Is Gradescope FERPA Compliant?
Gradescope, owned by Turnitin, cannot be "FERPA certified," because FERPA (20 U.S.C. § 1232g) makes the school or district the responsible party and issues no certificate to vendors. What Turnitin provides is a contract: it agrees to act as a FERPA "school official" for institutions that license the platform. That signed agreement, not a badge, is what supports a school's compliance, and the school stays legally responsible.
Quick Answer: No grading tool is FERPA certified, because FERPA binds the licensing institution rather than the software company. Turnitin, Gradescope's parent, contracts as a "school official" with a legitimate educational interest under FERPA's exception at 34 CFR § 99.31(a)(1), and states it remains under the institution's direct control over how it uses education records. Because Gradescope stores graded student work and scores, its data is squarely an education record, so the practical question is not whether FERPA applies (it plainly does) but whether your specific license actually sits under that contract. A free individual account often does not.
Gradescope is an unusual case among classroom AI tools, and in a helpful way. Most "Is this tool FERPA compliant?" questions start by arguing over whether FERPA even reaches the data involved. With Gradescope, that argument is settled before it begins: the platform holds scanned student work and grades, which is the textbook definition of an education record. This guide focuses on what that means in practice, where a license quietly falls outside the protective contract, and what a department should confirm before rollout.
Why Gradescope Is a Clearer FERPA Case Than Most Classroom Tools
Gradescope's entire function is to receive, mark, and store student work, so the data it holds is unambiguously a FERPA education record rather than an incidental byproduct. That clarity changes the shape of the question. You are not deciding whether FERPA applies; you are confirming that the contract satisfying it is actually in place for your account.
FERPA defines an education record as information directly related to an identifiable student and maintained by the school or a party acting for it. A scanned exam with a name on it, a rubric-scored response, and an exported gradebook all meet that definition without any interpretive stretch.
Turnitin reports that Gradescope serves more than 2,600 schools worldwide, spanning high schools through research universities (Gradescope, 2026). Across all of them, the same records logic holds: the moment a student's work enters the platform, an education record has been created and handed to a vendor.
What Counts as the Education Record Inside Gradescope
Three categories of stored data carry the FERPA weight, and it helps to name them plainly:
- The scanned or uploaded submission itself, which carries a student's name, handwriting, and answers as an identity-linked image.
- The scores and rubric feedback attached to that submission, which are grades in the most literal sense.
- The gradebook export, which bundles full names, student IDs, email addresses, and every score into one file.
Each of those is protected information. That is why the contract behind your Gradescope license matters more than any reassuring line on a marketing page.
How Turnitin's Institutional Contract Carries the FERPA Weight
A school's FERPA protection with Gradescope runs entirely through the agreement its institution signs with Turnitin, which positions the vendor as a "school official" with a legitimate educational interest under 34 CFR § 99.31(a)(1). Turnitin's own documentation states it remains under the direct control of the institution with respect to how it uses and maintains education records (Turnitin, 2026).
That designation is not decorative. The school-official exception is the specific mechanism that lets a school share records with an outside vendor without collecting individual parental consent for every disclosure, and it holds only when a signed contract enforces four conditions. The table below maps each condition to what Turnitin's contract is meant to address.
| School-official condition (34 CFR § 99.31(a)(1)) | What it requires | How Turnitin's contract addresses it |
|---|---|---|
| Institutional service | The vendor performs a task the school would otherwise do | Grading and assessment workflow the institution runs itself otherwise |
| Direct control | The school controls how data is used and maintained | Turnitin states it acts only on the institution's instruction |
| Purpose limitation | Data is used only for the authorized purpose | Student work used only to support the instructor's assessment |
| Redisclosure ban | The vendor cannot share data onward without permission | Confidential handling, no behavioral advertising on student activity |
The catch sits in the phrase "a school's institution signs." The protection is real only for the institution that actually executed the agreement. A department relying on Turnitin's published FERPA posture without confirming its own signed contract is trusting a description, not an enforceable instrument. The complete FERPA and COPPA guide for schools walks through why that four-part test only exists on paper when a contract puts it there.
The Free-Tier Gap: An Individual Account May Sit Outside Your District's Contract
Gradescope offers a genuinely free plan for individual instructors, and that is exactly where FERPA coverage quietly breaks down, because a self-signup account is not automatically bound by any agreement between Turnitin and the school. This is the single most overlooked point in the entire Gradescope FERPA question.
An instructor who signs up for the free Basic plan on their own has a working grading tool and, in many cases, no signed Data Processing Agreement standing behind it. The education records still flow into the platform. The contractual "school official" protection a district assumes is in place may simply not apply to that specific account.
| Tier | How it is obtained | Signed institutional agreement | FERPA footing |
|---|---|---|---|
| Basic (individual instructor) | Self-signup, no institutional contract | Typically none | Weakest; may sit outside any district DPA |
| Basic for Teams | First few instructors at an institution | Additional terms, still limited | Partial; confirm before relying on it |
| Institutional license | Full department or campus deployment | Yes, executed with Turnitin | Strongest; the "school official" contract applies |
The practical implication is direct. A teacher who assumes "our school uses Gradescope, so we are covered" can be wrong if their own login is a personal free account rather than a seat under the institutional license. Vendor sprawl makes this easy to miss: Instructure's LearnPlatform data shows districts have access to nearly 3,000 distinct edtech tools in a typical year, far more than any privacy office can individually track down to the account level (Instructure, 2025).
Does AI-Assisted Answer Grouping Change the FERPA Analysis?
Gradescope's AI-assisted grading clusters similar student answers so an instructor can grade in batches, and it does not, on its own, change the FERPA picture, because it processes work already inside the platform rather than collecting new categories of student data. The feature is also gated to paid Institutional licenses, at roughly $3 per student per year, which is the same tier where a signed agreement realistically exists (Gradescope, 2026).
Two boundaries keep this in perspective:
- It groups by answer pattern, not by student identity. The feature clusters similar responses on fixed-template and fill-in question types so one grade can apply to a group; it is not building a cross-assignment profile of a child.
- It operates on existing education records. No new personal information is gathered, so the FERPA analysis stays anchored to the submission and score data the platform already held.
Where AI grading does deserve a FERPA-adjacent question is the subprocessor chain. A district should confirm, in writing, that any third party involved in processing that student work stays under the same direct-control and confidentiality terms the institutional contract requires. The FTC's 2025 amendments to children's-privacy rules tightened subprocessor security expectations generally, and a strong agreement reflects that scrutiny even where a tool's user base skews older.
The FERPA Rights Families Hold Over Work Stored in Gradescope
Because scanned submissions and scores are education records, the families of students under 18, and eligible students 18 and older, hold specific FERPA rights over them, and the school, not Turnitin, must be able to honor those rights. This is the flip side of the "school is responsible" rule: the district owns the obligations, so it needs the vendor relationship to make meeting them possible.
FERPA grants three core rights, and each has a concrete counterpart inside the platform:
- The right to inspect and review. A parent can ask to see their child's education record, which includes the scanned exam and its scores held in the platform. The school must be able to produce it, so an instructor needs to know how to retrieve a specific student's submission.
- The right to request amendment. If a family believes a record is inaccurate, FERPA gives them a channel to request a correction. For a grade dispute, that process runs through the school, with the platform simply holding the underlying work.
- The right to control disclosure. The school generally needs consent before releasing a student's records to a third party, which is precisely why the "school official" contract exists to cover the vendor's access in the first place.
The practical upshot for an instructor is small but real: keep the ability to locate and export an individual student's submission on hand, since a FERPA inspection request is the school's obligation to fulfill promptly, and "the vendor stores it" does not discharge that duty.
Retention and Deletion: A Closed Course Is Not a Deleted Record
Student work generally remains inside a Gradescope course after a term ends, until someone deliberately deletes the course, so "the semester is over" is not a data-retention event on its own. For a records-holding tool, that persistence is a FERPA and state-law question, not just housekeeping.
FERPA does not set a universal retention clock, but it does make the school responsible for the education records a vendor holds on its behalf. Retention therefore has to be a decision someone actually made, rather than a default nobody reviewed. A few questions are worth putting to a department or IT office directly:
- Is there a defined retention timeline for past-course data, or does it default to indefinite storage until a manual deletion?
- Who is authorized to delete a completed course's records, the individual instructor or an administrator?
- Is there a documented process for a transferring or graduating student's removal request, consistent with the deletion-on-request commitment in the vendor's own privacy policy?
Several states add their own retention and deletion requirements on top of FERPA's federal floor, so a district in a state with a specific student-data statute should confirm its timeline satisfies that law too, not only the platform's default behavior.
A Grade 7 Scenario: Confirming You Are Actually Under the Contract
Say you teach Grade 7 math, and three teachers in your department have been scanning unit tests with free individual Gradescope accounts they each set up. The tool works well, so nobody questioned it. From a FERPA standpoint, this is the exact situation worth pausing on.
Work through it in order:
- Determine which tier each account actually is. A free Basic self-signup is very different, contractually, from a seat under a campus Institutional license.
- Ask the registrar or general counsel whether a signed Turnitin agreement exists for your school, and whether these specific accounts fall under it.
- Route any gap to your data-privacy officer before the next test cycle, rather than after a parent or an audit raises it.
- Separate the pedagogy from the paperwork. Whether scanning saves grading time is one decision; whether the education records are under a protective contract is an entirely independent one that applies regardless.
That fourth point is where reviews tend to slip. A tool that is obviously useful gets fast-tracked past the contract question precisely because the classroom case for it is so clear.
A FERPA Checklist Before Your Department Adopts Gradescope
Turning this into a defensible rollout means getting written answers before student work is ever uploaded. These steps sequence the analysis above.
- Confirm the license tier each instructor is using, and whether it falls under the institutional agreement.
- Obtain the signed Data Processing Agreement with Turnitin, and route it through legal or a data-privacy officer, not procurement alone.
- Ask what "de-identified" means in the vendor's context if aggregated data is used for product improvement, and get it in writing.
- Confirm the retention and deletion process, since course data generally persists until a course is explicitly deleted rather than expiring at term's end.
- Check your state statute, because California's SOPIPA (2014) and Illinois's SOPPA (2021) can require more than a FERPA-satisfying contract alone.
Expert Advice on What to Request
- Ask for the tier-specific agreement, not a generic privacy-policy link. A free-account department and a licensed department are in different contractual positions.
- Put the subprocessor question in writing. Confirm that any third party touching graded work stays under the same direct-control terms your institutional contract requires.
- Treat the under-13 question as a separate track. Gradescope skews toward AP-level and college courses, so it rarely arises, but an accelerated or dual-enrollment roster can bring it into scope; the companion guide on whether Gradescope is COPPA compliant covers that age-consent pathway in depth.
What to Avoid
- Do not read "FERPA compliant" on a pricing page as proof a contract is signed for your school. Confirm the actual agreement status with your registrar or counsel.
- Do not conflate a free individual account with an institutional deployment. The free tier may sit entirely outside the protective contract, even at a school that licenses Gradescope elsewhere.
- Do not treat AI-assisted answer grouping as a new privacy category. It reshuffles grading workflow, not the underlying education-record collection, so the review should focus on account provisioning and the contract, not the grouping feature.
- Do not assume the federal contract answers your state law. A FERPA-satisfying agreement can still fall short of a stricter state student-data statute.
Where Gradescope's FERPA Profile Differs From a Chat-Based AI Tool
Gradescope's FERPA exposure comes from a repository of stored records, which is a different shape than a chat-based tool's exposure, where the risk is largely whatever a user types into a prompt. Naming that contrast matters, because it changes what a review should actually scrutinize.
With a records-holding platform, the review centers on the signed contract, the license tier, retention, and access to stored work, since the education records exist whether or not anyone is careful about wording. With a conversational tool, more of the risk shifts to prompt hygiene and configuration, as the analysis in the Microsoft Copilot FERPA guide lays out. A district running both should not assume one review model transfers to the other, even when both tools are broadly "AI-powered" and sit in the same building's stack.
Keeping the Authoring Step Off the Records Surface
Gradescope grades what a teacher has already built; it does not create the quiz, the problem set, or the answer key that eventually gets scanned. That upstream step never has to touch a student-facing account or generate an education record at all, which is worth keeping in mind when mapping where student data actually enters the workflow.
Because content creation sits entirely on the teacher's side, a teacher could use EduGenius to generate a differentiated problem set and a matching answer key from a configured class profile, then export it to PDF for clean scanning before any student work exists to protect. Keeping authoring separate from grading means the only student data reaching Gradescope is the completed submission itself, not an additional account or record created upstream.
Key Takeaways
- No grading platform is "FERPA certified," because FERPA binds the licensing institution, not the vendor. Turnitin's contractual "school official" designation, not a badge, is what supports compliance.
- Gradescope is a clearer FERPA case than most AI tools, since scanned work, scores, and gradebook exports are unambiguously education records rather than incidental data.
- Turnitin contracts as a "school official" under 34 CFR § 99.31(a)(1) and states it stays under the institution's direct control, which is the exact four-part mechanism FERPA requires (Turnitin, 2026).
- The biggest real-world gap is the free individual tier, where a self-signup account may sit outside any signed agreement between Turnitin and the school.
- AI-assisted answer grouping does not expand FERPA exposure on its own, since it processes existing submissions; the fair question is subprocessor direct-control, put in writing.
- A department should confirm the license tier, obtain the signed agreement, and check state law before student work is uploaded, treating pedagogy and paperwork as separate decisions.
Frequently Asked Questions
Is Gradescope FERPA compliant?
Gradescope has no government FERPA certification, because none exists for software vendors. Its parent, Turnitin, contracts as a "school official" with a legitimate educational interest under 34 CFR § 99.31(a)(1) and states it stays under the institution's direct control. That signed agreement supports a school's compliance; the school remains responsible.
Is the free Gradescope account covered by the same FERPA protections as an institutional license?
Often not. An instructor who self-signs up for the free Basic plan may be operating outside any signed agreement between Turnitin and the school, which means the "school official" contractual protection a district assumes may not apply to that specific account, even if the school licenses Gradescope elsewhere.
Does Gradescope's AI-assisted grading create new FERPA concerns?
Not materially. The feature groups similar answers on specific question types to speed grading; it processes work already stored rather than collecting new personal information, and it is limited to paid Institutional licenses. The reasonable FERPA question is whether any subprocessor stays under the contract's direct-control and confidentiality terms.
What makes student work in Gradescope an "education record"?
It is directly related to an identifiable student and maintained by a party acting for the school, which is FERPA's definition. A scanned exam with a name on it, the rubric scores attached to it, and a gradebook export bundling names, IDs, and grades all qualify without any interpretive stretch, which is why FERPA plainly applies.
Can a parent ask to see their child's scanned exam in Gradescope?
Yes. Because the scanned submission and its scores are education records, FERPA gives a parent the right to inspect and review them, and the school must be able to produce them. The obligation sits with the school, so an instructor should know how to retrieve and export an individual student's work on request.