The Federal Trade Commission (FTC) and U.S. Department of Education (ED) increasingly are responding to concerns about educational technology and its ability to capture and manipulate massive quantities of private student and parent data. “EdTech,” as it is called, broadly refers to online curriculum and instructional materials accessed by school and personal devices. EdTech has the capacity to use student performance data to improve vendors’ learning programs and enhance educational outcomes. But it also has the ability to use that data for commercial uses that would otherwise be forbidden under privacy laws.

In a recent workshop held on December 1, 2017 by the FTC and ED, the agencies examined issues surrounding student privacy and EdTech. In particular, they looked at the intersection of the Children’s Online Privacy Protection Act (COPPA), overseen by the FTC, and the Family Educational Rights and Privacy Act (FERPA) regulated by ED. The workshop examined critical questions such as whether EdTech providers sufficiently understood FERPA and COPPA requirements, whether it is appropriate for school officials to provide consent under COPPA using in loco parentis concepts, what limits apply to personal information collected by EdTech vendors, and how schools can maintain “direct control” over EdTech providers when they rely on the School Official exception to FERPA’s consent requirements. Click here for more information about the workshop.

FERPA and COPPA have not been amended and updated in several years, during which the use of EdTech has exploded. Parents and privacy advocates increasingly are expressing concerns that the statutes are antiquated and inadequate to the task at hand. In response, many states have passed privacy legislation, and the EdTech industry has attempted to self-regulate through voluntary commitments such as the Student Privacy Pledge. But a robust and balanced federal regulatory scheme is the best approach for industry, schools, and students, providing a uniform system across the country and strong assurances that student data privacy and protection will be a reality.