Is Gradescope COPPA Compliant?
Gradescope, owned by Turnitin, does not claim a COPPA certificate because none exists for vendors to earn. Its actual posture is that it relies on the institutions that license it, high schools, colleges, and universities, to obtain any parental consent COPPA requires for students under 13, a pathway that rarely gets triggered in practice because Gradescope's typical grading workload sits in upper-level high school and college courses.
Quick Answer: Gradescope is not "COPPA certified." Per its own privacy policy, Gradescope relies on the licensing institution to secure any necessary parental consent for students under 13, consistent with the FTC's school-as-agent guidance. Because Gradescope's actual user base skews toward AP-level high school courses and higher education, in subjects like math, chemistry, computer science, physics, and economics, the under-13 question rarely arises. FERPA coverage runs through Turnitin's institutional contracts, which designate the vendor a "school official." The AI-assisted answer-grouping feature is gated to paid Institutional licenses and does not change that data-privacy picture on its own.
If a district is weighing Gradescope for a middle school or an early-high-school pilot, the COPPA question deserves a direct answer rather than an assumption either way. This guide walks through what Gradescope actually says about under-13 users, who really uses the platform, how the free individual tier differs from an Institutional license, and what a department chair or privacy officer should confirm before rollout.
Does COPPA Even Apply to a Typical Gradescope Deployment?
COPPA applies to any operator that collects personal information from children under 13, or knows it is doing so, regardless of the product's primary audience. The practical question for Gradescope is not whether the law could theoretically apply, it always could, but whether Gradescope's actual deployment pattern puts many under-13 students in front of it at all.
Gradescope reports serving more than 2,600 schools worldwide, spanning high schools through research universities like Duke, Princeton, UC Berkeley, and Amherst. The subjects that lean on it most heavily, math, chemistry, computer science, physics, and economics, are disproportionately upper-level high school and college courses rather than elementary or standard middle school classes.
That pattern matters for a simple reason: a tool used mostly for AP Calculus, college physics, and university problem sets is mostly touching students who are already 14 and older. It is not automatically COPPA-exempt for every deployment, an accelerated seventh-grade algebra cohort or a dual-enrollment program could still bring 11- and 12-year-olds into scope, but it explains why COPPA rarely becomes the dominant compliance concern for a typical Gradescope rollout compared with FERPA.
When the under-13 question does apply
- Accelerated or gifted-track middle school courses that use Gradescope for advanced math or science assessments.
- Dual-enrollment or early-college programs where a younger student is technically enrolled in a college course using Gradescope.
- K-8 schools piloting Gradescope early for standardized-test-style assessment practice, ahead of the grade levels where it is typically adopted.
In any of those cases, the standard COPPA school-consent pathway, not a Gradescope-specific mechanism, is what a district would rely on.
What Gradescope's Own Privacy Policy Actually Says
Gradescope's privacy policy states that it relies on its education institution customers to obtain any necessary consent for collecting data from children under 13, consistent with FTC guidance allowing schools to act as a parent's agent for a strictly educational purpose. That is a contractual reliance model, not an independent COPPA certification.
A few specific commitments, drawn from Gradescope's published privacy policy and Turnitin's affiliated-companies privacy documentation, are worth knowing directly:
- No behavioral advertising. Gradescope states it does not allow third-party advertising based on user activity.
- Confidential handling of student data. Turnitin, Gradescope's parent company, treats submitted student work and grading data as confidential and states it does not share it with third parties beyond what its terms describe.
- Deletion on request. Gradescope states it will delete student records upon request from the institution.
- De-identified data for product improvement. Gradescope may use de-identified, aggregated data to operate, analyze, and improve the service, a narrower use than raw identifiable student data.
| Commitment | What it covers | What it does not cover |
|---|---|---|
| No third-party ad targeting | Prevents Gradescope from selling attention or profiles to advertisers | Does not by itself satisfy every state's stricter student-data statute |
| Confidential handling by Turnitin | Restricts redisclosure of student work outside contracted use | Does not replace a signed, institution-specific DPA |
| Deletion on institutional request | Gives a school a mechanism to remove records | Requires the institution to actually initiate the request |
| De-identified data for improvement | Limits some internal uses to non-identifiable data | "De-identified" and "anonymized" are not always equivalent in practice; ask for specifics |
FERPA Coverage Runs Through Turnitin's Institutional Contract
Gradescope states it fully complies with FERPA, and as with any edtech vendor, that claim is only as strong as the underlying contract a school or university has actually signed. Turnitin, as Gradescope's parent, positions itself as a FERPA "school official" with a legitimate educational interest for customers subject to the law, the same designation the FERPA and COPPA guide explains is required under 34 CFR § 99.31(a)(1) before a vendor can touch education records without individual parental consent for every disclosure.
Under that arrangement, Turnitin states it remains under the "direct control" of the institution with respect to how it uses and maintains FERPA-protected records, one of the four conditions the school-official exception actually requires. That framing puts the compliance burden partly back on the institution: a department that never reviewed the actual Data Processing Agreement (DPA) is relying on a marketing claim, not an enforceable contract, no matter how confident the privacy policy sounds.
Individual Free Tier vs. Institutional License: Why It Matters for Privacy
Gradescope offers a genuinely free Basic plan for individual instructors, but the AI-assisted grading features that raise the most nuanced data questions are gated entirely to paid Institutional licenses. Understanding which tier a teacher is actually using changes what data question is even relevant.
| Tier | Who can use it | AI answer grouping | Typical cost |
|---|---|---|---|
| Basic (individual instructor) | Any instructor, self-signup, no institutional contract required | Not available | Free |
| Basic for Teams | First 5 instructors at a participating institution | Not available | Free, with additional terms free for others |
| Institutional license | Full department or campus deployment | Available on fixed-template PDF assignments, MCQ, math fill-in, and text fill-in questions | Roughly $3 per student per year, custom-quoted |
That gating has a direct privacy implication. The free, individual-instructor tier does not include the AI answer-grouping feature at all, so questions about how AI touches student submissions only become relevant once a department has moved to a paid Institutional license, which is also the tier where a signed DPA is realistically available in the first place. A teacher using the free Basic plan without an institutional contract is, practically speaking, operating outside any FERPA "school official" agreement Turnitin has with that specific school, an important distinction for any teacher assuming their individual signup carries the same institutional protections a campus-wide license would.
How the AI Answer-Grouping Feature Handles Student Data
Gradescope's AI-assisted grading groups similar student answers together on specific question types so an instructor can grade in batches rather than one submission at a time, a feature scoped narrowly enough that it does not, on its own, expand what personal information Gradescope collects.
A few boundaries worth knowing before assuming "AI-assisted" means something broader than it is:
- It only works on fixed-template PDF assignments, plus multiple-choice, math fill-in-the-blank, and text fill-in-the-blank question types, not open-ended online assignment fields.
- It groups by content pattern, not by identity. The feature clusters similar answers so an instructor can apply one grade to the group; it is not profiling individual students across assignments.
- It is an Institutional-license feature, meaning it is only available where a school has already gone through the contract process that (in theory) also produced a signed DPA.
None of that changes the underlying COPPA analysis. A feature that groups answer patterns for grading efficiency is not itself collecting new categories of personal information from a child; the COPPA question still comes back to whether the student using the assignment is under 13, and whether the institution has the appropriate consent basis in place for that specific student.
What the FTC's 2025 COPPA Amendments Change for a Tool Like Gradescope
The FTC's first COPPA Rule amendments since 2013 took effect June 23, 2025, with most substantive provisions requiring compliance by April 22, 2026, and they tighten exactly the kind of vendor practices a Gradescope-style contract needs to address. Even where Gradescope's typical user base makes direct under-13 collection uncommon, the amendments still shape what a strong DPA should contain for the deployments where it does apply.
- Separate consent for third-party sharing. A single bundled consent no longer covers both collection and disclosure to third parties; any subprocessor Gradescope or Turnitin uses for a COPPA-covered student now needs its own standalone consent basis.
- Written data-retention limits. Vendors must publish a specific retention policy rather than an open-ended "as long as necessary" statement, which is a fair question to put directly to Turnitin's account team rather than assuming the existing privacy policy already satisfies it.
- Stricter subprocessor security vetting. Operators must document how they verified that any third party receiving children's data can maintain adequate security, with written assurances required.
A department negotiating or renewing an Institutional license after 2026 should confirm the current DPA reflects these updated requirements, not a version drafted before the amendments took effect.
How Gradescope's Privacy Posture Compares to Other Classroom AI Tools
Gradescope's approach, contract-based FERPA coverage plus institution-managed COPPA consent, is a common pattern among vendors that serve secondary and higher education rather than early-elementary classrooms, but it is not the only model in a typical teacher's toolkit.
- A text-leveling tool like Diffit serves a younger, broader grade range and correspondingly documents its under-13 handling differently than a grading platform built around AP-level coursework.
- A widely used quiz-game platform like Kahoot faces the under-13 question far more often than Gradescope does, simply because its typical classroom use skews younger.
- Even within the same general-purpose AI category, Microsoft Copilot's age-gating approach for K-12 students looks nothing like Gradescope's institution-consent model, illustrating that "AI tool used in schools" is not a single privacy category with one standard answer.
- For a broader sense of how two AI tutoring products in the same space document consent and data handling differently, SchoolAI vs Khanmigo is a useful side-by-side reference.
The takeaway for a privacy officer reviewing a whole edtech stack: never assume one vendor's compliance model transfers to the next tool on the list, even when both are broadly "AI-powered" and both serve the same school.
A Practical Scenario: An Eighth-Grade Algebra Teacher Considering Gradescope
Say you teach an accelerated Grade 8 algebra class and your department is piloting Gradescope for scanning and grading unit tests. Before rolling it out to your specific roster, a few questions are worth answering in order.
- Confirm actual student ages, not just the course level. An "accelerated" eighth-grade class can include students who are 12 or already 13, and the answer to the COPPA question depends on the individual student, not the course's difficulty label.
- Check which tier your school is actually using. If your department signed up for the free individual Basic plan rather than an Institutional license, there is likely no signed DPA behind it, meaning the FERPA "school official" protections your district assumes may not actually be in place.
- Route the decision through your privacy officer if any student is confirmed under 13. The standard COPPA school-consent pathway applies the same way it would for any other vendor, but it needs to actually happen, not be assumed because "Gradescope is FERPA compliant" appears on a marketing page.
This is also a good moment to compare notes with how a similar plagiarism-and-integrity tool in the same family handles student data: the companion piece on Turnitin and student data privacy covers the parent company's broader posture, which is directly relevant since Gradescope inherits much of its contractual framework from Turnitin.
It also helps to separate the two decisions a department is actually making. One decision is pedagogical: does scanning and AI-assisted grading genuinely save time on an accelerated algebra unit test compared with manual grading? The other is a compliance decision entirely independent of the first: given the confirmed ages on this specific roster, does the school have the right consent basis in place? Treating these as one combined judgment call is where privacy reviews tend to get skipped, because a tool that is clearly a good pedagogical fit gets fast-tracked past the compliance step that should have applied regardless of how good the classroom case for it is.
Expert Advice: What a Privacy Officer Should Actually Request
- Ask for the tier-specific DPA, not a generic privacy policy link. A department using the free Basic plan and a department using an Institutional license are, from a contract-law standpoint, in very different positions.
- Confirm whether any enrolled student is under 13 before assuming COPPA is irrelevant. Don't rely on the course's typical age range as a substitute for checking the actual roster.
- Ask specifically what "de-identified" means in Gradescope's context. Vendors use that word inconsistently; get a written definition rather than assuming it matches your district's own standard.
- Cross-check against your state's student-data statute. California's SOPIPA (2014) and Illinois's SOPPA (2021) both impose requirements beyond COPPA and FERPA, and a Gradescope contract that satisfies federal law is not automatically sufficient in either state.
What to Avoid
- Don't assume "FERPA compliant" on a pricing page means a DPA is already signed for your school. Confirm the actual contract status with your registrar's or general counsel's office.
- Don't confuse the free individual tier with an institutional deployment. They carry different contractual protections, and an instructor who self-signed up for Basic may be operating without institutional-level FERPA coverage.
- Don't treat AI-assisted answer grouping as a new privacy risk category on its own. It changes grading workflow, not the underlying personal-information collection, so the actual privacy review should focus on account creation and submission data, not the grading feature specifically.
- Don't skip the under-13 check just because Gradescope is typically used with older students. Accelerated courses and dual-enrollment programs are exactly the scenarios where that assumption breaks down.
Tools for Building the Assessments Gradescope Grades
Gradescope is a grading and assessment-scanning platform, not a content generator, so teachers still need a way to build the quizzes, worksheets, and unit tests that eventually get uploaded and scanned. For that earlier step in the workflow, a teacher could use EduGenius to generate a differentiated Grade 8 algebra quiz aligned to a specific class profile, export it as a PDF formatted for scanning, and then run it through Gradescope for grading, keeping the content-creation step entirely on the teacher's side without adding another student-facing account to manage.
Key Takeaways
- Gradescope has no COPPA certification because none exists for vendors; it relies on the licensing institution to obtain consent for any student under 13, per its own privacy policy.
- Gradescope's actual user base, AP-level high school through university, in math, chemistry, computer science, physics, and economics, means the under-13 question rarely triggers, though accelerated middle school and dual-enrollment programs are real exceptions.
- FERPA coverage runs through Turnitin's institutional contract, which designates the vendor a "school official" under 34 CFR § 99.31(a)(1); the strength of that protection depends on the actual signed DPA, not the privacy policy's wording.
- The free individual Basic tier and a paid Institutional license carry meaningfully different privacy protections, since a signed DPA is realistically only in place at the institutional level.
- AI-assisted answer grouping, gated to Institutional licenses at roughly $3 per student per year, groups answer patterns for grading efficiency and does not expand the categories of personal data Gradescope collects.
- A department should confirm actual student ages on any accelerated or dual-enrollment roster rather than assuming COPPA is irrelevant because Gradescope typically serves older students.
- State laws like California's SOPIPA and Illinois's SOPPA can require more than a FERPA- and COPPA-satisfying contract alone provides.
Frequently Asked Questions
Is Gradescope COPPA compliant?
Gradescope has no government COPPA certification, since none exists for software vendors. Its privacy policy states it relies on the licensing institution to obtain any required parental consent for students under 13, consistent with FTC guidance permitting schools to consent on a family's behalf for educational use.
Does Gradescope typically collect data from children under 13?
Rarely, in most deployments. Gradescope's heaviest use is in AP-level high school and college courses in math, chemistry, computer science, physics, and economics, which mostly serve students 14 and older, though accelerated middle school and dual-enrollment programs can bring younger students into scope.
Is the free Gradescope Basic plan covered by the same FERPA protections as an Institutional license?
Not necessarily. An instructor who self-signs up for the free Basic plan without an institutional contract is likely operating outside any signed Data Processing Agreement between Turnitin and that school, meaning the formal FERPA "school official" protections a campus-wide license provides may not apply to that specific account.
Does Gradescope's AI-assisted grading feature raise separate privacy concerns?
Not materially beyond the platform's existing data practices. The feature groups similar student answers on specific question types to speed up grading; it does not collect new categories of personal information and is only available on paid Institutional licenses, which are also the tier most likely to have a signed DPA in place.
What should a school do before using Gradescope with a class that includes students under 13?
Confirm the actual ages on the roster, verify whether the school has a signed DPA with Turnitin (not just a self-signed individual account), and apply the standard COPPA school-consent process the same way it would for any other vendor collecting data from a child under 13.