FERPA posture requires understanding a specific policy change, because it's the detail most likely to catch a district off guard if their AI policy was written before it happened.
| Date | What changed | Why it matters for schools |
|---|---|---|
| Before August 28, 2025 | Consumer Claude (Free, Pro, Max) used an opt-in model for training; chats were not used to train Claude unless a user actively chose to share them. | A teacher's personal consumer account was, by default, not feeding a training pipeline. |
| August 28, 2025 | Anthropic flipped the consumer default to opt-out. New and resumed chats on Free, Pro, and Max plans now train Claude unless the user turns "Help improve Claude" off, and retention extends up to five years for participating users. | A teacher who never touched the setting is now, by default, on the training-eligible path, with far longer retention than before. |
| September 14, 2025 | API log retention was reduced from 30 days to 7 days; API inputs and outputs are automatically deleted after that window and are never used for training. | Applies to developer/API use, not to the consumer chat product most classroom teachers actually open. |
| Ongoing | Claude for Work, Claude Enterprise, Claude for Education, and Claude Gov remain under Commercial Terms: data is not used for model training under any of those plans. | This is the tier a district actually needs, and it has not changed in this respect. |
Sources: Anthropic, "Updates to Consumer Terms and Privacy Policy" (2025); Anthropic Trust Center and Privacy Center documentation.
The takeaway is not "Claude got worse." It's that the consumer product and the commercial product diverged further from each other in 2025 than they had before. A district that assumed "Claude doesn't train on our data" based on how the consumer product used to work needs to re-check that assumption, because it's no longer true for personal accounts on the default setting.
Why this distinction matters more than it sounds
A teacher pasting a lesson plan into personal Claude.ai for their own use, with no student names attached, is a low-stakes situation regardless of the training default. The same teacher pasting an anonymized-in-their-head but actually re-identifiable narrative about "the student in third period who struggles with fractions" into that same personal account is a different situation entirely, and the training-default flip makes the downside of that habit larger than it used to be.
Claude for Education, Claude for Work, and Claude Enterprise: The Commercial Layer
Anthropic's institutional products sit on a separate legal foundation from the consumer chat interface, and this is the layer that actually does FERPA-relevant work.
- Claude for Education, launched in April 2025, is Anthropic's higher-education-focused offering. Early partners announced at launch included Northeastern University, which extended access to roughly 50,000 students, faculty, and staff across 13 global campuses; the London School of Economics and Political Science; and Champlain College. It includes a "Learning mode" designed to guide a student's reasoning process with Socratic-style questions rather than simply supplying answers.
- Claude for Work and Claude Enterprise are Anthropic's broader business tiers, covering organizations including K-12 districts that want managed accounts, admin controls, and a signed agreement rather than a consortium of personal logins.
- All of these fall under Anthropic's Commercial Terms of Service, and Anthropic states that data from Claude for Work, Enterprise, Education, and Gov is not used for model training. A Data Processing Addendum, including Standard Contractual Clauses, is automatically incorporated once an organization accepts the Commercial Terms.
None of that is automatic FERPA compliance either. It's the contractual foundation a district's legal team needs in place before FERPA's four-part "school official" test can even be evaluated.
Where Claude fits below the university level
Every named launch partner for Claude for Education so far (Northeastern, LSE, Champlain College) is a higher-education institution, not a K-12 district. That doesn't mean a K-12 district can't sign Anthropic's Commercial Terms; Claude for Work and Claude Enterprise are available to any organization, districts included. It does mean a K-12 technology director should expect fewer off-the-shelf, K-12-specific assurances than they'd get from a product Anthropic has explicitly built and marketed for younger students, and should ask Anthropic's sales team directly whether the minors-serving guidelines apply to their intended deployment.
The Three-Part Test for Whether Your District Can Use Claude Compliantly
Rather than asking "is Claude compliant," a district gets a more useful answer by running through three concrete checks.
| Check | What to verify | Where the answer lives |
|---|---|---|
| 1. Contract, not chat window | Has the district signed Anthropic's Commercial Terms (Claude for Work, Enterprise, or Education), or are staff using personal Claude.ai accounts? | Procurement or legal's contract file, not a teacher's browser bookmark |
| 2. Direct control | Does the district control provisioning (who has access, what data categories are allowed), rather than leaving it to individual account settings? | Admin console, SSO configuration, written acceptable-use policy |
| 3. Training and retention terms | Does the signed agreement confirm data is excluded from training and specify a retention and deletion timeline the district can audit? | The DPA text itself, reviewed by counsel, not the marketing page |
A district that can answer "yes, in writing" to all three has done the actual work FERPA requires. A district that can only answer "I assume so" to any of them has a gap, regardless of how privacy-forward Anthropic's public statements sound.
It helps to run this test the same way for every vendor under consideration, not just Claude, so comparisons are apples-to-apples. A vendor that scores "yes" on all three isn't automatically the right fit for every district's use case; it has simply cleared the baseline that makes the FERPA question answerable at all. From there, the decision becomes a normal procurement one: cost, feature fit, and how well the tool actually serves the instructional goal a department is trying to solve.
Rolling Out Claude in a District: A Practical Sequence
- Identify the use case before the product. "Teachers using Claude to draft rubrics" and "students chatting with Claude directly" carry very different risk profiles and may call for different Claude products or none at all for the second case without further review.
- Route procurement through Claude for Education or Enterprise, never personal accounts. This is the step that actually creates the contract FERPA's school-official exception depends on.
- Confirm training exclusion and retention terms in writing. Ask specifically whether the agreement covers Claude for Education's classroom features, not just the base commercial terms, since programs can have their own addenda.
- Set up SSO and admin-managed provisioning. This demonstrates the "direct control" element of FERPA's test far more convincingly than a policy document alone.
- Write an acceptable-use policy naming what never goes into a prompt. Discipline records, health information, and identifiable academic performance data belong on that never-list on any AI product, Claude included.
- Separately confirm your COPPA posture for any student under 13. FERPA and COPPA are different laws with different triggers, and a Claude for Education rollout aimed at younger students needs both addressed.
- Re-verify annually, given how much changed in Anthropic's own consumer terms in a single year (2025 alone saw the training-default flip and the API retention change).
None of these steps are unique to Claude; they're roughly the same sequence any district should run for ChatGPT, Gemini, or any other general-purpose AI product. What's specific to Claude is the age floor covered above and the fact that Anthropic's education marketing has, to date, spoken mostly to universities. A district shouldn't read the absence of a splashy K-12 product announcement as evidence that Claude Enterprise is somehow unsuitable for K-12 use; it just means the district has to do more of the translation work itself, asking Anthropic's sales and legal contacts questions a dedicated K-12 product page would otherwise answer up front.
Districts evaluating Claude alongside other options often find it useful to also look at platforms purpose-built for K-12 workflows. EduGenius, for instance, is designed around class profiles that teachers configure once (grade level, subject, ability range) rather than open-ended chat, and it can generate differentiated worksheets, quizzes, and flashcards directly from that profile, which sidesteps the question of whether individual students need their own AI accounts at all.
Common Mistakes Districts Make With Claude and Student Data
- Assuming "Claude doesn't train on data" still describes the consumer product. That was true before August 28, 2025; it is no longer the default for Free, Pro, and Max accounts, so any policy written before that date needs review.
- Treating Claude for Education's academic-integrity features as a privacy feature. Learning mode is about pedagogy (guiding reasoning rather than giving direct answers), not about data handling; the two are separate design decisions worth evaluating independently.
- Signing a DPA and then never configuring the admin console to match it. A contract that promises retention limits doesn't enforce itself; someone has to actually set the retention window and turn off unmanaged self-signup.
- Conflating Claude's general privacy reputation with a specific district's contractual protections. Anthropic's public commitments to safety and privacy are real and well documented, but they describe the company's overall posture, not a guarantee that any specific unsigned, uncontracted use automatically inherits those protections.
- Overlooking the 18-plus age floor on consumer accounts. A district that assumes older high schoolers can simply sign up for Claude.ai directly, the way they might for a study app, runs into Anthropic's own terms of service before it ever reaches a FERPA question; the account itself isn't permitted.
- Skipping the comparison to other vendors. Districts sometimes over-index on one company's terms without checking how it stacks up. Is ChatGPT FERPA Compliant? What Schools Need to Know runs the same analysis for OpenAI, and AI Tools That Don't Train on Student Data looks specifically at training posture across a broader set of vendors.
For a practical, vendor-agnostic way to run this evaluation on any AI tool your district is considering, not just Claude, see FERPA-Compliant AI Tools for Teachers: A 2026 Checklist. And because Claude's education push has skewed toward higher ed, K-12 districts often end up comparing it against tools built K-12-first from day one; SchoolAI vs Khanmigo: Which Is Better for Teachers? is a useful look at two of those.
Key Takeaways
- FERPA regulates districts, not AI vendors. There is no certification Anthropic can earn that makes Claude "FERPA compliant" on its own; the legal obligation sits with the school.
- Consumer Claude.ai and commercial Claude are different products, legally. Personal accounts carry no district contract; Claude for Work, Enterprise, and Education fall under Commercial Terms that exclude training by default.
- Anthropic changed its consumer training default on August 28, 2025, moving Free, Pro, and Max plans from opt-in to opt-out, with retention up to five years for participating accounts.
- API retention was separately cut to 7 days as of September 14, 2025, and API data is never used for training, though this applies to developer use, not typical classroom chat use.
- The three-part test (contract, direct control, verified training/retention terms) is the practical way to evaluate any Claude rollout, and all three need a documented "yes."
- Claude for Education, launched April 2025 with partners including Northeastern University, LSE, and Champlain College, is the education-specific commercial track, distinct from both the general Claude Enterprise product and the consumer app.
- Anthropic's Consumer Terms require users to be 18 or older, so no K-12 student is meant to hold a personal Claude.ai account; K-12 use has to route through a teacher, a district-licensed product, or an API integration built under Anthropic's minors-serving guidelines.
- Claude's education launches so far have centered on universities, not K-12 districts, unlike OpenAI's dedicated K-12 tier, so K-12 technology directors should ask Anthropic directly how the minors-serving guidelines apply to their specific deployment.
- A policy written before 2025's changes needs a fresh review, since both the consumer default and the API retention window shifted within the same year.
Frequently Asked Questions
Does Claude train on student data?
It depends entirely on which product. Claude for Work, Claude Enterprise, and Claude for Education, all covered by Anthropic's Commercial Terms, are not used to train Claude. Consumer Claude.ai (Free, Pro, Max) now defaults to training-eligible as of August 28, 2025, unless the user turns that setting off.
Is Claude for Education FERPA compliant?
Claude for Education itself isn't "FERPA compliant" as a product; that designation doesn't exist. It falls under Anthropic's Commercial Terms, which exclude training and can be paired with a signed data processing agreement, giving a district the contractual foundation FERPA's school-official exception actually requires.
What's the difference between Claude.ai and Claude for Education?
Claude.ai is Anthropic's general consumer chat product, available on personal accounts with consumer terms. Claude for Education is a separate, institution-managed program under Commercial Terms, launched in April 2025, with admin controls and features like Learning mode built for classroom and campus use.
Can teachers use their personal Claude account with student data?
This isn't advisable. A personal Claude.ai account has no district-level contract, so there's nothing establishing the "direct control" and "no redisclosure" conditions FERPA requires. Any use involving identifiable student information should go through a district-provisioned Claude for Education or Enterprise account instead.
How often does Anthropic change its data policies?
More often than most districts revisit their own AI policy. In 2025 alone, Anthropic changed the consumer training default (August) and reduced API log retention (September). Districts should treat their Claude policy as something to re-verify annually, not something to write once and file away.
Can K-12 students use Claude directly?
Not on a personal account. Anthropic's Consumer Terms of Service set a minimum age of 18 for Claude.ai accounts, and the company actively enforces that limit. Direct student use in K-12 has to come through a teacher-mediated workflow or a licensed product built on Anthropic's API under its guidelines for organizations serving minors.