Student data privacy rules for AI tutors and learning analytics

Applies whenThe institution receives US Department of Education program funds and the tool uses personally identifiable information from education records¹.

• A vendor may receive records without consent as a school official only if it performs a function staff would otherwise perform, stays under the institution's direct control over the records and follows the redisclosure limits¹.
• Access must be limited to records in which the official has a legitimate educational interest¹.
• Rights pass from parents to an eligible student: one who has reached 18 or attends a postsecondary institution².

Applies whenA service is directed to children under 13, or the operator knows it collects personal information from a child under 13³.

• Verifiable parental consent; under FTC guidance a school may consent instead only where data serves the school and no other commercial purpose⁴.
• Separate parental consent for disclosures to third parties not integral to the service⁵.
• A written security program and a written retention policy; children's data may not be kept indefinitely⁶⁷.
• Most amended provisions became mandatory on April 22, 2026³.

Applies whenThe tool processes UK learners' personal data; the code covers online services likely to be accessed by children, including direct-to-consumer edtech⁸.

• A provider acting solely on a school's instructions for its educational functions is likely a processor and generally outside the code⁸.
• Processing for the provider's own purposes, such as product development or marketing, makes it a controller for that processing, and the code applies⁸.

Applies whenThe tool processes personal data of learners in the EU, or the provider or institution is established there⁹.

• Article 28 processor terms flowed down to every sub-processor, and an Article 35 impact assessment for high-risk processing⁹.
• Parental authorization where consent is relied on for a service offered directly to a child below the national age, which Article 8 lets member states set between 13 and 16⁹.

Applies whenAn AI system is placed on the EU market or used in the EU; Annex III lists admission, evaluating learning outcomes, assessing the appropriate level of education and detecting prohibited behavior during tests¹⁰.

• Emotion recognition in education institutions is prohibited under Article 5, except for medical or safety reasons¹⁰.
• High-risk providers need risk management, documentation, logging, human oversight and conformity assessment; deployers assign oversight, keep logs and inform students¹⁰.
• Stand-alone Annex III obligations now apply from December 2, 2027 instead of August 2, 2026¹¹.

Applies whenAn operator knows its service is used primarily for K–12 school purposes and was designed and marketed for them¹².

• No targeted advertising, no student profiles beyond school purposes and no selling of student information¹².
• Reasonable security, and deletion when the school or district asks¹².