# data[].attributes.body
While researching privacy of student data with AI usage, I have learned that no matter how much technology is changing FERPA will be the main law that protects student privacy. As AI becomes more wide spread and more invasive, amendments and additional laws are created to keep data collection of technology in compliance with FERPA. As I continue in my educational journey, guiding students to career paths there will be times I will need to use proper procedures and get permissions to disclose information for students to continue their education.

I think these laws are in place not only to protect student data, but to help students avoid discrimination against AI technology. Law makers will never be able to stop making adjustments to protect student privacy from technology with its advancing changes. Its up to us as educators to help teach students how to protect their information.

# data[].attributes.body
Before becoming a secondary math teacher, I started out with my school as the PEIMS Clerk where I was trained on policies and procedures regarding the protection of student privacy and secure movement of data from one school to another. Being in the classroom for the last two years has opened my eyes to a new type of data collector known to most as artificial intelligence (AI) which tests the limits of policies and procedures put in place to protect student information. As a math teacher, I do my best to keep students using pencil and paper to promote steps to keep students on track. Technology has some great resources and programs, however when I attempt to use approved school online programs that involve AI, students end up having to answer strange survey questions or accept a popup to continue. A majority of students do not read what they are accepting or are unaware what the popup means, this puts their privacy at risk being unaware of something they agreed to release. As teachers this becomes very frustrating as it wastes time that could be focused on the topics at hand.

Another concern many of us teachers share is grading of the state assessments that now use AI technology to score written essays and free response answers. Not only does this put students information in the hands of AI for accurate reporting of scores for students, but can even lead to discrimination of scores as AI is set to look for key words and example responses. Every student has their individual writing style meaning AI might not understand an answer that meets all the requirements, thus altering their score.

AI is becoming a part of everyday life, but how much information is being released without knowledge.

# data[].attributes.body
FEDERAL

When protecting student data at the federal level, the Student Privacy Policy Office (SPPO) within the United States Department of Education is responsible for enforcing policies such as Family Educational Rights and Privacy Act (FERPA) and Protection of Pupil Rights Amendment (PPRA). I have learned that these agencies work to create regulations, provide information on best practices for privacy, investigate complaints, and offer technical support that is related to violations in PPRA and FERPA. When it comes to privacy concerns associated with artificial intelligence, the SPPO uses the Privacy Technical Assistance Center (PTAC) to help educate others about AI related privacy issues through training and emphasizing best practices when using online programs (Student Privacy Policy Office, 2024).

STATE

For Texas, student privacy is handled at the state level by the Texas Education Agency (TEA). It is the job of TEA to oversee and enforce laws and regulations, such as FERPA, to protect student information within its jurisdiction (Texas Education Agency, 2020).

# data[].attributes.body
15 U.S.C. § 6501 et seq. - Children's Online Privacy Protection Act (COPPA)

Federal Law to protect online privacy of children under the age of 13

Requires websites to verify parent consent before collection of data from children

It is a legal requirement of website and online operators to follow verification of age before data collection through COPPA and have a privacy policy explaining practices

(eCFR, 2013)

https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-312

42 U.S.C. § 2000d et seq. - Civil Rights Act of 1964 - Title VI

20 U.S.C. §§ 1681–1688. - Title IX

Both Title VI and Title IX prohibit discrimination

Work to prevent bias of artificial intelligence

(U.S. Department of Justice, 2015)

https://www.justice.gov/crt/title-ix-education-amendments-1972#:~:text=of%20the%20page-,Sec.,the%20Secretary%20of%20Education%20or

House Bill 149 - Texas Responsible Artificial Intelligence Governance Act (TRAIGA)

State law that goes into effect January 1st, 2026

regulates AI to focus on transparency and prevent harmful applications

must disclose that interaction is happening with AI system

(Freedman, 2025)

https://capitol.texas.gov/tlodocs/89R/billtext/pdf/HB00149I.pdf

# data[].attributes.body
§§32.151-32.153 - Texas Student Privacy Act

State statute protecting student data from online programs used for educational purposes

Restricts use and disclosure of data

Must have implemented security measures

(HG.org, 2017)

https://capitol.texas.gov/tlodocs/88R/billtext/html/SB00928I.htm

20 U.S.C. § 1232g - Family Educational Rights and Privacy Act (FERPA)

administrative law in place to protect student education records

Law applies to educational institutions

Explains parent and student rights regarding access to information

Parents and students legally have a right to view their records

Proper disclosure of information

Must be followed by institutions receiving federal funding

(20 U.S. Code § 1232g - Family Educational and Privacy Rights, n.d.)

https://www.law.cornell.edu/uscode/text/20/1232g

# data[].attributes.attachment_link.readable_text
Amendments

2013-Subsec. (b)(1)(L). Pub. L. 112-278, § 2(1), added subpar. (L).

Subsec. (b)(2)(B). Pub. L. 112-278, § 2(2), inserted ", except when a parent is a party to a court proceeding involving child abuse and neglect (as defined in section 3 of the Child Abuse Prevention and Treatment Act ( 42 U.S.C. 5101 note)) or dependency matters, and the order is issued in the context of that proceeding, additional notice to the parent by the educational agency or institution is not required" after "educational institution or agency".

2010-Subsec. (b)(1)(K). Pub. L. 111-296, which directed that par. (1) be amended by adding subpar. (K) "at the end", was executed by adding subpar. (K) after subpar. (J), to reflect the probable intent of Congress.

2002-Subsec. (a)(1)(B). Pub. L. 107-110, § 1062(3)(A), realigned margins.

Subsec. (b)(1). Pub. L. 107-110, § 1062(3)(C), substituted "subparagraph (E)" for "clause (E)" in concluding provisions.

Subsec. (b)(1)(J). Pub. L. 107-110, § 1062(3)(B), realigned margins.

Subsec. (b)(7). Pub. L. 107-110, § 1062(3)(D), realigned margins.

2001-Subsec. (j). Pub. L. 107-56 added subsec. (j).

2000-Subsec. (b)(7). Pub. L. 106-386 added par. (7).

1998-Subsec. (b)(1)(C). Pub. L. 105-244, § 951(1), amended subpar. (C) generally. Prior to amendment, subpar. (C) read as follows: "authorized representatives of (i) the Comptroller General of the United States, (ii) the Secretary, or (iii) State educational authorities, under the conditions set forth in paragraph (3) of this subsection;".

Subsec. (b)(6). Pub. L. 105-244, § 951(2), designated existing provisions as subpar. (A), substituted "or a nonforcible sex offense, the final results" for "the results", substituted "such crime or offense" for "such crime" in two places, and added subpars. (B) and (C).

Subsec. (i). Pub. L. 105-244, § 952, added subsec. (i).

1994-Subsec. (a)(1)(B). Pub. L. 103-382, § 249(1)(A)(ii), added subpar. (B). Former subpar. (B) redesignated (C).

Subsec. (a)(1)(C). Pub. L. 103-382, § 249(1)(A)(i), (iii), redesignated subpar. (B) as (C) and substituted "subparagraph (D)" for "subparagraph (C)" in cl. (iii). Former subpar. (C) redesignated (D).

Subsec. (a)(1)(D). Pub. L. 103-382, § 249(1)(A)(i), (iv), redesignated subpar. (C) as (D) and substituted "subparagraph (C)" for "subparagraph (B)".

Subsec. (a)(2). Pub. L. 103-382, § 249(1)(B), substituted "privacy rights" for "privacy or other rights".

Subsec. (a)(4)(B)(ii). Pub. L. 103-382, § 261(h)(1), substituted semicolon for period at end.

Subsec. (b)(1)(A). Pub. L. 103-382, § 249(2)(A)(i), inserted before semicolon ", including the educational interests of the child for whom consent would otherwise be required".

Subsec. (b)(1)(C). Pub. L. 103-382, § 261(h)(2)(A), substituted "or (iii)" for "(iii) an administrative head of an education agency (as defined in section 1221e-3(c) of this title), or (iv)".

Subsec. (b)(1)(E). Pub. L. 103-382, § 249(2)(A)(ii), amended subpar. (E) generally. Prior to amendment, subpar. (E) read as follows: "State and local officials or authorities to whom such information is specifically required to be reported or disclosed pursuant to State statute adopted prior to ;".

Subsec. (b)(1)(H). Pub. L. 103-382, § 261(h)(2)(B), substituted "the Internal Revenue Code of 1986" for "the Internal Revenue Code of 1954 ", which for purposes of codification was translated as "title 26" thus requiring no change in text.

Subsec. (b)(1)(J). Pub. L. 103-382, § 249(2)(A)(iii) -(v), added subpar. (J).

Subsec. (b)(2). Pub. L. 103-382, § 249(2)(B)(i), which directed amendment of matter preceding subpar. (A) by substituting ", unless-" for the period, was executed by substituting a comma for the period before "unless-" to reflect the probable intent of Congress.

Subsec. (b)(2)(B). Pub. L. 103-382, § 249(2)(B)(ii), inserted "except as provided in paragraph (1)(J)," before "such information".

Subsec. (b)(3). Pub. L. 103-382, § 261(h)(2)(C), substituted "or (C)" for "(C) an administrative head of an education agency or (D)" and "education programs" for "education program".

Subsec. (b)(4). Pub. L. 103-382, § 249(2)(C), inserted at end "If a third party outside the educational agency or institution permits access to information in violation of paragraph (2)(A), or fails to destroy information in violation of paragraph (1)(F), the educational agency or institution shall be prohibited from permitting access to information from education records to that third party for a period of not less than five years."

Subsec. (c). Pub. L. 103-382, § 249(3), substituted "Not later than 240 days after , the Secretary shall adopt appropriate regulations or procedures, or identify existing regulations or procedures, which" for "The Secretary shall adopt appropriate regulations to".

Subsec. (d). Pub. L. 103-382, § 261(h)(3), inserted a comma after "education".

Subsec. (e). Pub. L. 103-382, § 249(4), inserted "effectively" before "informs".

Subsec. (f). Pub. L. 103-382, § 261(h)(4), struck out ", or an administrative head of an education agency," after "The Secretary" and substituted "enforce this section" for "enforce provisions of this section", "in accordance with" for "according to the provisions of", and "comply with this section" for "comply with the provisions of this section".

Subsec. (g). Pub. L. 103-382, § 261(h)(5), struck out "of Health, Education, and Welfare" after "the Department" and "the provisions of" after "adjudicating violations of".

Subsec. (h). Pub. L. 103-382, § 249(5), added subsec. (h).

1992-Subsec. (a)(4)(B)(ii). Pub. L. 102-325 amended cl. (ii) generally. Prior to amendment, cl. (ii) read as follows: "if the personnel of a law enforcement unit do not have access to education records under subsection (b)(1) of this section, the records and documents of such law enforcement unit which (I) are kept apart from records described in subparagraph (A), (II) are maintained solely for law enforcement purposes, and (III) are not made available to persons other than law enforcement officials of the same jurisdiction;".

1990-Subsec. (b)(6). Pub. L. 101-542 added par. (6).

1979-Subsec. (b)(5). Pub. L. 96-46 added par. (5).

1974-Subsec. (a)(1). Pub. L. 93-568, § 2(a)(1)(A)-(C), (2)(A)-(C), (3), designated existing par. (1) as subpar. (A), substituted reference to educational agencies and institutions for reference to state or local educational agencies, institutions of higher education, community colleges, schools, agencies offering preschool programs, and other educational institutions, substituted the generic term education records for the enumeration of such records, and extended the right to inspect and review such records to parents of children who have been in attendance, and added subpars. (B) and (C).

Subsec. (a)(2). Pub. L. 93-568, § 2(a)(4), substituted provisions making the availability of funds to educational agencies and institutions conditional on the granting of an opportunity for a hearing to parents of students who are or have been in attendance at such institution or agency to challenge the contents of the student's education records for provisions granting the parents an opportunity for such hearing, and inserted provisions authorizing insertion into the records a written explanation of the parents respecting the content of such records.

Subsec. (a)(3) to (6). Pub. L. 93-568, § 2(a)(1)(G), (2)(F), (5), added pars. (3) to (6).

Subsec. (b)(1). Pub. L. 93-568, § 2(a)(1)(D), (2)(D), (6), (8)(A)-(C), (10)(A), in provisions preceding subpar. (A), substituted "educational agency or institution which has a policy of permitting the release of education records (or personally identifiable information contained therein other than directory information, as defined in paragraph (5) of subsection (a))" for "state or local educational agency, any institution of higher education, any community college, any school, agency offering a preschool program, or any other educational institution which has a policy or practice of permitting the release of personally identifiable records or files (or personal information contained therein)", in subpar. (A), substituted "educational agency, who have been determined by such agency or institution to have" for "educational agency who have", in subpar. (B), substituted "the student seeks or intends to" for "the student intends to", in subpar. (C), substituted reference to "section 408(c)" for reference to "section 409 of this Act" which for purposes of codification has been translated as " section 1221e-3(c) of this title ", and added subpars. (E) to (I).

Subsec. (b)(2). Pub. L. 93-568, § 2(a)(1)(E), (2)(E), substituted "educational agency or institution which has a policy or practice of releasing, or providing access to, any personally identifiable information in education records other than directory information, or as is permitted under paragraph (1) of this subsection" for "state or local educational agency, any institution of higher education, any community college, any school, agency offering a preschool program, or any other educational institution which has a policy or practice of furnishing, in any form, any personally identifiable information contained in personal school records, to any persons other than those listed in subsection (b)(1) of this section".

Subsec. (b)(3). Pub. L. 93-568, § 2(a)(8)(D), substituted "information is specifically authorized by Federal law, any data collected by such officials shall be protected in a manner which will not permit the personal identification of students and their parents by other than those officials, and such personally identifiable data shall be destroyed when no longer needed for such audit, evaluation, and enforcement of Federal legal requirements" for "data is specifically authorized by Federal law, any data collected by such officials with respect to individual students shall not include information (including social security numbers) which would permit the personal identification of such students or their parents after the data so obtained has been collected".

Subsec. (b)(4). Pub. L. 93-568, § 2(a)(9), substituted provisions that each educational agency or institution maintain a record, kept with the education records of each student, indicating individuals, agencies, or organizations who obtained access to the student's record and the legitimate interest in obtaining such information, that such record of access shall be available only to parents, school officials, and their assistants having responsibility for the custody of such records, and as a means of auditing the operation of the system, for provisions that with respect to subsecs. (c)(1), (c)(2), and (c)(3) of this section, all persons, agencies, or organizations desiring access to the records of a student shall be required to sign forms to be kept with the records of the student, but only for inspection by the parents or the student, indicating specifically the legitimate educational or other interest of the person seeking such information, and that the form shall be available to parents and school officials having responsibility for record maintenance as a means of auditing the operation of the system.

Subsec. (e). Pub. L. 93-568, § 2(a)(1)(F), substituted "to any educational agency or institution unless such agency or institution" for "unless the recipient of such funds".

Subsec. (g). Pub. L. 93-568, § 2(a)(7), (10)(B), struck out reference to sections 1232c and 1232f of this title and inserted provisions that except for the conduct of hearings, none of the functions of the Secretary under this section shall be carried out in any of the regional offices of such Department.

# data[].attributes.attachment_link.title
20 U.S. Code § 1232g - Family educational and privacy rights

# data[].attributes.attachment_link.description
Amendments 2013-Subsec. (b)(1)(L). Pub. L. 112-278, § 2(1), added subpar. (L). Subsec. (b)(2)(B). Pub. L. 112-278, § 2(2), inserted ", except when a parent is a party to a court proceeding involving child abuse and neglect (as defined in section 3 of the Child Abuse Prevention and Treatment Act ( 42 U.S.C.

# data[].attributes.body
Dinerstein vs Google

Transactions allowed AI data mining companies to obtain and distribute medical files

showed an increased risk associated with data collection using AI and and algorithms that violate other laws

(Johnston, 2020)

https://caselaw.findlaw.com/court/us-dis-crt-n-d-ill-eas-div/2085390.html

# data[].attributes.body
Public Law 104-191 - Health Insurance Portability and Accountability Act of 1996 (HIPAA)

sets national standards for protecting information

gives individuals rights regarding their information

HIPAA assists in managing data similar to FERPA with students and data can be collected through AI

(U.S. Department of Health and Human Services, 2022)

https://www.govinfo.gov/content/pkg/PLAW-104publ191/pdf/PLAW-104publ191.pdf

# data[].attributes.body
20 U.S.C. § 1232g - FERPA

Policy for Taliaferro County Schools in Crawford, Georgia

Provides outline for acceptable and unacceptable uses of AI in the school system

States that AI programs must not collect or store student data without clear consent for educational purposes

Use of AI programs must not violate FERPA or COPPA

AI should not be used under bias

(AI Policy, n.d.)

https://www.taliaferro.k12.ga.us/AIPOLICY

# data[].attributes.body
19 Tex. Admin. Code § 247.2 - Code of Ethics and Standard

Practices for Texas Educators. (n.d.). LII / Legal

Information Institute.

https://www.law.cornell.edu/regulations/texas/19-Tex-

Admin-Code-SS-247-2

‌

20 U.S. Code § 1232g - Family educational and privacy

rights. (n.d.). LII / Legal Information Institute.

https://www.law.cornell.edu/uscode/text/20/1232g

AI Policy. (n.d.). Www.taliaferro.k12.Ga.us.

https://www.taliaferro.k12.ga.us/AIPOLICY

‌

‌eCFR. (2013, January 17). Federal Register :: Request

Access. Unblock.federalregister.gov.

https://www.ecfr.gov/current/title-16/chapter-

I/subchapter-C/part-312

‌

Freedman, L. F. (2025). Texas AI Governance Law Signed

by Governor. Natlawreview.com; National Law Review.

https://natlawreview.com/article/texas-ai-governance-

law-signed-governor

‌

HG.org. (2017). The Student Privacy Act in Texas - HG.org.

Hg.org. https://www.hg.org/legal-articles/the-student-

privacy-act-in-texas-45366

‌

Johnston, L. (2020, April 20). Recent Cases Highlight

Growing Conflict Between AI and Data Privacy.

Www.haynesboone.com.

https://www.haynesboone.com/news/publications/recent-

cases-highlight-growing-conflict-between-ai-and-data-

privacy

‌

Pixeld. (2024, April 18). Data Privacy in Schools - Best

Practices for Managing Student Information -

NetStrategy. NetStrategy.

https://www.netstrategy.net/data-privacy-in-schools-

best-practices-for-managing-student-information/

‌

Student Privacy Policy Office. (2024). U.S.

Department of Education.

https://www.ed.gov/about/ed-

offices/opepd/student-privacy-policy-

office

Texas Education Agency. (2020, June 5). Welcome and

Overview. Tea.texas.gov. https://tea.texas.gov/about-

tea/welcome-and-overview

‌

U.S. Department of Health and Human Services. (2022,

January 19). Your rights under HIPAA. HHS.gov.

https://www.hhs.gov/hipaa/for-individuals/guidance-

materials-for-consumers/index.html

‌

U.S. Department of Justice. (2015, August 6). Title Ix of the

Education Amendments of 1972. Justice.gov.

https://www.justice.gov/crt/title-ix-education-

amendments-1972

‌

‌

# data[].attributes.body
Training for teachers and other staff that focus on student privacy and what to be aware of if planning to implement AI programs

Create a safe use programs list that have been verified to protect students privacy

Establish a plan of action if a student inadvertently gave a program access to information without fulling understanding the implications

(Pixeld, 2024)

These strategies are important in the protection of student data as teachers that implement online programs know what to look for when planning lesson using online programs. The IT department along with teachers and administration can create an approved list of online programs that have policies that work to protect data. This helps teachers identify programs that are safe to use. Having a plan of action works to protect the students private information from falling into the wrong hands by informing the proper legal council, parent, and taking action immediately.

# data[].attributes.body
§247.2. Code of Ethics and Standard Practices for Texas Educators

(1) Professional Ethical Conduct, Practices and Performance.

(G) Standard 1.7. The educator shall comply with state regulations, written local school board policies, and other state and federal laws.

(19 TAC § 247.2)

https://www.law.cornell.edu/regulations/texas/19-Tex-Admin-Code-SS-247-2

This code for educators relates to student privacy and AI data collection as any local policy for protection of student data must follow the regulations outlined in FERPA. An educator complying with their local policy to protect their students' information they are also complying with FERPA.

# data[].attributes.attachment_link.title
19 Tex. Admin. Code § 247.2 - Code of Ethics and Standard Practices for Texas Educators

# data[].attributes.attachment_link.description
19 Tex. Admin. Code § 247.2 - Code of Ethics and Standard Practices for Texas Educators

# data[].attributes.body
Ensure proper training of all staff that will be handling student information

Develop emergency protocol if student information were to be accidentally released

Have IT departments assist in creation of appropriate AI programs list that have been verified to protect data

Confirm that documentation has been received from parents to verify their understanding of student data privacy and directory information

Read privacy policies of websites and programs that use AI to verify no collection of data

Always get permission and check documentation when handling student data