Is SchoolAI Safe for FERPA and COPPA?
Quick Answer: SchoolAI states on its own Trust & Safety pages that it is FERPA compliant, COPPA compliant, SOC 2 Type II audited, and contractually bars its AI subprocessors from training on student data. Those are the vendor's own claims, not independent government certifications. FERPA has no vendor certification program at all, and SchoolAI's public materials describe COPPA compliance as an internal, contractual commitment rather than enrollment in an FTC-approved Safe Harbor program. A district still has to verify the specifics before rollout.
Searching "is SchoolAI safe for FERPA and COPPA" usually turns up SchoolAI's own marketing pages first, which is exactly the problem. This article treats those pages as a starting claim to be checked, not a verdict, and walks through what FERPA and COPPA actually require, what SchoolAI says it does to meet them, and what a curriculum coordinator or district technology director should still confirm before a classroom rollout.
RAND's 2025 survey of U.S. principals found that 70% cited data privacy concerns as a major or minor factor shaping their decisions about AI tools, alongside a near-identical share who cited a lack of professional development on the topic (RAND, 2025). Common Sense Media's 2025 family research adds the parent side of that picture: 84% of parents reported concern about AI tools misusing their child's data, and 83% said their child's school had not communicated with them about generative AI at all (Common Sense Media, 2025). Those two numbers, one from school leaders and one from parents, explain why a single vendor's compliance page rarely settles the question on its own.
What FERPA Actually Requires From a Tool Like SchoolAI
FERPA is a federal law that makes the school or district, not the vendor, legally responsible for protecting student education records. The Family Educational Rights and Privacy Act was written in 1974, decades before generative AI existed, so it regulates AI tools indirectly, through the same "school official" exception that has long governed textbook publishers and grading software.
Under that exception, a district can let a vendor like SchoolAI access student records without separate parental consent, provided specific conditions are met:
- The vendor performs a service the school would otherwise do itself.
- The district maintains "direct control" over the vendor's use of the data.
- The vendor uses the data only for the authorized purpose, not for unrelated commercial use.
- The vendor doesn't redisclose the data to further third parties without authorization.
There is no FERPA seal, badge, or government certification a vendor can earn. When a company states it is "FERPA compliant," that's a description of its own practices measured against the law's requirements, not a credential issued by the Department of Education. The actual compliance obligation sits with the school district that signs the contract.
Where This Leaves SchoolAI Specifically
SchoolAI positions itself as operating under the school-official exception, meaning districts, not individual teachers, are expected to be the ones who execute the data agreement. That structural choice matters more than any badge on the homepage, because it's the legal mechanism that actually makes the tool usable under FERPA in the first place.
A common misunderstanding is worth clearing up directly: an individual teacher signing up for a free classroom account, without district IT or legal review, is a very different legal situation than a district-level agreement. The school-official exception depends on the district maintaining "direct control" over the vendor's use of student data, which is difficult to demonstrate if no one at the district level ever reviewed or signed anything. A teacher-led signup can still be a reasonable way to pilot a tool informally, but it shouldn't be mistaken for the same FERPA posture as a formal district contract.
What "Direct Control" Looks Like in Practice
Say a sixth-grade science teacher wants to use SchoolAI to run guided review sessions before a unit test. If the district has a signed agreement with SchoolAI that specifies data use, retention, and deletion terms, that teacher's classroom use sits inside a FERPA-compliant structure the district already vetted. If the teacher instead signed up independently with a personal account and started uploading a class roster, the district has no contractual mechanism governing what happens to that data at all, regardless of what SchoolAI's own privacy page promises.
What COPPA Actually Requires From a Tool Like SchoolAI
COPPA, the Children's Online Privacy Protection Act, is enforced by the Federal Trade Commission and requires verifiable parental consent before collecting personal information from children under 13, unless a specific exception applies (such as data collected for school-authorized educational purposes, where the school can act as the parent's agent for consent under FTC guidance).
The FTC finalized its first COPPA Rule amendments since 2013 on April 22, 2025, adding stricter requirements around separate parental consent for third-party data sharing (FTC, 2025). That update raised the bar for exactly the kind of AI subprocessor chains discussed below.
COPPA does have a formal, government-recognized certification path, unlike FERPA, but it's narrower than most people assume. The FTC approves a small number of independent organizations, currently including iKeepSafe, PRIVO, and kidSAFE, to run "Safe Harbor" programs. A company that enrolls in one of these programs gets its practices reviewed by that organization and, in exchange, is generally shielded from direct FTC investigation as long as it stays in compliance with the program's rules.
A vendor can be entirely truthful in calling itself "COPPA compliant" without ever having enrolled in a Safe Harbor program. Compliance can also be demonstrated through internal legal review and contractual commitments. It's simply a different, less independently verified path than formal Safe Harbor certification.
The Safe Harbor programs themselves are older and more established than most people assume. PRIVO has operated as an FTC-approved Safe Harbor since 2004. The FTC approved iKeepSafe's program in 2014, describing it as providing "the same or greater protections for children" as the COPPA Rule itself. kidSAFE was approved as a later addition to the same small group. Under recent FTC amendments, these approved programs must now publicly disclose their member lists and report periodically to the FTC on disciplinary actions taken against members, which makes checking membership more straightforward than it used to be: a district can look up whether a vendor is listed rather than taking a claim on faith.
What SchoolAI Itself States About Meeting These Requirements
The table below reflects SchoolAI's own published statements on its Trust & Safety pages as of 2026. Every row is the company's description of itself, not an independent finding.
| Claim | What SchoolAI states | Independent backing |
|---|---|---|
| FERPA compliance | Fully compliant, structured around the school-official exception | Internal/contractual; no separate government FERPA certification exists for any vendor |
| COPPA compliance | Fully compliant with federal requirements for protecting children's data | Described as internal and contractual; no public Safe Harbor enrollment (iKeepSafe, PRIVO, kidSAFE) found in SchoolAI's materials |
| SOC 2 Type II | Independently audited security controls, including AES-256 encryption and 24/7 monitoring | Third-party audited (SOC 2 is a recognized, independent security standard, distinct from a privacy certification) |
| ESSA Tier 3 Validated | Meets the U.S. Every Student Succeeds Act's evidence tier for promising research-based practices | Third-party evidence review under the ESSA framework |
| 1EdTech TrustEd Apps Certified | Certified against 1EdTech's data privacy and security rubric for ed-tech products | Third-party certification body (1EdTech) |
| No training on student data | States student data is never sold, shared with advertisers, or used to train AI models, and that its AI subprocessor contracts explicitly prohibit pretraining or fine-tuning on that data | Contractual (self-reported); no independent auditor named specifically for this claim |
Two of those six rows carry real third-party weight: SOC 2 Type II and 1EdTech TrustEd Apps Certified. Both involve an outside body reviewing SchoolAI's practices against a defined standard. The FERPA, COPPA, and no-training rows are SchoolAI's own descriptions of its practices, which is common in this industry and not inherently suspicious, but it's a meaningfully different category of evidence than an audit.
A District's Verification Checklist Before Approving SchoolAI
A privacy page comparison is a useful first pass. Before a district-wide rollout, walk through these steps with SchoolAI directly:
- Request the signed Data Protection Agreement (DPA), ideally through the Student Data Privacy Consortium's National Data Privacy Agreement framework, rather than relying on the website's summary of terms.
- Ask for the current list of AI subprocessors behind SchoolAI's product and confirm each one's own training and retention policy in writing, not just SchoolAI's characterization of it.
- Request a copy or summary of the SOC 2 Type II report (many vendors will share this under a mutual NDA) rather than accepting the certification claim at face value.
- Ask directly whether SchoolAI participates in an FTC-approved COPPA Safe Harbor program. If the answer is no, that's not necessarily disqualifying, but it changes what "COPPA compliant" is actually backed by.
- Confirm how parental consent is handled in your specific state and district, since some states require consent mechanisms that go beyond the federal COPPA baseline.
- Check your state's own student data privacy law, since states including California, Colorado, and New York impose requirements beyond FERPA and COPPA that a federal-only compliance claim won't automatically satisfy.
Picture a district technology director running this checklist during a two-week pilot with two classrooms before recommending SchoolAI for the whole middle school. That short pilot window is enough time to request the DPA, get the subprocessor list, and confirm the SOC 2 report exists, all before a single additional classroom is added to the rollout.
A Sample Two-Week Verification Timeline
Spreading the checklist above across a defined window keeps it from becoming an open-ended delay. One reasonable way to sequence it:
| Timeframe | Action |
|---|---|
| Days 1–3 | Request the DPA (or begin the SDPC National Data Privacy Agreement process) and the current AI subprocessor list |
| Days 4–7 | Review subprocessor terms; request the SOC 2 Type II report summary under NDA if needed |
| Days 8–10 | Confirm COPPA consent mechanism and ask directly about Safe Harbor program participation |
| Days 11–12 | Check district's home state's student data privacy law against SchoolAI's stated terms |
| Days 13–14 | Legal/IT sign-off and go/no-go decision before wider classroom rollout |
How SchoolAI Compares to Other Classroom AI Assistants on These Specific Points
This is a factual comparison of publicly stated positions, not a ranking. Each platform serves a somewhat different classroom purpose.
| Platform | Primary use case | SOC 2 stated | Third-party COPPA certification found |
|---|---|---|---|
| SchoolAI | Interactive classroom AI "spaces" for teacher-guided student activities | Yes (Type II) | Not publicly found; described as internal/contractual |
| Khan Academy (Khanmigo) | AI tutoring and teaching assistant integrated with Khan Academy's curriculum | Not the primary claim emphasized in public materials | Not publicly found; described as internal/contractual |
| MagicSchool | AI tools for lesson planning, differentiation, and teacher workflow generation | Yes (Type II) | Yes; iKeepSafe lists MagicSchool as a participant in its FTC-approved COPPA Safe Harbor program |
The MagicSchool row is the clearest example of the distinction this article keeps returning to. Two platforms can both say "COPPA compliant" and mean genuinely different levels of independent verification behind that phrase.
Districts evaluating classroom AI chat assistants alongside instructional content generators should apply the same verification checklist across categories. EduGenius, for instance, is used for generating quizzes, worksheets, flashcards, and other instructional materials from a teacher-defined class profile rather than for open-ended student chat, but the same procurement questions (what's in the DPA, who processes the data, what's independently audited) still apply before it's adopted at scale.
It's worth being explicit that none of this is a recommendation against SchoolAI. The point of this comparison is that "safe for FERPA and COPPA" isn't a single yes-or-no answer a district can copy from a vendor's homepage. It's a set of specific, checkable claims, some backed by independent audits, some self-reported, and a district's job during procurement is to figure out which is which before students are using the tool every day.
Common Mistakes Schools Make When Vetting "Compliant" AI Tools
- Accepting a compliance badge without asking who issued it. A SOC 2 badge and a self-declared "COPPA compliant" badge look similar on a webpage but represent very different levels of scrutiny; one came from an independent auditor, the other is the vendor describing itself.
- Assuming FERPA compliance is something a vendor "has," rather than something the district demonstrates through its own contract and data-governance practices. The legal responsibility never actually transfers to the vendor under FERPA.
- Skipping the subprocessor question because the interface feels self-contained. SchoolAI, like most classroom AI tools, runs on top of one or more foundation model providers; those providers' own training and retention policies matter just as much as the classroom-facing product's.
- Treating a two-week free trial the same as a vetted district deployment. Free trials often run under different, sometimes looser, terms than a signed institutional agreement, and a pilot that "worked fine" isn't the same as a pilot that was contractually reviewed.
- Never asking what happens if the underlying model provider changes. A vendor that switches AI subprocessors could inherit a different training or retention policy without a corresponding change to the district-facing marketing language, which is exactly why annual re-verification, not just a one-time signoff, belongs in the renewal process.
- Confusing a state-level student privacy pledge with FERPA or COPPA compliance. Some vendors sign voluntary industry pledges that sound authoritative but are separate from, and narrower than, an actual DPA specific to your district.
Key Takeaways
- FERPA has no vendor certification program; SchoolAI's "FERPA compliant" claim describes its own alignment with the school-official exception, and the legal responsibility still sits with the district.
- COPPA does have a formal certification path (FTC-approved Safe Harbor programs like iKeepSafe, PRIVO, and kidSAFE), but SchoolAI's public materials describe COPPA compliance as internal and contractual rather than Safe Harbor-certified.
- SchoolAI's SOC 2 Type II and 1EdTech TrustEd Apps Certified claims carry real independent, third-party backing; its FERPA, COPPA, and no-training claims are self-reported.
- MagicSchool's COPPA claim is backed by a named third-party certifier (iKeepSafe), which is a useful comparison point when weighing SchoolAI's self-reported claim.
- The FTC's April 2025 COPPA Rule amendments raised the bar for third-party data sharing consent, making the AI subprocessor question more important than it was a few years ago.
- A district's own verification checklist (DPA, subprocessor list, SOC 2 report request, Safe Harbor question, state law check) matters more than any single badge on a vendor's website.
- The same due-diligence process applies across tool categories, whether evaluating a classroom chat assistant or an instructional content generator like EduGenius.
Frequently Asked Questions
Is SchoolAI FERPA compliant?
SchoolAI states on its Trust & Safety pages that it is fully FERPA compliant and operates under the school-official exception. There is no government FERPA certification for any vendor to hold; the district signing the contract remains the legally responsible party under the law.
Is SchoolAI COPPA certified by the FTC?
SchoolAI states it is COPPA compliant, but its public materials describe this as an internal and contractual commitment rather than enrollment in an FTC-approved Safe Harbor program such as iKeepSafe, PRIVO, or kidSAFE. That's a real distinction worth asking the vendor about directly.
Does SchoolAI have SOC 2 certification?
Yes. SchoolAI states it holds SOC 2 Type II certification, which involves an independent auditor reviewing security controls like encryption, access management, and monitoring over a sustained period. This is a genuine third-party audit, distinct from a privacy-specific certification, and a district can request the underlying report to confirm scope.
Can an individual teacher legally sign up for SchoolAI without district approval?
A teacher can create an account, but doing so outside a district-level agreement means FERPA's "direct control" requirement, the condition that lets a vendor access student records under the school-official exception, likely isn't satisfied. For any classroom-wide or district-wide use, IT and legal should review and sign the DPA first.
Does SchoolAI train its AI on student conversations?
SchoolAI states that student data is never sold, shared with advertisers, or used to train AI models, and that its contracts with AI subprocessors explicitly prohibit using that data for pretraining or fine-tuning. This is the vendor's own stated policy; districts should request the underlying subprocessor terms to confirm it in writing.
How is SchoolAI different from MagicSchool on FERPA and COPPA?
Both platforms state they are FERPA and COPPA compliant, and both hold SOC 2 Type II audits. The notable difference is that MagicSchool is listed by iKeepSafe as a participant in its FTC-approved COPPA Safe Harbor program, while SchoolAI's COPPA claim is currently presented as an internal, contractual commitment.
For the broader legal framework behind these questions, see the pillar guide, AI, FERPA & COPPA: The Complete School Data-Privacy Guide (2026). For how the no-training claim works across the wider market, read AI Tools That Don't Train on Student Data. For a look at how a different security lens changes the comparison, see The Most Secure AI Tools for K-12 Students in 2026. For a step-by-step vetting checklist you can reuse for any vendor, see FERPA-Compliant AI Tools for Teachers: A 2026 Checklist. And for a direct feature-by-feature comparison, see SchoolAI vs Khanmigo: Which Is Better for Teachers?