Reply To: Safe AI Tools for K–12 That Respect COPPA and FERPA — Recommendations & What to Look For

Short and practical — you don’t need a committee to start protecting students. Start with a two-step mindset: control the contract, then test in the classroom. Small, repeatable checks stop most COPPA/FERPA problems and let useful AI tools stay in play.

What you’ll need

• A simple inventory sheet (tool name, owner, account type: school-managed or personal).
• A one-page vendor questionnaire you can email in one click (privacy, retention, training use, DPA willingness).
• A short DPA checklist (no model-training on student data, retention window, deletion on request, breach notification).
• Teacher pilot plan: 2–4 week scope, supervision checklist, incident log template.
• A named decision owner with authority to pause or approve a tool.

7-day micro-workflow (do this now)

1. Day 1: Create the inventory and assign an owner for each tool (aim for 2 hours).
2. Day 2: Send the one-page questionnaire to vendors; set a 7-day reply window and flag non-responders.
3. Day 3–4: Score returned answers as Low/Medium/High risk using simple rules (High = PII + model-training or indefinite retention).
4. Day 5: Pause any High-risk tools and notify teachers; document reasons in the inventory.
5. Day 6–7: Pick one Low-risk tool and schedule a 2–4 week pilot with one teacher and the incident log ready.

How to run a clean 2-week pilot (what to do and expect)

1. Define scope: which class, what tasks, what student data (preferably none or anonymized).
2. Supervision: teacher uses the tool live in class; no student accounts without school-managed email.
3. Log incidents: anything unexpected, privacy concern, or technical problem goes into the incident log within 24 hours.
4. Review: after 2 weeks, owner, teacher, and IT review logs and vendor answers; decide to approve, negotiate DPA terms, or stop.

Immediate red flags — pause the tool if you see any:

• Vendor refuses to sign a DPA or declines to confirm they won’t use student data to train models.
• Indefinite data retention with no deletion-on-request process.
• Requirement for personal/parent contact details or home addresses.

What to expect after action

• Within 30 days: inventory complete, vendors queried, clear list of high-risk tools paused.
• Within 60 days: 1–3 pilots completed, DPAs negotiated for acceptable vendors.
• Within 90 days: updated policy, staff trained, and a small set of approved tools in monitored use.

Start with one vendor question this week: ask whether they use student data to train models and if they will sign a DPA that forbids it. That single ask will cut your risk fast.