Is MagicSchool AI FERPA Compliant?
MagicSchool AI can support your district's FERPA obligations, but it cannot be "FERPA compliant" on its own. FERPA (20 U.S.C. § 1232g) makes the school or district the legally responsible party for student education records, and it issues no certification any software company can earn. MagicSchool states it acts as a "school official" under a signed agreement, which is the mechanism that actually does the work.
Quick Answer: There is no such thing as a "FERPA certified" vendor. FERPA binds your school, not MagicSchool AI. What MagicSchool offers is a data privacy agreement your district can sign so the tool operates under FERPA's "school official" exception. MagicSchool states it processes student data only on the district's documented instructions and does not train its models on personally identifiable student information. Your protection comes from that signed agreement plus your own configuration, not from a badge.
So the honest answer to the question in the title is "it depends on your contract, not on MagicSchool's marketing." That is not evasive. It is how the law is built. This guide shows exactly where MagicSchool AI fits into FERPA's actual machinery, what the "school official" exception requires, why the iKeepSafe badge you may have seen is not the thing people assume it is, and what a teacher or technology director should confirm before typing a real student name into any prompt.
FERPA Certifies Schools, Not Software
FERPA is a 1974 federal law that gives parents and eligible students rights over "education records" and restricts how a school discloses them. It regulates the school district, full stop. A vendor never becomes "FERPA compliant" the way a product passes a safety inspection, because the law was written to hold the institution accountable, not the software it happens to use.
That framing changes how you read any vendor page. When MagicSchool AI, or any tool, describes itself as FERPA compliant, it is making one of three very different claims:
| What a FERPA claim can mean | What it actually is | How much it protects your district |
|---|---|---|
| A government "FERPA certification" | Does not exist; the U.S. Department of Education issues no such seal | Nothing, because there is nothing to hold |
| A signed data privacy agreement (DPA) | A binding contract placing the vendor under your control as a "school official" | This is the real mechanism, enforceable and specific to you |
| A third-party privacy assessment (e.g., iKeepSafe) | A private organization's review against its own criteria | A useful signal, but not a government seal and not a transfer of legal responsibility |
Read down that table and the pattern is clear. Only the middle row is a legal instrument you can enforce. The first row is a myth, and the third is evidence, not a substitute for your own paperwork.
The U.S. Department of Education's Student Privacy Policy Office (studentprivacy.ed.gov) administers FERPA and has never framed any vendor as certified. FERPA also carries no private right of action, a point the Supreme Court settled in Gonzaga University v. Doe (2002), so its real teeth are the district-facing threat of losing federal funding, not a lawsuit against MagicSchool.
How the "School Official" Exception Applies to MagicSchool AI
The "school official" exception, found at 34 CFR § 99.31(a)(1), is the only reason a district can share education records with an outside tool like MagicSchool AI without collecting individual parental consent. It is a four-part test, and every part has to hold true in a signed contract, not just on a webpage.
Applied to MagicSchool AI specifically, here is what each condition asks and what to confirm:
| FERPA "school official" condition | What it requires | What to confirm with MagicSchool |
|---|---|---|
| Legitimate educational service | The vendor performs a task the school would otherwise do itself | That the tools you enable are instructional, not repurposed for the vendor's own goals |
| Direct district control | The school stays in control of how data is used and kept | That processing happens only on your documented instructions |
| Purpose limitation | Data is used only for the authorized purpose | That student input is not used to train models or for advertising |
| No redisclosure | The vendor cannot pass data on without permission | That subprocessors, including the underlying model provider, are bound by the same terms |
MagicSchool AI's own materials line up with this test on paper. According to MagicSchool AI (2026), the company acts as a data processor that handles personal data solely on the documented instructions of the educational institution, states that personally identifiable student information is never used to train its AI models, and says its subprocessors are contractually required to delete data after processing rather than retain it.
Why MagicSchool's teacher-first design lowers the FERPA surface
A large share of MagicSchool AI's more than 80 tools are teacher-facing, meaning a teacher types a prompt and gets a lesson plan, rubric, or worksheet back without any student logging in. That design choice matters for FERPA, because a tool that never ingests identifiable student data has a much smaller "education record" footprint to govern in the first place.
The exposure concentrates in two places worth naming:
- Documentation tools such as IEP and 504 drafting, where a teacher may enter a real name paired with disability information, data covered by both FERPA and IDEA.
- MagicStudent, the separate student-facing product where children interact with an AI directly, which is a different risk profile from the core teacher suite.
A district that has only approved the teacher tools should treat enabling MagicStudent, or feeding real IEP data into a documentation generator, as a fresh review rather than an automatic extension of the original sign-off.
The COPPA question is separate
FERPA is not the only law in play, and it is easy to conflate the two. COPPA governs data collected online from children under 13 and binds the vendor directly, which is a different question with a different answer. MagicSchool's COPPA posture, including its iKeepSafe Product Profile and the school-consent pathway, is covered in depth in Is MagicSchool AI COPPA Compliant?. For the full side-by-side of how both laws interact, the complete school data-privacy guide walks through the framework this article applies to one vendor.
About That iKeepSafe Badge: A Private Assessment, Not a Government Seal
iKeepSafe is a real, FTC-approved COPPA Safe Harbor organization, and it also runs a separate, private FERPA assessment program. MagicSchool points to iKeepSafe involvement as evidence of its privacy practices, which is a genuine signal worth having. It is not, however, the government FERPA certification many educators assume it is.
Two clarifications keep this in perspective:
- FERPA has no statutory Safe Harbor. COPPA's rules explicitly authorize FTC-approved Safe Harbor programs at 16 CFR § 312.11. FERPA's text authorizes nothing equivalent, so any organization reviewing "FERPA compliance" is applying its own private criteria, not a government standard.
- A private assessment does not shift legal responsibility. Even a vendor with a spotless third-party review leaves the district as the party FERPA holds accountable. The badge is a reason to trust the vendor's diligence, not a reason to skip your own.
There is also a documentation nuance covered in the COPPA article: an iKeepSafe Product Profile and iKeepSafe's stricter certification are different artifacts, so a district should ask MagicSchool directly which one applies rather than assuming a listing equals a full certification. The practical upshot is the same either way. Ask to see the underlying documents, not the badge on the page.
The DPA Is the Document That Actually Governs
If only one sentence from this article sticks, make it this: the signed data privacy agreement, not the public privacy policy, is what legally binds MagicSchool AI to your district. A privacy policy can change with a quiet website edit. A DPA cannot be altered without both parties agreeing, which is exactly why it, and not marketing copy, is the enforceable instrument.
MagicSchool AI provides customizable data privacy agreements and is a member of the Student Data Privacy Consortium (SDPC), the national network that maintains pre-negotiated DPA templates such as the National Data Privacy Agreement (SDPC, 2026). That membership can save a district weeks, because you may be able to start from an existing SDPC addendum for MagicSchool rather than drafting one from scratch.
A DPA worth signing should spell out, in specific terms:
- Every subprocessor that touches student data, including which large language model provider handles requests.
- A retention and deletion timeline stated in days or months, not vague phrasing like "as long as necessary."
- A no-training commitment that explicitly extends through the model provider, not just MagicSchool's own layer.
- A breach-notification window your legal team can hold the vendor to.
- A directory-information clause confirming that any FERPA "directory information" designation stays the district's call, which MagicSchool states is how it operates.
If a vendor takes weeks to produce a DPA, or cannot say clearly whether student prompts reach a model that retains them, that hesitation is itself useful information about how mature the privacy program really is.
Directory Information and End-of-Contract Deletion: The FERPA Details Vendors Gloss Over
Two FERPA specifics get lost in most vendor conversations, and both matter more with an AI tool than with a filing cabinet: who decides what counts as "directory information," and what happens to student data when the relationship ends. MagicSchool AI addresses the first directly, and the second is a question every district should force into writing.
On directory information, FERPA lets a school designate certain fields (a name, a grade level, participation in activities) as "directory information" it may disclose without consent, but that designation is the school's decision, never a vendor's. MagicSchool AI states it does not independently treat student data as directory information, leaving any such designation to the school or educational agency under its own policies. That is the correct posture, and it belongs in the DPA explicitly, because an AI tool that quietly decided for itself what was "public" would undercut a choice FERPA reserves for the district.
End-of-contract data is the second blind spot. An AI vendor stores prompts, outputs, and account records, and FERPA's control requirement does not evaporate when a pilot ends. Force these into the contract:
- A deletion timeline stated in days once the agreement terminates, not "upon request."
- Coverage of subprocessor copies, including anything the underlying model provider cached while processing.
- Written confirmation that deletion actually happened, for the district's audit file.
- A mid-year path for when an individual student transfers out, not only full contract termination.
A trial agreement that expires quietly while classroom use continues past that date is one of the most common ways a district ends up running an AI tool with no active contractual protection at all. Put a renewal-and-deletion checkpoint on the calendar before the first pilot is even approved, and that gap never opens.
A Teacher's Walk-Through: Keeping a Real Class FERPA-Safe
Say you teach a self-contained Grade 4 class and want to use MagicSchool AI for weekly lesson planning and, separately, for drafting one student's annual IEP. Those are two different FERPA situations riding on the same login, and treating them the same way is where a well-meaning teacher can drift out of bounds.
Here is how to keep them separate in practice:
- Confirm your account is district-provisioned, not a personal signup. FERPA's "school official" protection depends on the district retaining control, which an individual free account does not provide.
- Use general descriptions for planning. A prompt like "a mixed-ability Grade 4 reading group" gets you the same lesson plan without turning that request into an education record tied to named students.
- Route the IEP task through your special-education coordinator first, and enter identifiable disability data only once you have confirmed the account is authorized for that specific use.
- Download, edit, and store the sensitive output in your district's approved system, rather than leaving it living inside a prompt history.
For the low-sensitivity half of that workflow, a teacher-side generator can remove the judgment call entirely. EduGenius, for example, can generate a differentiated Grade 4 worksheet, quiz, or set of revision notes from a class profile you configure once with grade, subject, and ability range, with no student login and no identifiable student data required to produce the material. When no real student information is needed for a task, the safest FERPA posture is a tool that never asked for it. For the day-to-day habits behind this kind of workflow, the practical companion MagicSchool AI and Student Data Privacy: What Teachers Should Know goes tool-by-tool.
Pro Tips for Evaluating MagicSchool's FERPA Posture
The difference between a real compliance posture and a reassuring webpage is usually four or five specific questions. Ask them in writing and keep the answers in your privacy file.
- Ask which iKeepSafe artifact MagicSchool actually holds, a Product Profile or a full certification, rather than treating "iKeepSafe" as a single yes.
- Request the DPA and the SOC 2 Type II report together. SOC 2 verifies security controls like encryption and access management; it says nothing about FERPA consent or data training, so you need both documents for different questions.
- Name the model provider and pin the no-training promise to it in writing. A commitment that stops at MagicSchool's own layer leaves a gap exactly where districts most need it closed.
- Check your state statute. California's SOPIPA (2014) and Illinois's SOPPA (2021) restrict vendor use of student data more tightly than FERPA alone, so a FERPA-satisfying contract can still fall short of a stricter state law.
- Set an annual re-verification date. Model providers and retention defaults shift, and a policy frozen at rollout drifts out of date within a year.
What to Avoid
Most FERPA problems with an AI tool are not malicious; they are the predictable result of moving faster than the paperwork. These four pitfalls account for a large share of them.
- Trusting the word "compliant" on a pricing page. It is a self-description until a signed DPA backs it, and RAND's 2025 survey found that 70% of principals already treat data privacy as a real factor in AI purchasing decisions (RAND, 2025), so your leadership will expect the document, not the adjective.
- Using a personal MagicSchool account for anything with identifiable student data. A personal signup sits outside the district-control requirement that makes the "school official" exception work.
- Assuming teacher-suite approval covers MagicStudent. The student-facing product puts a child in front of an AI directly and deserves its own review.
- Skipping family communication because the district technically consented. Common Sense Media's 2025 research found 83% of parents said their school had not communicated with them about generative AI at all (Common Sense Media, 2025), and a short, specific notice closes more of that trust gap than a long policy document.
Key Takeaways
- No vendor is "FERPA certified," including MagicSchool AI, because FERPA (20 U.S.C. § 1232g) binds the school district, not the software, and the Department of Education issues no such seal.
- The "school official" exception (34 CFR § 99.31(a)(1)) is the real mechanism, and it only works through a signed data privacy agreement that keeps the district in control of how student data is used and kept.
- MagicSchool AI states it processes data only on the district's documented instructions and does not train its models on personally identifiable student information, claims worth confirming inside the DPA rather than taking from a webpage.
- The iKeepSafe badge is a private assessment, not a government certification, and FERPA has no statutory Safe Harbor the way COPPA does, so it supports but never replaces your own agreement.
- MagicSchool's teacher-first design lowers FERPA exposure for most of its tools, with the real risk concentrated in IEP or documentation tools and in the separate MagicStudent product.
- The signed DPA, a named model provider, a written retention timeline, and a state-law check are the four things that turn "probably fine" into a defensible, documented decision.
Frequently Asked Questions
Is MagicSchool AI officially FERPA certified?
No. There is no official FERPA certification for any software vendor, because FERPA legally binds schools and districts rather than companies. MagicSchool AI states it aligns with FERPA and acts as a "school official," but the real evidence a district can rely on is a signed data privacy agreement, not a certificate or badge.
Does MagicSchool AI use student data to train its AI models?
MagicSchool AI states that personally identifiable student information is never used to train its AI models, and that its subprocessors, including the underlying language-model providers, are contractually required to delete data after processing (MagicSchool AI, 2026). A district should confirm this commitment appears in its own signed agreement rather than only in public materials.
What does the "school official" exception mean for MagicSchool AI?
The FERPA "school official" exception (34 CFR § 99.31(a)(1)) lets a district share education records with MagicSchool AI without individual parental consent, but only under a contract keeping the district in control, limiting use to the authorized purpose, and barring redisclosure. It is the legal pathway that makes district use of the tool workable.
Does the iKeepSafe badge mean MagicSchool AI is FERPA compliant?
Not by itself. iKeepSafe runs a private FERPA assessment, which is a genuine third-party signal but not a government certification, since FERPA authorizes no Safe Harbor program. The assessment supports MagicSchool's claims; it does not shift FERPA's legal responsibility, which stays with the district regardless of any badge.
Can teachers use MagicSchool AI without violating FERPA?
Yes, when the account is district-provisioned under a signed agreement and teachers avoid entering identifiable student data where a general description works just as well. For higher-sensitivity tasks like IEP drafting, confirm the account is specifically authorized first. Compare how directly student-facing assistants handle this differently in SchoolAI vs Khanmigo: Which Is Better for Teachers?.
Related Reading
- AI, FERPA & COPPA: The Complete School Data-Privacy Guide (2026)
- Is MagicSchool AI COPPA Compliant?
- MagicSchool AI and Student Data Privacy: What Teachers Should Know
- Is Quizlet FERPA Compliant?
- Diffit and Student Data Privacy: What Teachers Should Know
- SchoolAI vs Khanmigo: Which Is Better for Teachers?