Is Nearpod FERPA Compliant?
No classroom tool is "FERPA certified," Nearpod included, because FERPA is a federal law that regulates your school district, not the software it licenses. What Nearpod actually provides is a signed Data Processing Agreement (DPA) and School Official status that let a district meet its own FERPA obligations under the school-official exception. Whether Nearpod use is FERPA-compliant at your school comes down to that contract and how you configure the tool, not a seal on a marketing page.
Quick Answer: Nearpod supports FERPA compliance rather than "being FERPA compliant" by itself. It offers districts a DPA that names Nearpod a School Official under FERPA's 34 CFR § 99.31(a)(1) exception, commits to no sale of student data, and encrypts data in transit. The compliance itself belongs to your district, which holds the contract, controls the roster, and decides how the tool gets used. Confirm a signed DPA is on file before rostering students.
That certification-versus-contract distinction is the single fact that unlocks this whole question, so it is worth pausing on. A teacher who reads "Nearpod is FERPA compliant" and stops there has missed the part that actually protects a class. This article stays specific to the FERPA question. The separate matter of whether Nearpod satisfies COPPA, including its pending independent certification, is covered in Is Nearpod COPPA Compliant?, and it deliberately isn't re-argued here.
FERPA Regulates Your District, Not the Nearpod Product
FERPA, the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g), gives parents and eligible students rights over "education records" and limits when a school may disclose them, and it binds schools that receive U.S. Department of Education funding, per the Department's Student Privacy Policy Office (studentprivacy.ed.gov). A vendor like Nearpod is a party a district may share records with, not an entity FERPA polices directly.
Read that structure carefully, because it explains why no "FERPA compliant" badge exists to earn. The law was written in 1974, long before a slide-based lesson platform existed as a purchasing category. It regulates the school's disclosure decision, so the only lever a vendor has is the contract it offers a district. When Nearpod's public materials say the product is "designed to allow responsible parties to comply with" FERPA, the responsible party named in that sentence is your district.
Data privacy anxiety is not abstract for the people signing these contracts. In RAND's 2025 survey of U.S. teachers and principals, 70% of principals cited data privacy as a major or minor factor shaping their AI and edtech purchasing decisions (RAND, 2025). The pillar guide, AI, FERPA & COPPA: The Complete School Data-Privacy Guide (2026), lays out the full federal mechanics behind every claim here.
When a Nearpod Session Actually Creates an Education Record
An education record is information directly related to an identifiable student and maintained by the school or a party acting for it. Inside a Nearpod lesson, that line depends entirely on how a student joined and what they submitted:
- A tied-to-identity response (a rostered student's quiz score, an open-response answer stored against their name) can be an education record.
- An anonymous, code-based submission with only a first name or nickname, not linked to a persistent account, generally is not.
- A drawing or audio clip from a rostered account is both an education record and a more identifiable data type than a multiple-choice answer.
The practical takeaway is that the FERPA surface is not fixed by Nearpod's policy. It is shaped, lesson by lesson, by choices a teacher makes.
The School-Official Exception and What Nearpod's DPA Must Lock In
The mechanism that lets a district use Nearpod without collecting written consent from every family is the "school official" exception at 34 CFR § 99.31(a)(1), and it only exists on paper when a signed contract puts four conditions in writing. A click-through terms-of-service page does not satisfy it; a DPA does.
Nearpod's published DPA language treats the company as a School Official acting under the direction and control of the Local Education Agency for the use of student data, which is exactly the posture the exception requires. Here is how the four-part test maps onto what a district should confirm the contract actually says.
| FERPA's four-part school-official test | What Nearpod's DPA needs to state | How a district verifies it |
|---|---|---|
| The vendor performs a service the school would otherwise do itself | Delivering and storing instructional activities is an institutional function | Confirm the DPA names Nearpod a School Official for the stated purpose |
| The school keeps "direct control" over the data | The LEA directs use, retention, and deletion of student data | Check for LEA-controlled deletion and retention clauses |
| The vendor uses data only for the authorized purpose | No sale, no advertising, no repurposing of student data | Nearpod's notice states no sale and no student-facing marketing |
| The vendor cannot redisclose without permission | Sub-processors are contractually bound to the same limits | Request the current sub-processor list and notice terms |
Beyond the contract itself, Nearpod backs its posture with a few checkable practices: a signed Student Privacy Pledge (a voluntary industry commitment administered by the Future of Privacy Forum and the Software & Information Industry Association), encryption of data in transit at TLS 1.2 or better, and a stated breach-notification commitment. None of those replace the DPA. They sit alongside it as supporting evidence.
What "Direct Control" Looks Like in Practice
FERPA's "direct control" condition is not just contract language; it should map to settings a district can actually operate. A clause promising control means little if the district has no real way to exercise it.
In practice, direct control means the district, not the vendor, decides how long rostered student data is retained, can trigger deletion when a student transfers or a school year ends, and can find out which sub-processors touch the data. A DPA that promises direct control but leaves a district with no deletion or export path has satisfied the sentence without satisfying the substance. Ask to see the admin-side retention and deletion controls, not just the clause that references them.
Why iKeepSafe and Safe Harbor Do Not Answer the FERPA Question
Here is where FERPA confusion most often creeps in. Renaissance Learning, Nearpod's parent company since 2021, engages iKeepSafe, an FTC-approved Safe Harbor organization, and holds that certification for several other products in its portfolio. It is tempting to treat that as a FERPA answer. It isn't one.
Two facts have to sit side by side. First, an FTC-approved Safe Harbor program under 16 CFR § 312.11 certifies COPPA practices, not FERPA; FERPA has no certification program at all, voluntary or otherwise. Second, the Nearpod-specific iKeepSafe review is listed as not yet complete on the parent company's own privacy hub, even as sibling products already carry it. So a Safe Harbor badge, once it posts, would still speak to COPPA rather than resolve the FERPA question for you.
| Claim you might see | What it actually is | Does it answer the FERPA question? |
|---|---|---|
| "Nearpod complies with FERPA" | A vendor self-description, unreviewed by an outside party | No; it is the weakest form of evidence |
| Student Privacy Pledge signatory | A public, voluntary commitment with no recurring third-party audit | Partially; supportive, not a contract |
| Signed district DPA naming Nearpod a School Official | A binding contract satisfying the § 99.31(a)(1) exception | Yes; this is the actual FERPA mechanism |
| iKeepSafe / Safe Harbor certification | Independent review of COPPA practices, currently pending for Nearpod | No; it is a COPPA signal, not a FERPA one |
The row that carries the FERPA weight is the signed DPA. For the full breakdown of where the iKeepSafe certification stands and why "coming soon" is not automatically a red flag, Is Nearpod COPPA Compliant? covers that ground in depth rather than repeating it here.
The Join Method Is Your Biggest FERPA Lever
Because FERPA attaches to identifiable education records, the way students join a Nearpod lesson is the most direct control a teacher has over how much record exists to protect in the first place. An anonymous session code keeps the footprint close to nothing; a rostered account creates a persistent, identifiable one.
| Join method | What gets stored | Education-record status | Best fit |
|---|---|---|---|
| Anonymous session code | A first name or nickname tied to one session only | Generally not an education record | One-off lessons, exit tickets, substitute-covered periods |
| Rostered student account | Full name, school email, institution, reference number, responses over time | An education record under the district's DPA | Semester-long progress tracking, assigned homework |
When you do need rostered accounts, route them through school-issued single sign-on rather than personal email. Nearpod supports Google, Microsoft, Apple, Clever, and ClassLink, and enabling accounts at the district level keeps them inside whatever agreement your district negotiated instead of outside it.
Say you teach Grade 5 social studies and want a quick end-of-class check on a lesson about the branches of government. An anonymous join code collects the answers you need without ever creating an education record tied to a named student. Reserve rostered accounts for the units where you genuinely need to look at a specific student's work again next week. For the day-to-day habits that flow from this choice, Nearpod and Student Data Privacy: What Teachers Should Know is the practical companion piece.
Newer AI Features Add a FERPA Question of Their Own
Nearpod has layered AI-assisted features on top of its original slide-based activities, and any feature that processes identifiable student input through an AI model raises FERPA's no-redisclosure condition in a way a static quiz never did. A no-sale, no-training commitment written for the core platform does not automatically extend to a feature added later, or to the model provider behind it.
Most classroom platforms are not foundation-model builders. When an AI feature relies on a separate provider's model calls, that provider becomes a sub-processor sitting exactly where FERPA's redisclosure bar is meant to hold. Three questions keep that layer honest:
- Does the AI feature send identifiable student responses to a model provider, and is that provider bound by the same no-redisclosure and no-training terms the DPA sets for Nearpod itself?
- Is the AI feature covered by the same contract as the core platform, or was it added after the DPA your district signed?
- Can the vendor name the model provider, rather than describing it vaguely as "our AI"?
The 2025 regulatory backdrop raises the bar here. The FTC's COPPA amendments now expect documented, written assurances that third parties receiving children's data can maintain adequate security (FTC, 2025), which is the right shape of question to ask about a Nearpod AI feature even though FERPA and COPPA are separate laws. Separate the core product from newer features when you ask, because a commitment covering lesson slides may not, on its own, cover an AI-generated content feature bolted on afterward.
A Before-You-Roster FERPA Checklist for Nearpod
Before rostering a class under a Nearpod account, work through these checks in order, and get written answers rather than verbal reassurances. Each one takes less time than building the lesson it protects.
- Confirm a signed DPA is actually on file with your district for Nearpod, rather than relying on the public privacy notice as your only reference point.
- Verify the DPA names Nearpod a School Official under LEA direction, the specific language the § 99.31(a)(1) exception depends on.
- Ask which sub-processors touch student data, and whether any AI-driven feature routes data to a model provider bound by the same no-redisclosure terms.
- Confirm the retention and deletion timeline in writing, matching the specificity the FTC's 2025 COPPA amendments now expect of vendors handling children's data (FTC, 2025).
- Check your state's own student-privacy statute, since a FERPA-satisfying DPA does not automatically clear a stricter law like Illinois's SOPPA or California's SOPIPA.
- Route the decision through a student-data-privacy officer or legal, not procurement alone, before a pilot becomes district-wide.
Expert Advice: Match the Tool to the Record You Actually Need
The sharpest habit an experienced teacher builds is asking what record a lesson truly requires before opening any account. Districts now have access to an average of nearly 3,000 distinct edtech tools in a given year, according to Instructure's LearnPlatform usage data (Instructure, 2025), far more than any privacy office can vet line by line, so a teacher's own restraint does real work. The same contract-not-certificate logic governs every tool in this category, which is why Is Quizlet FERPA Compliant? and Is Newsela FERPA Compliant? reach the identical conclusion for two very different platforms.
If the goal is generating the material rather than tracking live responses, a class-profile approach can sidestep student accounts entirely. EduGenius, for instance, lets a teacher generate a differentiated worksheet, MCQ quiz, or set of revision notes from a configured grade level and subject, with no student login involved in the generation step, which changes the education-record footprint compared with a rostered live session. That is a capability worth knowing about, not a replacement for the interactive formats Nearpod does well.
Pro Tips for a Cleaner FERPA Posture
- Ask for the certifying body by name, not the adjective. "We support FERPA" and "here is our School Official DPA" describe very different levels of commitment.
- Check the parent company's own compliance page directly. The way Renaissance itemizes each product's status separately is more informative than a single blanket claim for the whole portfolio.
- Log which units use rostered accounts versus anonymous codes. That one-line record makes an end-of-year retention conversation with your technology office far faster.
- Re-verify status annually. A DPA, a sub-processor list, or a pending certification can all change between one school year's renewal and the next.
What to Avoid
- Treating the public privacy notice as a substitute for a signed DPA. The notice describes intentions; only the contract satisfies FERPA's school-official exception, and only for the district that signs it.
- Assuming a certified parent company makes Nearpod certified, or that any certificate answers FERPA. Sibling Renaissance products carrying iKeepSafe does not extend to Nearpod, and even when it does, it certifies COPPA, not FERPA.
- Defaulting every lesson to rostered accounts. An anonymous code that meets the instructional goal creates far less of an education record to govern.
- Letting a pilot's DPA lapse while classroom use continues. A trial agreement that expires quietly leaves a class running with no active FERPA protection behind it.
Key Takeaways
- No vendor is "FERPA certified," Nearpod included, because FERPA binds schools and districts rather than software companies, and offers no certification for a vendor to earn.
- Nearpod's real FERPA mechanism is a signed DPA that names it a School Official under 34 CFR § 99.31(a)(1), placing the confidentiality and use limits in an enforceable contract.
- iKeepSafe and Safe Harbor are COPPA signals, not FERPA ones, and the Nearpod-specific review is listed as not yet complete on the parent company's privacy hub as of this writing.
- The join method is a teacher's biggest FERPA lever: anonymous session codes generally create no education record, while rostered accounts do.
- Rostered accounts should route through school SSO (Google, Microsoft, Apple, Clever, or ClassLink) and be enabled at the district level, not by an individual teacher acting alone.
- State laws such as SOPPA and SOPIPA can require more than a FERPA-satisfying DPA alone provides, so federal compliance is a floor, not a ceiling.
- A written checklist beats a website skim: confirm the DPA, the School Official designation, the sub-processor list, and the retention policy before rostering students.
Frequently Asked Questions
Is Nearpod FERPA compliant?
Nearpod is not "FERPA compliant" as a standalone product, because FERPA regulates schools, not vendors, and issues no certification. Nearpod supports a district's compliance by offering a DPA that names it a School Official under FERPA's exception. Actual compliance depends on your district holding that signed contract and configuring the tool correctly.
Does Nearpod sign a Data Processing Agreement with districts?
Yes. Nearpod offers districts a DPA in which it is treated as a School Official acting under the Local Education Agency's direction and control for the use of student data. That contract, not the public privacy notice, is the document that satisfies FERPA's school-official exception, so a district should request and review it before a wider rollout.
Does Nearpod's iKeepSafe status make it FERPA compliant?
No. iKeepSafe is an FTC-approved COPPA Safe Harbor organization, and Safe Harbor certifies COPPA practices, not FERPA, which has no certification program. The Nearpod-specific iKeepSafe review is also listed as not yet complete on the parent company's privacy hub. For FERPA, the signed DPA remains the mechanism that matters.
Does FERPA require parental consent to use Nearpod with students?
Usually not, when the district relies on FERPA's school-official exception through a signed DPA that keeps the district in direct control of the data. That exception lets a school share records with a vendor without individual consent. A separate law, COPPA, adds its own consent question for children under 13, covered in the linked COPPA article.
What data inside Nearpod counts as a FERPA education record?
Information tied to an identifiable, rostered student and maintained for the school, such as stored quiz scores, open-response answers, or submitted drawings, can be an education record. An anonymous, code-based response with only a first name and no persistent account generally is not, which is why the join method a teacher chooses directly shapes the FERPA footprint.