AI in Education: Protect Students. Prepare Them.

In the U.S., the Family Educational Rights and Privacy Act (FERPA) protects student education records. The Children's Online Privacy Protection Act (COPPA) restricts data collection from children under 13. When a school adopts an AI tool that processes student data, it must ensure compliance with both.

The problem: many AI tools are adopted by individual teachers without institutional review. A teacher who pastes student names and grades into ChatGPT to generate report card comments has just shared FERPA-protected data with OpenAI. This isn't hypothetical. It's happening daily.

Establish a clear, written AI use policy. Define which tools are approved. Define what student data can never be entered into AI systems (names, grades, behavioral records, health information, IEP data). Require institutional review before any new AI tool is adopted. Train teachers on these policies, because prohibition without education leads to shadow AI use.

AI-generated writing is now indistinguishable from student writing in most cases. AI detection tools are unreliable and have been shown to disproportionately flag writing by non-native English speakers. The answer isn't better detection. It's better pedagogy. Redesign assessments to emphasize process (drafts, revisions, in-class work) over product. Teach students to use AI as a tool, with transparency and attribution, rather than pretending it doesn't exist.

Students need to understand how AI works, what it can and can't do, where its biases come from, and how their data is used. This isn't a computer science elective. It's a civic literacy requirement. Just as we teach media literacy and financial literacy, AI literacy should be part of every curriculum. Students who understand AI are less likely to be exploited by it.

Ask your child's school: What AI tools are being used in the classroom? Has the school reviewed those tools for FERPA and COPPA compliance? Is there a written AI use policy? What data is being collected about my child, and by whom? You've the right to ask these questions and the right to receive answers.

Because children were recognized as vulnerable before the internet existed. FERPA was enacted in 1974. COPPA was enacted in 1998. These laws were written to protect people who couldn't protect themselves.

Adults were assumed to be capable of reading terms of service, understanding data policies, and making informed choices. That assumption was always questionable and is now laughable. The average person encounters thousands of data collection events per day through apps, websites, smart devices, and AI tools. No human being can meaningfully consent to all of it.

The honest answer: adults aren't protected because the political will to protect them hasn't yet overcome the lobbying power of the industries that profit from their data. This is fixable. It requires legislation. See the Government Action page.