Is Edpuzzle FERPA Compliant?

No AI or edtech vendor can be "FERPA certified" by any government body, since FERPA (20 U.S.C. § 1232g) regulates schools and districts, not the companies selling them software, and issues no certificate for any company to earn. What makes Edpuzzle worth a closer look than most tools in this guide's series is that it holds an actual independent FERPA assessment from iKeepSafe, a genuinely uncommon credential, sitting alongside a signed institutional Data Protection Agreement that names Edpuzzle a school official.

Quick Answer: Edpuzzle cannot be "FERPA compliant" the way a badge on a pricing page implies, because FERPA has no certification program for any vendor. It does hold something most competitors in this category do not: an independent FERPA assessment from iKeepSafe, alongside its better-known COPPA Safe Harbor participation. That assessment is real and third-party reviewed, but it is still a private evaluation, not a government seal, since FERPA has no official certification mechanism for any organization, private or public, to administer. A district's own signed Data Protection Agreement, which names Edpuzzle a school official under FERPA's regulations, remains the actual enforceable protection.

That distinction, a genuine private assessment versus a government certification that simply does not exist, is worth understanding precisely, because Edpuzzle's marketing has more real substance behind it than most vendors this series covers, and it would be a mistake to either dismiss that difference or overstate what it means. This guide separates what FERPA requires, what iKeepSafe's FERPA assessment actually is and isn't, what Edpuzzle's own Data Protection Agreement says in writing, and a legal wrinkle specific to how the no-account Open Class feature affects whether a FERPA-covered record exists at all. For the complete legal picture connecting FERPA and COPPA, start with AI, FERPA & COPPA: The Complete School Data-Privacy Guide (2026); for the fuller data-collection picture, see Edpuzzle and Student Data Privacy: What Teachers Should Know.

What FERPA Actually Requires, and Why Edpuzzle's Claim Looks Different

FERPA restricts when a school may disclose personally identifiable information from a student's education record to an outside party, and the restriction binds the school holding the record, not the vendor processing it. Edpuzzle participates through the "school official" exception at 34 CFR § 99.31(a)(1), which lets a school share records with a vendor without collecting individual parental consent, provided the school keeps direct control, limits the vendor to an authorized purpose, and bars redisclosure.

Enforcement Looks Different Too, and That Shapes What Evidence Actually Exists

FERPA carries no private right of action, a point the Supreme Court settled in Gonzaga University v. Doe, 536 U.S. 273 (2002), and its only real penalty, loss of federal funding, has never actually been imposed on a school. That is worth naming here because it explains why FERPA-specific enforcement case law essentially does not exist the way it does under COPPA, where the FTC has brought direct actions against edtech vendors. A vendor's FERPA claim gets tested through a district's contract review, not through a courtroom, which is exactly why the specificity of what Edpuzzle actually puts in writing matters more than it would under a law with a more active enforcement docket.

That gap between "how FERPA is supposed to work" and "how it actually gets tested" is exactly why this guide spends more time on Edpuzzle's written agreements than on any hypothetical enforcement risk. A district's leverage over Edpuzzle's data practices lives almost entirely in contract language, not in the threat of a lawsuit or a fine, which makes reading that language closely a genuinely higher-value use of a privacy officer's time than it might be under a law the FTC actively polices.

iKeepSafe's FERPA Seal: A Real Differentiator, Still Not a Government Certification

Edpuzzle holds iKeepSafe's FERPA, COPPA, and CSPC (California Student Privacy) certifications, and the FERPA piece specifically is genuinely uncommon: iKeepSafe's own materials describe its FERPA badge as the first independent assessment program built specifically for the law. That phrase, independent assessment program, is precise and worth reading literally rather than as marketing language.

Why FERPA Has No Safe Harbor the Way COPPA Does

COPPA has an actual government-recognized mechanism for third-party review: the FTC-approved Safe Harbor program under 16 CFR § 312.11, which iKeepSafe operates as one of a small number of approved organizations. FERPA has no equivalent at all, not even a voluntary one, because FERPA legally binds the school rather than the vendor, leaving nothing for a vendor to formally get certified against in the government's own system. When iKeepSafe issues a FERPA badge, it is applying its own private review process, an independent privacy expert evaluating a company's privacy policy, data-security practices, and published Product Profile, then requiring annual re-evaluation to keep displaying it.

Read side by side, the table makes a point worth sitting with: Edpuzzle's COPPA credential and its FERPA credential sound similar on a marketing page but rest on different foundations. One plugs into an actual federal program. The other is the strongest private substitute available, precisely because no federal program for FERPA exists for it to plug into at all.

What Edpuzzle's Actual Data Protection Agreement Says

Edpuzzle's institutional Data Protection Agreement states directly that it is treated as a school official for FERPA purposes, and that the DPA's terms take precedence over Edpuzzle's general Service Agreement or Terms of Service whenever the two conflict. That supremacy clause is a meaningful detail, since it means the specific, district-negotiated document, not the public website's boilerplate, is what actually governs a classroom's data.

Under that structure, a district relying on FERPA's school-official exception is expected to specify, in its own annual notification of rights, the criteria it uses to determine who qualifies as a school official and what counts as a legitimate educational interest. Edpuzzle's DPA is written to satisfy that expectation from the vendor's side, keeping personally identifiable information strictly confidential and using it only for the purposes the agreement authorizes.

That written structure is a stronger foundation than a bare compliance sentence, but it still depends on two things happening at the school's end: the district actually signing an institutional DPA, and that DPA actually naming Edpuzzle correctly as part of the school's own FERPA notification framework.

Does Open Class Remove the FERPA Question the Same Way It Narrows COPPA's?

FERPA's protection attaches specifically to personally identifiable information inside an education record, and Edpuzzle's Open Class feature, which lets a student join and respond using a randomly generated nickname instead of a real name, can mean there is little or no personally identifiable information for FERPA to attach to in the first place. That is a related but distinct question from Open Class's COPPA effect, covered in Is Edpuzzle COPPA Compliant?, since FERPA's trigger is identifiability inside a record, while COPPA's trigger is collection of personal information from a child directly.

The practical test is the same instinct applied to a different statute: a nickname session with no name, no email, and no persistent login collects little that FERPA would recognize as personally identifiable, so there may be no education record in the FERPA sense at all. The moment a teacher ties a session to a real name for gradebook continuity, that record becomes personally identifiable again, and the ordinary school-official analysis applies exactly as it would for any other Edpuzzle assignment.

A Grade 2 Scenario, Walked Through

Say you teach Grade 2 and want to assign a short phonics video with two comprehension checkpoints, the kind of same-day formative check Open Class is built for.

• Default to Open Class with nicknames for this specific assignment, since a same-day check rarely needs semester-long, named continuity.
• Recognize that a genuinely anonymous session narrows the FERPA question, not just the COPPA one, because there is less identifiable information for either law to attach to.
• Switch to named accounts deliberately, not by habit, once you actually need to track an individual student's progress across a unit or report card period.
• Document which setting you used, briefly, so a parent question later has a clear, specific answer rather than a guess about which mode a given assignment ran under.

Individual Free Signup vs. Institutional Account: Which One Actually Carries FERPA's Protection?

Edpuzzle's free Basic tier and its roughly $15-a-month Pro Teacher plan apply the identical iKeepSafe certification and stated data practices, which answers a product-tier question but not a school-relationship question that matters just as much. A teacher who signs up individually, outside any district contract, is a meaningfully different FERPA scenario than a class rostered under an institutional agreement, regardless of which pricing tier that teacher is on.

A working login is not proof that FERPA's framework actually covers a specific classroom. A teacher who self-funds a Pro Teacher subscription with a personal card, however well-intentioned, has not thereby created a school-official relationship on the district's behalf. That relationship exists only once the school itself has authorized the specific tool for a specific purpose, ideally documented the same way an institutional DPA would document it.

This is not a hypothetical edge case. Individual, unmanaged signups are one of the most common ways a classroom AI tool ends up touching student data with no FERPA-relevant contract behind it at all, since the product itself gives no signal to a teacher that a personal account sits outside whatever agreement the district negotiated. A quick check with a building's technology coordinator, before rostering a full class rather than after, closes that gap in a few minutes.

A FERPA Checklist Before a District-Wide Edpuzzle Rollout

Work through these in order before treating Edpuzzle as cleared for every classroom, not just a single pilot.

1. Confirm an institutional DPA is actually signed for your school, rather than assuming a colleague's individual account reflects a broader agreement.
2. Ask whether the DPA's criteria for "school official" and "legitimate educational interest" are reflected in your district's own annual FERPA notification, since that pairing is part of what the exception assumes exists.
3. Default to Open Class with nicknames for lower-stakes, same-day assignments, narrowing both the FERPA and COPPA questions at once by reducing what identifiable data exists.
4. Check whether individual teachers in your building are using personal free or Pro accounts outside the institutional agreement, since those may not carry the same FERPA footing even though the product functions identically.
5. Confirm your state's own student-data-privacy statute is satisfied too. Illinois's Student Online Personal Protection Act (SOPPA) and California's SOPIPA both layer additional requirements on top of FERPA's federal floor, separate from anything a national DPA alone resolves.

The same underlying test applies to any classroom AI vendor a district is weighing, not only Edpuzzle. Diffit and Student Data Privacy: What Teachers Should Know walks through the equivalent picture for a differentiation-focused tool many of the same classrooms already use, while Is Brisk Teaching FERPA Compliant? and Is Khanmigo FERPA Compliant? apply the same DPA-first evaluation to two products built on very different architectures. If a district is also reviewing an academic-integrity tool in the same review cycle, Is Turnitin COPPA Compliant? is worth the same close read.

Where a Non-Video Companion Workflow Fits

For the comprehension questions and vocabulary practice that often pair with a video lesson, it helps to know there is a workflow that never touches a video-hosting or account question at all. EduGenius can generate the comprehension questions, an answer key, and a companion worksheet directly from a class profile set to a grade level and subject, which a teacher can then adapt into a video's timeline separately, keeping content creation and video delivery as two distinct steps. That does not change Edpuzzle's own FERPA posture, but it is a practical way to keep some of a unit's material entirely outside any student-facing tool's data footprint in the first place.

Related Reading

• AI, FERPA & COPPA: The Complete School Data-Privacy Guide (2026)
• Edpuzzle and Student Data Privacy: What Teachers Should Know
• Diffit and Student Data Privacy: What Teachers Should Know
• Is Brisk Teaching FERPA Compliant?
• Is Turnitin COPPA Compliant?
• Is Khanmigo FERPA Compliant?
• SchoolAI vs Khanmigo: Which Is Better for Teachers?