Is EduGenius COPPA Compliant?
EduGenius is built around a simple idea for reducing COPPA exposure: don't collect what you don't need. The Assign feature that puts generated content in front of students requires no student login, no account, and no email address. Answer keys and grading criteria are removed before a page ever reaches a student's browser. And the kind of feature that would call for a district's signed agreement, a persistent, reusable Student Roster with rich per-student data, lives behind the institution and enterprise tiers rather than sitting on every account by default.
Quick Answer: EduGenius has not yet completed a formal COPPA Safe Harbor review, the one real, third-party certification mechanism that exists for this law (the FTC-approved programs are iKeepSafe, PRIVO, kidSAFE, CARU, and ESRB). Alongside that, it has a specific architecture built to minimize COPPA exposure from the start: no student accounts for the core workflow, server-side removal of answer keys before a student ever sees a page, and enterprise-only gating for any feature that stores standing student data. Ask EduGenius, or any vendor, the same verification questions this guide recommends, and judge the answer directly.
This is EduGenius's own blog assessing EduGenius's own product, so the standard here is the same one this guide applies to every vendor it covers, not a lighter one.
Why This Matters for Districts Right Now
AI tool adoption in classrooms is moving faster than most districts' review processes can keep up with. RAND's 2025 survey of U.S. teachers and principals found that 70% of principals cited data privacy concerns as a major or minor factor shaping their AI purchasing decisions (RAND, 2025). Instructure's LearnPlatform usage data separately puts the average district's active edtech tool count at nearly 3,000 in a given year (Instructure, 2025), far more than any privacy office can individually vet in depth.
That's the backdrop for this article: a straight answer to a question a privacy officer, curriculum director, or careful teacher is likely to ask before rolling EduGenius out to a class.
What COPPA Actually Requires
COPPA (16 CFR Part 312) regulates any operator of an online service directed at children under 13, or one with actual knowledge it is collecting personal information from a child under 13, and requires verifiable parental consent before that collection happens. AI, FERPA & COPPA: The Complete School Data-Privacy Guide (2026) covers the full legal mechanics, including the FTC's six approved consent methods and the school-as-agent pathway that lets a district consent on behalf of families.
One fact worth stating plainly here, since it applies to every vendor this series covers: neither FERPA nor COPPA issues a government certification a company simply earns. FERPA makes the school the legally responsible party for student records; there is no vendor badge for it. COPPA is narrower and more concrete: the one real, checkable mechanism is a voluntary, FTC-approved Safe Harbor review under 16 CFR § 312.11, run by an independent organization such as iKeepSafe, PRIVO, kidSAFE, CARU, or ESRB. EduGenius has not completed one of those reviews yet, and that's worth saying directly rather than around.
How the Actual-Knowledge Trigger Applies to a Teacher-Facing Tool
A tool built around a teacher configuring a class profile and generating content, rather than a student logging in to chat with a model, sits differently against COPPA's actual-knowledge trigger than a student-facing chat product does. The teacher, not a child, is the account holder generating quizzes, worksheets, and flashcards. That's a real structural difference, and it's also not the whole analysis, since COPPA's reach extends to any point where a child's personal information actually gets collected, not just to who holds the account. Two flows matter here: a teacher entering class configuration data (grade level, subject, ability range) is not a child submitting personal information about themselves; a student opening a public assignment link is a different question entirely, covered next.
A Teacher-Facing Workflow, With a Deliberately Narrow Student-Facing Surface
The core content-generation workflow in EduGenius runs entirely through the teacher's account, and the Assign feature requires no student login or account creation at all. A student reaches an assignment through a link or QR code, not a signup form.
Say you teach a Grade 6 science class and want to assign a worksheet you generated on the water cycle. You can share it as a public link or a QR code students scan on their own device, with no student account, email address, or password required at any point in that flow.
The answer key and grading criteria bundled with a teacher's generated content never reach the student's browser at all, so there's no version of the page a student could inspect to find them.
| What a teacher sees when building an assignment | What a student sees on the public link |
|---|---|
| The full generated content, including questions | The same questions, formatted for student view |
| The complete answer key with explanations | Not present in the data sent to the browser |
| Grading criteria and rubric details | Not present in the data sent to the browser |
| Any roster names attached to the assignment | Not exposed on the public link itself |
The Optional Roster, and Why the Bigger Version Is Gated
A teacher can optionally attach a roster of student names to a single assignment on the free tier, scoped to that one assignment rather than stored as a persistent, cross-class database. It's optional; a teacher can run an assignment with no roster at all.
A separate, more capable feature exists on institution and enterprise plans: a persistent, reusable Student Roster and rich per-student personalization inside Class Profiles, the kind of feature that would let a teacher tailor content to individual students across a whole year. That's deliberately gated behind the paid tiers. A standing, cross-class database of real student names carries meaningfully more compliance weight than a single-assignment list, and it deserves the kind of signed Data Processing Agreement and institutional oversight that an individual teacher's free-tier account isn't positioned to provide on its own.
| Feature | Availability | Why it's scoped this way |
|---|---|---|
| Assign feature (student view, no login) | All plans | No student PII is required to use it at all |
| Optional roster for one assignment | Free tier and above | Limited, single-assignment scope keeps the exposure narrow |
| Persistent, reusable Student Roster | Institution and enterprise plans | Standing student PII needs institutional agreements and oversight |
| Class Profiles with rich per-student data | Institution and enterprise plans | Same reasoning: real, persistent student data warrants a signed agreement first |
Common Procurement Questions, Answered Directly
A district's RFP or vendor-review form usually asks a predictable set of compliance questions. Here are direct answers, in the same blunt format a privacy officer would want.
| Question a district's review typically asks | EduGenius's direct answer |
|---|---|
| Do you hold FERPA certification? | No such certification exists for any vendor to hold |
| Are you a COPPA Safe Harbor participant (iKeepSafe, PRIVO, kidSAFE, CARU, or ESRB)? | Not yet |
| Do you have a current SOC 2 report? | Not yet available |
| Will you sign our district's Data Processing Agreement? | Available on request; route it through your legal or privacy team for review |
| Do students need individual accounts to use the product? | No, for the Assign feature and the core content-generation workflow |
| Where does persistent, identifiable student data get stored, if anywhere? | Only through the Student Roster and Class Profiles features, on institution and enterprise plans |
| Is community-pool sharing of materials public by default? | No; sharing defaults to private and requires an explicit opt-in to share more broadly |
A district that gets a vague or evasive answer to any row in that table, from EduGenius or any other vendor, should treat that as a signal worth escalating.
A Practical Verification Checklist
Apply the same checklist this guide recommends for any AI vendor. A FERPA Compliance Checklist for AI Tools in Schools and FERPA-Compliant AI Tools for Teachers: A 2026 Checklist walk through the general version of this process; here is how it maps to EduGenius specifically.
- Request a written Data Processing Agreement before deploying EduGenius with identifiable student data at any scale, rather than relying on the public terms of service.
- Confirm which tier your school is on, since Student Roster and Class Profiles carry meaningfully more student PII than the free-tier, single-assignment roster.
- Ask which underlying AI model powers content generation, and whether any no-training commitment extends to that provider, the same subprocessor question worth asking any AI vendor.
- Confirm data-retention and deletion practices in writing, matching the specificity the FTC's 2025 COPPA amendments require of any vendor (FTC, 2025).
- Route the decision through your student-data-privacy officer or legal counsel, not procurement alone.
Comparing a Certification to an Architecture
A completed Safe Harbor review and this article's description of EduGenius's design measure two different things, and it's worth being clear about which is which. A certification is an independent, third-party audit against a fixed standard. What's described above is EduGenius's own account of specific, checkable technical choices: no student accounts required for the Assign workflow, server-side removal of answer keys, enterprise-only gating for standing student data. Both are useful signals, and neither substitutes for the other.
A district doing real diligence on any AI tool should ask for both: request whatever documentation a certified vendor can provide, and independently verify the architecture claims any vendor, EduGenius included, makes about itself, rather than accepting either on its own as the full picture. SchoolAI vs Khanmigo: Which Is Better for Teachers? is a useful model for that kind of side-by-side evaluation, applied to two other platforms.
What to Avoid
- Treating this article's description of EduGenius's architecture as a substitute for a signed DPA. It's a starting point for diligence, not the diligence itself.
- Assuming the free-tier roster and the institution-tier Student Roster carry the same data-privacy stakes. They don't; the gating exists specifically because they don't.
- Skipping the question of which AI model powers content generation, the same subprocessor question worth asking of any vendor.
- Rolling out the persistent Class Profiles feature district-wide without routing it through legal or a privacy officer first, given that it's specifically the tier holding richer, more persistent student data.
Key Takeaways
- The Assign feature requires no student login or account creation, and a public assignment link strips answer keys and grading criteria server-side before a student's browser receives the page.
- The optional student roster on the free tier is scoped to a single assignment, not a persistent, cross-class database of student names.
- Student Roster and Class Profiles, the features holding richer per-student data, are gated to institution and enterprise plans, a design choice reflecting the added compliance overhead real student PII requires.
- Community-pool sharing defaults to private and requires an explicit opt-in before anything is shared more broadly.
- EduGenius has not yet completed a COPPA Safe Harbor review. A district should ask for the same documentation, and apply the same verification checklist, it would use for any AI vendor.
Frequently Asked Questions
Is EduGenius certified as COPPA compliant?
EduGenius has not completed a review with an FTC-approved COPPA Safe Harbor program, such as iKeepSafe, PRIVO, kidSAFE, CARU, or ESRB. No government-issued COPPA certification exists for any vendor to hold in the first place; the Safe Harbor review is the closest real, checkable equivalent.
Do students need to create an account to use EduGenius?
No. The Assign feature lets a teacher share generated content with students through a public link or QR code, with no student login, email address, or account creation required. The teacher's account is the only account involved in generating and sharing the content.
Does EduGenius store a persistent database of student information?
Only on institution and enterprise plans, through the Student Roster and Class Profiles features. A free-tier roster, when used, is scoped to a single assignment rather than stored long-term.
What should a district ask EduGenius before adopting it district-wide?
Request a written Data Processing Agreement, ask which AI model powers content generation and whether any no-training commitment covers that provider, and confirm the data-retention and deletion policy in writing. Route the decision through legal or a student-data-privacy officer rather than procurement alone.
Related Reading
- AI, FERPA & COPPA: The Complete School Data-Privacy Guide (2026)
- A FERPA Compliance Checklist for AI Tools in Schools
- FERPA-Compliant AI Tools for Teachers: A 2026 Checklist
- Diffit and Student Data Privacy: What Teachers Should Know
- Microsoft Copilot and Student Data Privacy: What Teachers Should Know
- Is Khanmigo Safe for Students?
- Is Perplexity Safe for Students?
- SchoolAI vs Khanmigo: Which Is Better for Teachers?