Is Kahoot FERPA Compliant?

Kahoot is not, and cannot be, "FERPA certified," because the Family Educational Rights and Privacy Act issues no certificate to any software company. What Kahoot actually offers is a Data Processing Agreement plus a written commitment to act as a "school official" under a district's direct control, and that combination can support a district's own FERPA compliance. Under the law, the district stays the legally responsible party.

That single distinction, between a certificate a vendor holds and a contract a district signs, is the whole answer to this question. FERPA (20 U.S.C. § 1232g) regulates schools, not the tools they buy, so no version of "Kahoot is FERPA compliant" is ever a standalone fact about Kahoot.

Quick Answer: No FERPA certification exists for any vendor, so the honest answer is conditional. Kahoot can support a district's FERPA compliance: it offers a Data Processing Agreement (via dpa@kahoot.com), states it operates as a "school official" under the school's direct control, and holds the 1EdTech Data Privacy Certification earned in December 2024 as a real third-party privacy signal. None of that is a government FERPA seal, and the district, not Kahoot, remains accountable for the education records involved.

This guide stays narrowly on FERPA. For day-to-day data handling, see Kahoot and Student Data Privacy: What Teachers Should Know, and for the parallel legal question under a different law, see Is Kahoot COPPA Compliant?. Here the focus is the school-official exception, when a live quiz game actually touches an education record, and what a signed agreement does that a certification cannot.

What FERPA Actually Asks of a Tool Like Kahoot

FERPA never asks a tool to be "compliant" by itself; it asks the school to keep control of student education records when an outside vendor touches them. The law binds the district, and Kahoot enters the picture only through the contract a district signs and the exception that contract satisfies.

Adoption is running ahead of the paperwork, which is why this specific question keeps landing in procurement meetings. RAND's 2025 survey of US teachers and principals found that 70% of principals cited data privacy concerns as a major or minor factor in their technology purchasing decisions (RAND, 2025). A live-quiz platform sits squarely inside that scrutiny even though it rarely markets itself as a data product.

The School-Official Exception That Makes a Classroom Tool Legal

A school may share personally identifiable information from an education record with a vendor, without individual parental consent, only through FERPA's "school official" exception at 34 CFR § 99.31(a)(1). That exception is the legal doorway every classroom edtech tool walks through, Kahoot included.

The exception holds only when four conditions are all met:

1. The vendor performs a service the school would otherwise handle itself.
2. The school keeps "direct control" over how the vendor uses and maintains the data.
3. The vendor uses the data only for the authorized purpose, not its own separate goals.
4. The vendor is barred from redisclosing the data without permission.

A click-through terms-of-service box does not reliably put those four conditions in writing. A signed Data Processing Agreement (DPA) does, which is exactly why the contract, not the marketing page, carries the legal weight.

Why the District Stays the Responsible Party

FERPA's obligations attach to the school district, and they do not transfer to Kahoot no matter what a pricing page says. Enforcement runs through the US Department of Education's Student Privacy Policy Office, not against the vendor.

The Supreme Court settled the enforcement shape in Gonzaga University v. Doe, 536 U.S. 273 (2002), holding that FERPA creates no private right of action a parent can sue over directly. The statutory penalty is loss of federal funding, a sanction the Department has never actually imposed. That structure means a district cannot outsource its FERPA accountability to a vendor; it can only choose a vendor whose contract makes meeting its own obligations possible.

When a Live Quiz Game Actually Touches an Education Record

Whether Kahoot handles a FERPA education record at all depends on one setup choice: anonymous PIN join versus rostered student accounts. An education record, under FERPA, is information directly related to an identifiable student and maintained by the school or a party acting for it. Fully anonymous play usually falls outside that definition; rostered, saved results usually fall inside it.

Anonymous PIN Join Usually Creates No Education Record

When a student joins a live game with only a game PIN and a nickname, Kahoot's own materials describe the data collected as limited to that nickname, not tied to a persistent identifier. No name, email, or account is required. Because nothing links the nickname to an identifiable student in a maintained record, a one-off anonymous review game generally does not create the kind of education record FERPA governs.

That makes anonymous join the lowest-exposure mode for a routine review session, and it is the mode most classroom games actually run in.

Rostered Accounts and Saved Reports Change the Answer

The moment a school issues rostered student accounts, typically through single sign-on, Kahoot begins handling names, school affiliation, and individually identifiable scores that persist across sessions. Those saved game reports are education records, and FERPA's rules apply to them fully.

• A rostered account ties each game result to a named, identifiable student over time.
• A saved results report with individual scores is a maintained record the school is responsible for.
• Report deletion in Kahoot is a manual, permission-gated action, so records accumulate until someone with the right access clears them.

How Kahoot Supports a District's FERPA Compliance

Kahoot supports FERPA the only way any vendor legally can: by offering a contract that satisfies the school-official exception and by committing, in that contract, to operate under the district's control. The support is real, but it is contractual, not certified.

The Data Processing Agreement Is the Actual Mechanism

Kahoot offers a Data Processing Agreement as part of its education plans, reachable through a dedicated request channel at dpa@kahoot.com or a district's account manager, according to Kahoot's Trust Center (Kahoot, 2026). That signed DPA, not the public privacy page, is what makes the four-part school-official test enforceable for a specific district.

A district evaluating Kahoot should treat the DPA request as a required step rather than a formality. A public Trust Center page reads reassuringly, but it is not a contract a district can enforce if a dispute ever arises.

Kahoot's Stated "School Official" Commitment

Kahoot's published privacy materials state that where FERPA applies, Kahoot acts as a "school official" that is under the direct control of the school or district and uses student data only to provide its services under that agreement (Kahoot, 2026). That language maps directly onto the second and third conditions of the § 99.31(a)(1) exception.

Kahoot also states it does not collect, retain, use, or share students' personal information except as necessary for the authorized purpose, at the direction of the school. Read carefully, those are commitments a district can hold Kahoot to once they sit inside a signed agreement, which is the point of getting the DPA rather than relying on the statement alone.

The AI Quiz-Creation Feature Adds a Subprocessor Question to FERPA

Kahoot's paid tiers include AI tools that generate questions from a document a teacher uploads, and that introduces the one FERPA wrinkle a live game does not: a subprocessor sitting behind the feature, and the chance of feeding it an education record by accident. Generative features run on model infrastructure, so a district's "direct control" has to extend through that chain rather than stop at Kahoot's own layer.

Two separate FERPA concerns live here, and it helps to name them individually:

• The redisclosure risk. If a teacher uploads a document containing identifiable student information, a gradebook export or notes naming a student, that education record is now being processed by an AI feature, which is exactly the redisclosure FERPA's fourth school-official condition restricts.
• The subprocessor gap. A "we don't train on your data" statement is a promise about future model updates, not a claim that nothing is processed. For a FERPA-sensitive rollout, that commitment needs to sit in the signed DPA and reach any model provider behind the feature, not just live on a public help page.

The redisclosure risk is the more immediate of the two, because it is triggered by a single careless upload rather than a policy gap. A teacher pasting a class roster into a quiz-generation box has moved an education record into a processing path the district never reviewed.

The practical discipline is the one the pillar guide, AI, FERPA & COPPA: The Complete School Data-Privacy Guide (2026), applies to every AI vendor: name the model provider, get the no-training and no-redisclosure commitments in writing, and strip identifying student information out of any source document first. Treat an AI-generation upload the way you would treat an attachment leaving the district entirely.

What Kahoot's 1EdTech Certification Means for FERPA, and What It Doesn't

The 1EdTech Data Privacy Certification is a genuine, independent third-party review of Kahoot's privacy practices, and it is a useful FERPA-relevant signal, but it is not a FERPA certification, because none exists. Kahoot earned the certification in December 2024, and its practices were vetted against the 1EdTech Data Privacy Rubric covering data collection, security, third-party sharing, and advertising (Kahoot, 2024).

Understanding what that mark does and does not prove is the difference between reading a vendor page accurately and misreading it. A certification against a rubric signals that an outside body reviewed Kahoot's stated practices; it does not sign your district's DPA or transfer FERPA accountability anywhere.

The bottom row matters for a district that has read the companion analysis in Is Kahoot COPPA Compliant?: Kahoot does not hold an FTC-approved COPPA Safe Harbor certification, and even if it did, Safe Harbor is a COPPA mechanism with no FERPA equivalent to earn. FERPA simply has no vendor certificate to hold.

That same reading applies across the quiz and grading tools a district lines up side by side. A platform like Quizizz, now rebranded Wayground, leans on third-party privacy badges without a confirmed FTC Safe Harbor, a posture examined in Is Quizizz FERPA Compliant?, and an assessment tool raises its own separate education-record questions, as Is Gradescope FERPA Compliant? walks through. The through-line never changes: the signed agreement, not the badge, is what carries FERPA weight.

For the quiz content itself, a teacher can keep the authoring step outside the education-record question entirely. EduGenius can generate quiz questions from a class profile configured by grade level and subject, with export to PDF, DOCX, or PowerPoint, so the base content is built without a student account and without producing a record tied to a named child, which a teacher could then run through a live Kahoot game for the engagement layer.

A FERPA Verification Checklist Before Approving Kahoot

Turn the legal question into a short sequence of documented steps rather than a single yes-or-no verdict. Say you coordinate technology for a middle school and a Grade 5 math team wants weekly review games; the work below is what actually protects the district.

1. Request the signed DPA from dpa@kahoot.com rather than relying on the Trust Center page alone.
2. Confirm the agreement names the specific product tier the district will actually use, including any AI content-creation add-on.
3. Decide anonymous join versus rostered accounts by default, since anonymous play keeps most review games out of education-record territory.
4. Document a retention and deletion schedule for saved reports, since Kahoot's deletion is manual rather than automatic.
5. Check your state statute on top of FERPA, such as California's SOPIPA or Illinois's SOPPA, which can require more than the federal floor.
6. Route the contract through legal or a data-privacy officer, not procurement alone, before a single-class pilot becomes district-wide.

Related Reading

• AI, FERPA & COPPA: The Complete School Data-Privacy Guide (2026)
• Kahoot and Student Data Privacy: What Teachers Should Know
• Is Kahoot COPPA Compliant?
• Is Quizizz FERPA Compliant?
• Is Gradescope FERPA Compliant?
• SchoolAI vs Khanmigo: Which Is Better for Teachers?