Learn out. Schools Race To Write AI Policies. What About Student Data Privacy? via @forbes https://forbes.com/sites/sarahhernholm/2026/07/24/schools-race-to-write-ai-policies-what-about-student-data-privacy/… #tech #digital #privacy #crypto #ai

Schools Race To Write AI Policies. What About Student Data Privacy?

Source: https://www.forbes.com/sites/sarahhernholm/2026/07/24/schools-race-to-write-ai-policies-what-about-student-data-privacy/ Make sure you know the AI policies and student data protection rights

getty

AI use in classrooms jumped fast.RAND’s 2025 surveyof a nationally representative group of teachers, students, school leaders, and parents found 54% of students and 53% of teachers used AI for school that year, both up more than 15 percentage points from the year before. Policy did not keep pace. Only 45% of principals reported having a school or district AI policy, and just 34% of teachers said their district had a policy specifically addressing AI and academic integrity.

That gap is closing on the usage side. What’s less clear is whether student data privacy is closing with it, or getting written in as an afterthought.

Student Data Privacy Rarely Gets Its Own AI Policy

Ohio became the first state to require every public school district to adopt a formal AI policy, under a deadline set by House Bill 96: July 1, 2026. To its credit,the state’s model policydoes name data privacy directly, telling districts to address protection of personally identifiable information and FERPA compliance. Not every district will use the state model, though, and RAND’s numbers suggest a meaningful share of schools nationally still don’t have any AI policy to build data protections into in the first place.

Action steps

• Inquire directly with your child’s school about its AI policy, if it has one. Specifically, ask whether the policy addresses data handling and retention, not just acceptable use.
• Check if the policy names specific vendors or outlines general principles. Be cautious of vague language, as it may indicate that the data issues have not been adequately addressed.

Student Data Privacy Law Predates The AI Tools It’s Supposed To Cover

FERPA, Family Educational Rights and Privacy Act,the federal law governing student education records, was written in 1974. It has no explicit cybersecurity requirements and wasn’t built with AI models that train on the data they touch in mind. California’s AB 1159, which is still moving through the state legislature as of mid-2026, aims to prohibit schools and educational technology vendors from using student data to train AI models. The bill would also grant students and parents a limited right to sue if violations occur. However, there isoppositionto this legislation.

Idaho’s SB 1227 takes a more focused approach by requiring data privacy protections specifically for AI tools used in schools.

Bills like these exist because the current baseline doesn’t cover this. Passing one in California or Idaho doesn’t extend that protection to a family in a state that hasn’t introduced anything similar.

Action steps

• Check whether your state has introduced or passed AI-specific student data legislation. FutureEd’s legislative tracker follows this bill by bill.
• Don’t assume FERPA alone covers what an AI tool does with your child’s data. Ask the school what additional agreement, if any, exists with the vendor.

When The Gap Between AI Policy And Student Data Privacy Becomes A Headline

The consequences of data breaches are very real. In December 2024, a breach ofThe PowerSchool breach,was discovered and publicly disclosed in early 2025. This incident compromised over 62 million student records and nearly 10 million teacher records, making it the largest known breach of children’s data in the country.

In spring 2026,a breach at Canvas, exposed lists of names, email addresses, student ID numbers, and private messages from over 8,800 institutions.

Additionally,whistleblower allegedthat AllHere, a chatbot vendor used by school districts, improperly collected student data in violation of both industry standards and the district’s own written policies.

Action steps

• Treat anAI-written policyas a starting point, not definitive assurance. Inquire about how compliance is actually verified.
• If your school uses a chatbot, tutoring tool, or AI grading system, ask who audits the vendor and how frequently this occurs.

Student Data Privacy Questions To Ask Before Your Kid Uses A School AI Tool

Compliance specialists who work with districts, state the key document to reference is a signed data privacy agreement between the school and the vendor. This agreement should clearly outline usage restrictions, prohibit redisclosure of information, and grant the school audit rights. Without this agreement, an AI vendor and any sub-vendors it works with will have significantly less accountability.

Action steps

• Make sure to ask if the school has a signed data privacy agreement with each AI vendor it uses, rather than relying solely on a general policy statement.
• Inquire about what happens to your child’s data if the vendor utilizes another AI company’s model behind the scenes. The sub-vendor accepts the same obligations only if this is specified in the contract.
• Ask how long the data is kept and whether it’s deleted when your child leaves the school or the tool is discontinued.

Writing an AI policy is the easy part. Student data privacy, what actually happens to a kid’s data once the tool is being used, is the part still getting figured out, one breach and one bill at a time.