Is Diffit FERPA Compliant?

Diffit is not "FERPA certified," because FERPA (20 U.S.C. § 1232g) issues no certification to any vendor; it binds the school district instead. What makes Diffit's answer unusual is the other half of it: Diffit states it collects zero student data, because only teachers hold accounts, so there is very little "education record" for FERPA to attach to at the vendor level in the first place. That is a genuinely strong posture, and it remains a vendor claim a district should verify rather than simply inherit.

Quick Answer: No product is "FERPA certified," and Diffit does not claim to be one. Diffit states it collects only a teacher's name, email, and IP address, and no student data at all, since students never log in. FERPA protects a student's "education records," so a tool that maintains none of them gives the law almost nothing to govern at the vendor level. The FERPA exposure that remains lives not in Diffit's design but in what a teacher chooses to paste into it. The district stays legally responsible for both.

This is a narrower and more interesting question than a typical "is this tool compliant" article. It is not really asking whether Diffit runs a strong privacy program overall, since that ground is already covered in Diffit and Student Data Privacy: What Teachers Should Know. It asks something more precise: if a tool collects no student records, what is left for FERPA to attach to, and where does the law quietly re-enter anyway?

FERPA Binds Schools, and Diffit Holds Almost Nothing FERPA Governs

FERPA is a federal law about how a school or district manages student education records, and it does not certify software. No agency issues a "FERPA compliant" seal a vendor can display, so the phrase on any product page, Diffit included, is shorthand for "here are terms your district can rely on," never a government credential.

Two facts sit underneath the whole analysis, and they pull in the same direction:

• FERPA regulates the "educational agency or institution," meaning the funded school district, not the vendor it hires. The US Department of Education's Student Privacy Policy Office enforces it, and it runs no vendor-certification program.
• FERPA's subject is the "education record." Where a tool never creates or holds one, the law's core machinery, disclosure limits, parental access, the school-official exception, has very little to operate on.

Diffit is built so that the second fact does most of the work. Because the tool takes teacher input and returns leveled materials, without a student ever creating an account, the pool of student records it maintains is, by its stated design, empty. The pillar guide, AI, FERPA & COPPA: The Complete School Data-Privacy Guide (2026), explains why that certification-versus-contract distinction is the single most important fact across every vendor question of this kind.

What FERPA Attaches To, and Why Diffit's Design Sidesteps Most of It

FERPA protects "education records," defined broadly as information directly related to an identifiable student and maintained by the school or a party acting for the school. The key words are "identifiable student" and "maintained," and a teacher-only tool struggles to satisfy either at the vendor level.

Consider what FERPA normally cares about, and whether each piece has anything to grip in a tool nobody under 18 logs into.

Reading down that table, the pattern is consistent: almost every FERPA obligation presupposes a student education record, and Diffit's stated model does not create one. That is a structurally cleaner answer than a tool that collects student data and then argues its handling is careful.

The Difference Between "Compliant" and "Nothing to Comply About"

There is a subtle but important distinction worth naming. A student-facing platform earns a FERPA answer by collecting records and then locking down how they are used through a contract. A teacher-only tool like Diffit gets there a different way, by not generating the records at all, which is the data-minimization principle privacy regulators consistently recommend as a first line of defense.

Both routes can be legitimate. They simply carry different risks, and a district evaluating Diffit is checking a factual claim about architecture rather than parsing the fine print of a consent chain.

Where the Education Record Actually Lives Across Three Tools

It helps to place Diffit next to two tools this series also covers, to make the "where does the record live" question concrete rather than abstract.

The contrast is the point. Is Newsela FERPA Compliant? describes a platform where students log in directly, so education records form continuously and a signed agreement has to do real work. Is GPTZero FERPA Compliant? covers a detector where a teacher submits a student's essay, which is itself an education record. Diffit sits at the opposite end, holding almost nothing for FERPA to reach.

What Diffit States About Its Own Data Practices

Diffit's published privacy page states plainly that the company does not collect any student data, is FERPA and COPPA compliant, and collects only a teacher's name, email address, and IP address to operate the service (Diffit, 2026). It further states it will never sell data or use it to advertise third-party products, and that it is a signatory of the National Data Privacy Agreement and the Student Data Privacy Consortium's statewide privacy agreements.

Those are meaningful commitments, and the consortium membership matters for FERPA specifically. A signatory status signals that a pre-negotiated agreement template exists, which is the mechanism a district uses to satisfy the school-official exception when it does need a contract on file.

Still, "states it is compliant" and "a district has independently confirmed it" are different standards, and only the second should govern a rollout. That is not skepticism aimed at Diffit in particular; it is the correct posture toward any vendor, precisely because FERPA offers no certification a district could otherwise point to. The honest framing is that Diffit's design makes the FERPA question small, and the district's job is to confirm the design is what the page says it is.

Where FERPA Still Shows Up With a Teacher-Only Tool

The one place FERPA genuinely re-enters is not Diffit's architecture; it is the teacher's keyboard. A tool that collects nothing from students can still receive student-identifying content the instant a teacher pastes it in, and at that moment the material is inside a third-party system regardless of the zero-student-data design.

This is the nuance a "no student accounts, so no FERPA" summary skips, and it deserves specifics.

• Pasting in a student's own writing. If a teacher drops a struggling reader's paragraph into the tool to re-level it, that excerpt can be an education record, and the teacher, not Diffit, put it there.
• Pasting in a document that names students. A class roster, an IEP-adjacent note, or a data table with names carries identifiable information into an outside service.
• Where the output lands next. Once a leveled worksheet leaves the tool as a file or shared link, its storage and sharing fall under the district's own FERPA-aware policies, not the vendor's.

A Grade 8 English Scenario, Walked Through

Say you teach Grade 8 English and want to re-level a dense primary-source passage for a mixed-ability class, plus generate comprehension questions. Handled one way, FERPA barely enters the picture; handled another, it does.

• The clean path: paste in the published source text itself, generate three reading levels, and distribute. No student is identified anywhere, so no education record is created in the process.
• The path that pulls FERPA in: paste in a specific student's flagged essay, complete with their name in the header, to model a "simpler version." Now an identifiable student's work sits in an outside tool, which is a teacher-conduct and FERPA question even though Diffit collected nothing on its own.

The safeguard is a habit, not a setting: strip identifying detail before pasting, and treat student-authored text as something to keep out of any outside AI tool unless a district policy explicitly permits it. The pillar guide covers that teacher-side judgment in depth.

The Output Side: FERPA Follows the Worksheet After It Leaves Diffit

A leveled worksheet does not shed FERPA relevance the moment it exports; it simply moves under the district's own record-handling rules. If a generated handout gets annotated with a student's name, filed in a shared drive, or attached to a grade, it can become an education record the school maintains, entirely downstream of the tool that drafted it.

That is worth stating because a zero-collection design can create a false sense that the FERPA question ends at export. It does not.

• A blank leveled passage is not an education record. The same passage marked up with a named student's scores can become one.
• Storage and sharing choices belong to the district. A worksheet in an unsecured shared folder is a district-side exposure, not a vendor-side one.
• Retention of those downstream files should follow the same schedule the district applies to any other student work.

Verify, Don't Assume: A District's FERPA Check for Diffit

A vendor's self-description, however specific, is not verification, and FERPA supplies no certificate to stand in for one. The practical response is a short due-diligence pass that turns Diffit's stated design into something a district has actually confirmed.

A one-sentence takeaway: the account-model row does most of the work, since a tool with no student accounts starts from a far smaller FERPA footprint, but the other rows still deserve an answer, especially the teacher data Diffit does hold. The companion pieces Is Diffit COPPA Compliant? and Is Diffit Safe for Students? work through the same verify-do-not-trust posture from the consent and content-safety angles.

The Free-Account Gap: Individual Signups and the District's FERPA Chain

A single teacher signing up for the free tier with a personal email is not automatically covered by any district agreement, and that gap is a FERPA-governance issue even for a tool that collects no student data. The concern is not that Diffit mishandles anything; it is that an individually adopted tool can sit entirely outside the district's reviewed, contracted toolset.

Districts have access to an average of nearly 3,000 distinct edtech tools in a given school year, according to Instructure's LearnPlatform usage data (Instructure, 2025), far more than any privacy office can vet one by one. A free-tier tool a teacher adopts independently is exactly the kind of quiet adoption that never passes through that review.

For a teacher-only tool, the stakes of that gap are lower than for a student-facing platform, since there is no student account layer left uncovered. Two things still matter, though:

• The teacher-content question does not disappear. An individually adopted account is the most likely place a teacher pastes in student-identifying material with no district policy in view to discourage it.
• Scaling past one classroom should move to the district tier. The quote-based school or district plan is where a signed agreement, and the school-official exception it supports, actually gets put in writing.

Related Reading

• AI, FERPA & COPPA: The Complete School Data-Privacy Guide (2026)
• Diffit and Student Data Privacy: What Teachers Should Know
• Is Diffit COPPA Compliant?
• Is Diffit Safe for Students?
• Is Newsela FERPA Compliant?
• Is GPTZero FERPA Compliant?