Is Khanmigo FERPA Compliant?
No AI vendor, Khan Academy included, can be "FERPA certified," because FERPA (20 U.S.C. § 1232g) regulates schools and districts directly, not the companies that sell them software. What Khan Academy actually has is more specific than most vendors in this category offer: a Data Protection Agreement that names Khan Academy a "school official" under a district's direct control, the exact legal mechanism FERPA's own regulations describe.
Quick Answer: Khanmigo is not, and cannot be, "FERPA compliant" in the way a pricing page implies, because FERPA has no vendor-certification program for any company to earn. Khan Academy's Data Protection Agreements assert FERPA compliance and explicitly designate Khan Academy a school official acting under a district's control and direction, tracking FERPA's regulations at 34 CFR § 99.31(a)(1) almost word for word. That is more specific language than most AI-tool privacy pages offer, but it is still a contract a district has to sign and apply correctly, not a government seal Khan Academy holds automatically.
That distinction, specific contractual language versus a general marketing claim, is worth sitting with before anything else. It is easy to read the phrase "school official" and assume the legal work is already finished. It isn't, not until a specific district's own agreement is signed and actually names Khanmigo. This guide walks through what FERPA requires, how Khan Academy's own paperwork lines up against that requirement, a legal wrinkle unique to how Khan Academy sells Khanmigo directly to families, and a practical checklist for a district evaluating it. For the full legal background connecting FERPA and COPPA, start with AI, FERPA & COPPA: The Complete School Data-Privacy Guide (2026); for day-to-day account setup and classroom habits, see Khanmigo and Student Data Privacy: What Teachers Should Know.
What FERPA Actually Requires From Any Vendor, Khan Academy Included
FERPA restricts when a school may disclose personally identifiable information from a student's education record to an outside party, and the law binds the school holding that record, not the company processing it on the school's behalf. A vendor like Khan Academy participates only through the "school official" exception at 34 CFR § 99.31(a)(1), which lets a school share records with a vendor without collecting individual parental consent, but only when specific conditions are met simultaneously.
The Four-Part Test, and Where Khan Academy's Paperwork Actually Lands
FERPA's regulations set four conditions a school and a vendor have to satisfy together, not just one side alone. Reading Khan Academy's own Data Protection Agreement language against each condition shows a more specific claim than most vendors in this space are willing to put in writing.
| FERPA's requirement | What it demands | What Khan Academy's DPA states |
|---|---|---|
| Institutional service | The vendor performs a function the school would otherwise do itself | Tutoring and instructional support, explicitly framed as a school function |
| Direct control | The school, not the vendor, controls how the data is used and kept | The DPA states Khan Academy operates under the district's "control and direction" |
| Authorized purpose only | Data is used only for what the school approved | Data use is scoped to the educational purpose named in the agreement |
| No redisclosure | The vendor cannot share the data onward without permission | Confidentiality and non-redisclosure terms are written into the signed DPA |
Khan Academy's Data Protection Agreements, the templates it files with individual districts and with the Student Data Privacy Consortium, state directly that Khan Academy operates as a "school official" under the district's control and direction with respect to personally identifiable information from education records (Student Data Privacy Consortium, Khan Academy Data Privacy Agreement, 2024). In several district-level versions, that DPA explicitly controls over Khan Academy's general Terms of Service whenever the two conflict.
That detail carries real weight. It means the specific, district-negotiated contract, not the public website's general terms, governs a classroom's data whenever the two disagree. A district's own signed copy, not the marketing page, is the document actually worth a close read.
Does Khan Academy's Nonprofit Status Change the FERPA Analysis?
No. FERPA's four-part school-official test applies identically to a nonprofit and a for-profit vendor; tax status has no bearing on the legal test itself. What the nonprofit structure changes sits adjacent to FERPA rather than inside it: the incentive structure behind how a vendor might handle an ambiguous corner of its own contract.
A vendor funded through advertising or resale of user behavior has a standing business reason to interpret "authorized educational purpose" as loosely as a contract allows. Khan Academy states its funding comes primarily from philanthropy and grants rather than advertising against student data, according to its own public statements about its funding model. That is a real, relevant data point for a district weighing risk, and a genuinely different starting position than a venture-funded consumer app chasing engagement metrics.
It is not, on its own, proof that a specific DPA is signed, current, or actually being followed inside a specific building. A mission-driven structure is a reason for cautious optimism. It is not a substitute for reading the contract.
Three Different Doors Into Khanmigo, Three Different FERPA Postures
Khanmigo reaches a classroom through three structurally different paths, and FERPA's applicability shifts depending on which door a specific student actually walked through. Conflating the three is the single easiest way to misjudge a school's actual exposure.
| Access path | Who is the "educational agency" in the data relationship | Does FERPA apply the way this guide describes? |
|---|---|---|
| District-wide rollout under a signed DPA | The district, acting through Khan Academy as its designated school official | Yes, squarely; this is the exact scenario the school-official exception was written for |
| A single verified teacher's free account (2024 Microsoft partnership) | The school, if IT has actually reviewed and authorized it; sometimes nobody, in an informal pilot | Ambiguous; FERPA applies in principle, but only where a real, current DPA covers that specific building |
| A family's directly purchased Khanmigo plan (roughly $4/month or $44/year) | No school at all | Generally no; FERPA protects records maintained by an educational agency, and none sits inside this relationship |
The Parent-Purchased Plan Is a Genuine Wrinkle, Not a Loophole
That third row deserves its own explanation, because it is easy to misread as a compliance gap rather than what it actually is: a different legal category entirely. FERPA defines an "education record" as a record maintained by an educational agency or institution. When a parent buys Khan Academy's family plan directly, no school ever enters that data relationship, so there is no educational agency maintaining anything, and FERPA's core trigger simply is not present in the first place.
That does not mean the data goes unprotected. A different framework governs it instead: Khan Academy's own consumer privacy policy, and COPPA's verifiable-parental-consent requirement where the child is under 13, covered in full in Is Khanmigo COPPA Compliant?. It is worth a teacher knowing this distinction directly. A student mentioning "I use Khanmigo at home too" is describing a relationship your school's DPA has no bearing on at all.
Does a Parent Have the Right to Inspect a Child's Khanmigo History Under FERPA?
Yes, when the account exists through a school-authorized rollout, a chat transcript tied to an identifiable student is an education record, and FERPA's inspection right applies to it the same way it applies to a report card. That is a more specific, more legally grounded claim than "a connected adult can see the chat," the framing most safety-focused guides use. This is the actual statutory right sitting behind that visibility.
FERPA gives a parent, or an eligible student 18 or older, the right to inspect and review education records a school maintains, which extends to records a school official like Khan Academy maintains on the school's behalf. A parent formally requesting to see their child's Khanmigo history is not asking for a favor. They are exercising a specific right under federal law, and a district's process for handling that request should exist before the first parent actually asks for it.
A Grade 7 Scenario, Walked Through
Say you teach Grade 7 social studies and a parent emails asking to see everything their child has typed into Khanmigo during a research-skills unit. A FERPA-literate response looks different from a purely practical one.
- Route the request to whoever handles FERPA record requests at your school, typically a registrar or main office, rather than personally compiling a transcript yourself.
- Confirm the account was created under the district's DPA, not a personal, unverified signup, since that affects which document actually governs the request.
- Expect a defined response window, not an instant export. FERPA allows a school a reasonable period, generally interpreted as up to 45 days, to comply with an inspection request.
- Treat the request as routine, not adversarial. A parent asking to see education records is exercising an ordinary right, the same one that applies to a disciplinary file or a report card.
The Subprocessor Question: Does the DPA Reach Microsoft's Azure OpenAI Service?
A signed DPA is only as strong as whether its confidentiality and no-redisclosure terms extend through Khan Academy's own vendors, and Khanmigo's free-teacher tier runs through Microsoft's Azure OpenAI Service specifically, not a model Khan Academy hosts itself. This is FERPA's fourth prong in practice: a vendor barred from redisclosing data still needs that same bar to reach whatever infrastructure it actually relies on downstream.
Microsoft's own published Azure OpenAI documentation states that customer prompts and completions are not used to improve Microsoft's or a third party's models without explicit permission. That is a real, checkable commitment from the infrastructure layer itself, separate from anything Khan Academy says about its own product on top of it. A district's signed DPA is still the document that needs to actually name this arrangement, rather than a technology office simply assuming it from a help-center article somewhere.
Three questions worth routing to whoever manages your district's Khan Academy contract:
- Does the signed DPA reference the underlying model infrastructure explicitly, or only Khan Academy's product layer in general terms?
- Is the no-redisclosure obligation identical across the free teacher tier and any future paid district tier, or does it vary by product line?
- What happens to a flagged or moderated conversation once it leaves Khan Academy's own systems, if at all, and is that documented anywhere beyond a general privacy page?
A FERPA-Focused Checklist Before Rostering a Full Class Into Khanmigo
Work through these in order before treating Khanmigo as cleared for a full class, not just a single pilot group.
- Confirm a DPA is actually signed for your specific building, not just that your district's name appears somewhere on Khan Academy's general customer list.
- Confirm the DPA names Khanmigo specifically, not only Khan Academy's broader practice platform, since the AI-tutoring layer is a meaningfully different product than the exercise sets many districts adopted years earlier.
- Ask whether a free-teacher-tier account is covered by the same DPA as a formal rollout, or whether it needs its own signature before scaling past a single classroom.
- Confirm your state's own student-data-privacy statute is satisfied too. New York's Education Law § 2-d, for instance, layers its own data-privacy-agreement and parents'-bill-of-rights requirements on top of FERPA's federal floor, separate from anything this guide covers at the national level.
- Establish who handles a parent's FERPA inspection request before the first one arrives, not while a parent is already waiting on an answer.
The same four-part test applies to every AI vendor a district considers, not only Khan Academy. Diffit and Student Data Privacy: What Teachers Should Know walks through the equivalent picture for a differentiation-focused tool many of the same classrooms already use, while Is Canva for Education FERPA Compliant? and Is Brisk Teaching FERPA Compliant? apply the same DPA-first evaluation to two very different products a district might be weighing at the same time.
Reading the Specificity Ladder Behind Any Vendor's FERPA Claim
Not every "FERPA compliant" claim carries the same weight, and it helps to see the actual range laid out rather than treating the phrase as a single yes-or-no label. Khan Academy's language sits closer to the strong end of that range than most competitors in this corpus, though nothing on the list is a government audit.
| Claim specificity | What it actually says | Does Khan Academy have it? |
|---|---|---|
| General self-description | "We value student privacy," with no legal mechanism named | Present, but the weakest layer on its own |
| General FERPA compliance claim | "We are FERPA compliant," with no specific regulatory hook | Present across public materials |
| DPA naming the school-official designation explicitly | A signed contract citing the district's "control and direction," tracking 34 CFR § 99.31(a)(1) | Yes, in Khan Academy's Data Protection Agreement templates |
| Independent government audit of that designation | A federal body verifying the designation is being honored in practice | Does not exist for any vendor; FERPA has no such mechanism at all |
That last row is the one worth remembering longest. Even a vendor doing everything right on paper cannot point to a government inspector who checked. The signed DPA, not a badge, is where the actual protection lives.
Where a Non-Chat Workflow Sidesteps the Record-Keeping Question Entirely
For the parts of a unit where a teacher wants review material without generating a new, individually attributed chat transcript at all, it helps to know a structurally different option exists. EduGenius can generate a quiz, worksheet, or review packet directly from a class profile set to a grade level and subject, with no student typing into a live AI conversation and no per-student chat record created in the first place. That does not replace the interactive tutoring Khanmigo is built for, but for an assignment where a stored, individually identifiable conversation is not actually the point, it removes this article's entire record-keeping question by design rather than by paperwork. EduGenius takes the same DPA-first, no-certification-claimed posture toward its own FERPA standing, detailed in Is EduGenius FERPA Compliant?
Pro Tips for a FERPA-Focused Khanmigo Review
- Ask for the DPA's actual redisclosure and subprocessor language, not a verbal assurance that "Microsoft is covered too."
- Separate the free-teacher-tier question from the district-DPA question explicitly. A single enthusiastic teacher's account and a signed institutional agreement are not automatically the same document.
- Keep a simple internal log of any parent inspection requests, useful both for your own reference and for showing a working process if your district is ever audited.
- Revisit the DPA annually. Khan Academy's Microsoft partnership and Khanmigo's own feature set have both changed materially since launch, and a review done once at initial signing can drift out of date within a year.
- If your school is separately comparing Khanmigo against a broader AI classroom assistant, SchoolAI vs Khanmigo: Which Is Better for Teachers? breaks down the feature differences directly, though this article's DPA checklist is worth applying to whichever tool your school lands on.
What to Avoid
- Treating "Khan Academy is a nonprofit" as a substitute for reading the actual DPA. It is a real, relevant fact about incentives, not a legal finding about compliance.
- Assuming a free verified-teacher account is automatically covered by a district-wide agreement. Confirm it directly with your technology office rather than assuming the two are identical.
- Ignoring the parent-purchased family plan when a student mentions using it at home. It sits entirely outside your school's DPA, governed by a different legal framework altogether.
- Letting a parent's inspection request sit with no clear owner. FERPA gives that request real legal weight, and a school with no defined process risks a slow, inconsistent response.
Key Takeaways
- FERPA (20 U.S.C. § 1232g) has no vendor-certification program. Khan Academy's real compliance posture rests on a signed Data Protection Agreement, not a marketing claim.
- Khan Academy's DPA language explicitly designates it a "school official" under a district's control and direction, closely tracking FERPA's regulatory language at 34 CFR § 99.31(a)(1).
- Nonprofit status doesn't change FERPA's legal test, though it does remove one common incentive to interpret a signed contract loosely.
- Three different access paths into Khanmigo carry three different FERPA postures: a district DPA, a single teacher's free account, and a family's direct purchase, and only the first two involve a school at all.
- A family-purchased Khanmigo plan generally sits outside FERPA entirely, since no educational agency ever maintains that record.
- A chat transcript tied to an identifiable student, created under a school's DPA, is an education record, and a parent has a real FERPA right to inspect it, not just a safety-feature courtesy.
- The DPA's protection is only as strong as whether it explicitly reaches Microsoft's Azure OpenAI Service, the infrastructure actually processing Khanmigo's free-tier conversations.
- State laws like New York's Education Law § 2-d can add requirements beyond FERPA's federal floor, worth confirming separately from the checklist above.
Frequently Asked Questions
Is Khanmigo FERPA compliant?
Khanmigo cannot be "FERPA compliant" the way a certification badge would imply, since FERPA regulates schools rather than certifying vendors. Khan Academy's Data Protection Agreements designate it a school official under a district's control, the specific mechanism FERPA's regulations describe, but that protection only applies once a district has actually signed one covering Khanmigo.
Does Khan Academy's nonprofit status make it more FERPA compliant than a for-profit AI tool?
Not legally. FERPA's four-part school-official test applies the same way regardless of tax status. A nonprofit funding model does remove one common incentive to monetize student data loosely, a real but separate consideration from whether a specific DPA is signed and current for your building.
Can a parent request to see everything their child typed into Khanmigo?
Yes, when the account exists under a school-authorized rollout. A chat transcript tied to an identifiable student is an education record, and FERPA's inspection right applies to it, generally with a response expected within a reasonable period, commonly interpreted as up to 45 days.
Does FERPA apply if a parent buys Khanmigo directly for their child at home?
Generally no. FERPA protects records maintained by an educational agency or institution, and a directly purchased family plan never involves a school in the data relationship. COPPA's parental-consent framework, not FERPA, is the more relevant law for that specific scenario.
Is a single teacher's free Khanmigo account covered by the same FERPA protections as a district rollout?
Only if a signed Data Protection Agreement actually exists for that building and covers Khanmigo specifically. A single enthusiastic teacher's free account, used without confirming this, may be operating outside any FERPA-relevant contract at all, even though the tool works identically either way from the classroom.
Does Khan Academy's Data Protection Agreement cover Microsoft's Azure OpenAI Service too?
That depends on the specific agreement's actual language, which is exactly why it is worth confirming rather than assuming. Microsoft's own Azure OpenAI documentation states customer prompts are not used to train models without explicit permission, but a district's DPA is the document that needs to actually extend its confidentiality terms to that infrastructure layer.
Related Reading
- AI, FERPA & COPPA: The Complete School Data-Privacy Guide (2026)
- Khanmigo and Student Data Privacy: What Teachers Should Know
- Diffit and Student Data Privacy: What Teachers Should Know
- Is Canva for Education FERPA Compliant?
- Is Brisk Teaching FERPA Compliant?
- Is EduGenius FERPA Compliant?
- SchoolAI vs Khanmigo: Which Is Better for Teachers?