Is Newsela FERPA Compliant?

No software company is "FERPA certified," and Newsela is no exception: FERPA (20 U.S.C. § 1232g) regulates the school district, not the vendor, so there is no seal for Newsela to earn. What Newsela actually offers is a Data Processing Agreement plus a written commitment to act as a "school official" under the district's control. That posture can support a district's FERPA compliance, but the honest answer to the title question is a contract, not a certificate.

Quick Answer: Newsela is not, and cannot be, "FERPA certified," because FERPA binds the school district rather than the software it buys. Newsela's own privacy policy states that the reading and quiz data it generates about a student may be an "education record" under FERPA, that this data is owned and controlled by the school, and that Newsela acts as a school official under the district's direction. That supports FERPA compliance only once a signed Data Processing Agreement is in place, and the district stays legally responsible either way.

Newsela sits in a category that makes this question sharper than it is for a teacher-only tool. Students log in and read directly, so the platform continuously generates data about an identifiable child. That is precisely the kind of information FERPA was written to govern, which is why a reading platform earns a more careful answer than a quick skim of a compliance page can give.

Why No Vendor, Newsela Included, Can Be "FERPA Certified"

FERPA governs how a school or district handles a student's education records; it issues no certificate to the software companies a district contracts with. When a vendor page reads "FERPA compliant," it is describing a willingness to sign a contract, not displaying a government seal, because no such seal exists for any product.

The reason is structural rather than a technicality:

• FERPA binds the "educational agency or institution," meaning the district that receives US Department of Education funding, not the third party it hires.
• The Department's Student Privacy Policy Office administers the law, and it has never operated a vendor-certification program of any kind.
• A vendor's role is defined entirely by contract, specifically the "school official" exception at 34 CFR § 99.31(a)(1), which exists on paper only once a district and vendor actually sign one.

So the accurate reading of "Newsela is FERPA compliant" is narrower than it sounds: Newsela offers terms a district can sign that, combined with the district's own handling, support compliance. The pillar guide, AI, FERPA & COPPA: The Complete School Data-Privacy Guide (2026), works through why that certification-versus-contract distinction is the most important fact in every one of these vendor questions.

The One Exception That Proves the Rule

COPPA, FERPA's frequent companion, does have a voluntary Safe Harbor program the FTC formally recognizes. FERPA has no equivalent, not even a voluntary one, since it binds the school and leaves nothing for a vendor to be certified against. That asymmetry is worth holding onto, because it means a Newsela FERPA claim can never be more than "here is a contract your district can execute."

What FERPA Actually Protects When Students Use Newsela

FERPA protects "education records," and the reading activity a student generates inside Newsela can squarely qualify. Newsela's privacy policy itself acknowledges that student data on the platform may include education records as defined by FERPA, which is a more candid starting point than many vendors offer.

An education record under FERPA is, broadly, information directly related to an identifiable student and maintained by the school or a party acting for the school. Inside a reading platform, that sweeps in more than most teachers expect.

Which Newsela Data Counts as an Education Record

A student reading on Newsela leaves a trail of activity, and much of it can attach to FERPA once it is tied to a named child. The table below sorts the common data types by whether they typically fall inside FERPA's education-record definition.

The pattern reading down that table is clear: nearly everything a student personally generates on the platform becomes a record the district is responsible for, which is exactly why the contract governing that data matters so much.

The "School Official" Exception in Plain Terms

FERPA normally requires a school to get consent before sharing a student's records with an outside party. The school-official exception at 34 CFR § 99.31(a)(1) is the carve-out that lets a district share records with a vendor like Newsela without individual parental consent, but only when four conditions all hold:

1. Newsela performs a service the district would otherwise handle itself.
2. The district keeps "direct control" over how the data is used and maintained.
3. Newsela uses the data only for the purpose the district authorized.
4. Newsela is contractually barred from redisclosing the data.

Those four conditions are not satisfied by a friendly privacy policy. They are satisfied by a signed agreement, which is why the next section matters more than any marketing language.

The Parental Rights a Newsela Account Puts in Play

FERPA gives parents, and eligible students 18 and older, three concrete rights, and a platform students log into can implicate all three. Naming them turns an abstract statute into a checklist a district can actually answer.

• The right to inspect and review. A parent can ask to see the education records the school maintains, which can include a child's reading history, quiz results, and annotations stored in Newsela. The district needs a way to retrieve that data from the vendor to honor the request.
• The right to request amendment. If a parent believes a record is inaccurate or misleading, they can ask the school to correct it, a right that presumes the district can actually locate and edit the underlying data.
• The right to control disclosure. The school generally cannot release a student's records to an outside party without consent, which is the precise obligation the school-official exception carves a narrow path through.

None of these rights bind Newsela directly. They bind the school, and Newsela's role under the DPA is to keep the data accessible enough that the district can satisfy them on request.

What Newsela States About FERPA, and Where the Proof Lives

Newsela's public position is that it acts as a school official under the district's direction, uses student data only to deliver the contracted service, and treats that data as owned and controlled by the school. Its Data Processing Agreement goes further, stating that for FERPA purposes Newsela is a school official under the control and direction of the local education agency as it pertains to the use of student data (Newsela, 2026).

Those are strong commitments, and they map cleanly onto the four-part school-official test. Three of them are worth pulling out specifically:

• No targeted advertising to students. Newsela states it does not use or disclose student data for targeted advertising, aligning with the "authorized purpose only" condition.
• No sale of student data. Newsela's terms state it will not sell student data to any third party.
• Return or deletion on termination. Newsela's DPA states that when a contract ends, it will cease processing and return or destroy customer data under its retention policy (Newsela, 2026).

The DPA, Not the Privacy Policy, Is the Enforceable Document

A privacy policy is a self-description a company can revise. A Data Processing Agreement is a binding contract specific to the district that signs it, which is what makes retention windows, subprocessor lists, and breach-notification timelines actually enforceable. Newsela publishes a DPA districts can attach to their contract, and it is a recognized signatory to standard student-data-privacy agreements coordinated through the Student Data Privacy Consortium.

Here is the practical division of labor that a signed DPA creates, and why "is Newsela FERPA compliant" is really a shared responsibility rather than a vendor property.

Read across any row and the same truth surfaces: Newsela can supply the terms, but the district holds the FERPA obligation. That is the honest shape of the answer.

A "Warning" Privacy Rating Is Not a FERPA Violation

An independent transparency rating and a FERPA legal violation are two different things, and conflating them is a common mistake. In the version reviewed for this article (2026), the Common Sense Privacy Program's evaluation of Newsela's terms carried a "Warning" rating, driven mainly by language permitting advertisements shown to teachers and administrators based on their students' interests, not targeted ads served to children.

That distinction deserves precision. A Warning rating flags how clearly a policy communicates its practices; a FERPA violation would be a school improperly disclosing an education record. Neither the rating nor the underlying advertising language is a finding that Newsela broke FERPA. The fuller safety picture, including that rating in context and Newsela's use of Clever and ClassLink rostering, already lives in Is Newsela Safe for Students?, and the COPPA-specific consent mechanics live in Is Newsela COPPA Compliant?. This article does not repeat or dispute either.

Why bring it up here at all? Because a district evaluating FERPA needs to know that a third-party rating and a FERPA obligation answer different questions, so a Warning badge should prompt a closer read of the DPA rather than a reflexive rejection or a false sense of alarm.

A Grade 6 ELA Scenario, and the FERPA Questions That Belong to You

Say you teach Grade 6 English Language Arts and your building has adopted Newsela for differentiated nonfiction this year. Your students generate reading-level data and quiz scores daily, all of which can be education records, so the FERPA mechanics above are concrete for your roster rather than abstract.

Most of the heavy lifting is not yours as the classroom teacher. A short set of questions is:

1. Know who signed the DPA. You do not need to read it line by line, but you should know which office in your district holds it, so a parent question has a real answer.
2. If a parent asks to see their child's records, route it through that office. FERPA gives a parent the right to inspect and review, and a student's Newsela reading history can be part of what they are entitled to see.
3. Keep annotations in mind as the sensitive category. A quiz score is a number; a written response can reveal far more, and it is still an education record the school controls.
4. Do not spin up a manual, non-rostered account as a shortcut, since a personal email address in a signup field creates data the district never needed to collect.

A teacher could also shrink the education-record footprint of a unit before it starts by generating some materials teacher-side rather than student-side. EduGenius, for example, can generate a differentiated nonfiction worksheet, a comprehension quiz, or vocabulary flashcards from a class profile you configure with grade level and subject, without any student logging in for the generation step, which keeps that particular slice of data out of a student-facing system entirely. It is a different tool than a leveled-reading platform, but it is a useful way to ask how much of a unit truly needs to run through student accounts.

Newsela vs a Teacher-Only Tool: Why the FERPA Answer Differs

The FERPA analysis for Newsela is heavier than for a teacher-only tool for one structural reason: students log in, so the platform holds education records about identifiable children. A tool a teacher uses alone to generate materials may never touch a student's name at all, which shrinks the FERPA surface dramatically.

That contrast is worth making concrete:

• Newsela collects reading and quiz data tied to each student, so the school-official exception and a signed DPA are load-bearing rather than optional.
• A teacher-only differentiation tool, by design, may collect no student data at all, leaving little for FERPA to attach to. Is Diffit FERPA Compliant? walks through exactly that model, where the vendor states it collects zero student data because only teachers hold accounts.

The lesson is not that one model is universally safer. It is that the FERPA questions scale with how much identifiable student data a tool actually holds, and Newsela, as a platform students use directly, sits at the end of that spectrum where the contract has to do real work. A district weighing a reading platform against assistant-style tools may also find the feature-level comparison in SchoolAI vs Khanmigo: Which Is Better for Teachers? useful for holding each tool to the same evidence standard.

Related Reading

• AI, FERPA & COPPA: The Complete School Data-Privacy Guide (2026)
• Is Newsela Safe for Students?
• Is Newsela COPPA Compliant?
• Is Diffit FERPA Compliant?
• Is Grammarly FERPA Compliant?
• SchoolAI vs Khanmigo: Which Is Better for Teachers?