Public schools across the United States are rapidly adopting artificial intelligence and digital surveillance tools to monitor students, but outdated privacy laws fail to protect children's data. As districts trade student information for tracking software, weak state and federal regulations leave gaps that expose children to disciplinary risks and security threats.
What Happened
School-issued laptops, tablets, and applications are now standard in classrooms. Today, 89% of U.S. school districts use student activity monitoring software to log keystrokes and search queries on these devices. As we previously reported, school districts often struggle to manage classroom app sprawl, so they grant external vendors broad access to student data.
This widespread sharing is legal under a loophole in the Family Educational Rights and Privacy Act (FERPA). The "school official exception" allows districts to share personally identifiable student records with third-party vendors without parental consent, as long as the vendor performs an institutional service under the school's direct control. Yet security experts warn that a standard data privacy agreement does not guarantee a vendor will limit data collection or practice proper data minimization.
The Bigger Picture
The consequences of unregulated school surveillance are unequal. A Brookings Institution report shows that schools in lower-income areas and districts with larger minority student populations deploy surveillance tools at higher rates.
These automated tools make errors that disrupt students' lives. In Maryland, an AI system flagged a bag of chips as a weapon, and a Baltimore County student was handcuffed by police. In Arizona, a school suspended a student over an unsent draft email flagged and analyzed in their private account outside of school hours.
The technology also threatens student safety and privacy. Automated keyword alerts flag searches for sensitive topics like "gender identity," which can inadvertently out LGBTQ+ youth to administrators and parents without consent. At the same time, the U.S. Department of Education recently removed key disparate-impact regulations from its Title VI enforcement guidelines. Now, school districts and tech vendors cannot be held federally liable for discriminatory outcomes from their AI tools unless someone proves intentional bias.
State laws offer some protections but create a confusing, contradictory legal map. Under Minnesota state law, public school students can request that their educational data be withheld from their parents if a school decides it is in the student's best interest. This conflicts with federal FERPA guidelines, which tie school funding to parents' absolute right to inspect records. Even in states with privacy laws, protections remain narrow. Minnesota's breach notification statute, for instance, excludes sensitive modern data points like precise location coordinates, passwords, and biometric signatures from mandatory notifications.
What This Means for Families
School-issued devices are active monitoring stations. Because federal frameworks do not mandate strict data minimization, any personal information, search history, or deleted draft on a school device can be logged, stored, and shared. These systems often lead to unwarranted discipline. Marginalized students, including those flagged disproportionately by automated algorithms, face the greatest risk.
What You Can Do
- Use school-issued laptops and tablets only for schoolwork. Perform personal searches, identity-related questions, and private communications on family devices equipped with secure browsers.
- Review the agreements your school district makes with tech companies. Parents have a legal right to request these contracts. Ask the school board how they handle the FERPA school official exception and whether they prevent vendors from selling or retaining student profiles.
- Push your local school board to adopt strict data minimization policies. Ask them to require the deletion of web logs and search histories at the end of each school day to prevent long-term tracking.