An American school district evaluating an AI tool is answering a legal question before a pedagogical one. Federal and state student data rules set the boundaries of what is even possible.
Federal records rules define who may see what
Federal law protects student education records and restricts disclosure without parental consent. Districts rely on an exception that allows sharing with parties performing an institutional function under district control.
Fitting a vendor into that exception requires the district to direct the work and retain control of the data. The contract has to say so explicitly, and the vendor must accept those limits.
This is why district AI contracts read as data processing agreements first and product agreements second. The educational features are often described in less detail than the storage terms.
State laws add restrictions on vendor use
Many states have passed student data protection statutes that go beyond the federal baseline. Common provisions prohibit selling student data, restrict advertising uses and require deletion at contract end.
Several states also address using student data to improve a vendor's product. That provision matters directly for AI, since improvement usually means training on collected data.
Vendors respond with contractual commitments not to train on district data. Verifying such a commitment is difficult, which is why districts increasingly rely on shared vendor review consortia rather than reviewing alone.
Age rules constrain younger grades differently
Federal rules on collecting personal information from children under thirteen apply to online services, and schools may provide consent in limited circumstances on parents' behalf.
The scope of that school consent is narrower than many assume, covering educational use rather than any use the operator chooses. Elementary deployments are therefore more constrained than high school ones.
The practical effect is a split within districts, where a tool approved for eleventh grade is unavailable to fourth grade even though the software is identical.
Procurement runs through the board
District purchases above a threshold require board approval at a public meeting, which puts the decision in front of parents and local media.
That visibility changes what administrators propose. Tools that clearly support instruction present better than tools that monitor students, regardless of the merits.
Deletion obligations shape the exit
Contracts usually require the vendor to return or destroy district data when the agreement ends. Districts have to be able to confirm that this happened.
Confirmation is hard when data has been incorporated into derived artifacts. This is a further reason districts insist on no-training clauses at the outset.
Handled properly, the exit terms are what preserve a district's ability to change vendors, which is the only real leverage it has after the first contract is signed.