FERPA Basics
This federal law protects student education records.
What is FERPA?
True or False: FERPA only applies to physical files.
What is false? (digital or electronic records are also included in FERPA compliance)
This is the safest way to use AI for teaching—provide examples, explanations, and general help without using student-specific data.
What is general pedagogical support?
Tools integrated with Canvas, Banner, or Navigate must always go through this evaluation process.
What is an ITAC (IT Advisory Committee) review?
At this point, FERPA rights transfer from the parent to the student.
What is 18 years old OR enrollment in post-secondary education?
True or False: AI is always safe as long as students aren’t named.
What is false? (Context can identify a student.)
AI tools may not use student PII for this purpose, unless explicitly approved via contract.
What is AI model training?
This agreement can transform a vendor into a “school official” with legitimate educational interest.
What is an IT Advisory Committee approved contract?
Information that, alone or in combination, can identify a student.
What is personally identifiable information (PII)?
True or False: Students can be forced to use an external AI tool without alternatives.
What is false?
These AI tools are considered “third-party vendors” under FERPA.
What are external AI systems (e.g., ChatGPT, Gemini, Claude)?
Contracts should prohibit vendors from doing this with student data.
What is training AI models or using data for other customers?
Grades, comments, and feedback are examples of these FERPA-protected items.
What are education records?
True or False: FERPA protects data even when faculty use personal Google/OpenAI accounts.
What is false? (FERPA does not cover personal accounts.)
This must always be offered to students if you require the use of an external AI tool for coursework.
What is an alternative assignment?
This is required before any third-party vendor can access FERPA-protected data.
What is a contract approved by ITAC (IT Advisory Committee)?
Under FERPA, these entities—not AI companies—hold responsibility for protecting student data.
Who are the educational institutions (colleges)?
True or False: Colleges and Universities are ultimately responsible for FERPA compliance.
What is true?
Faculty should never upload student assignments to external AI unless this condition is met.
What is having an IT Advisory Committee approved contract?
Faculty cannot bypass this institutional process, even if a tool is “educational” or “popular.”
What is the IT Advisory Committee review (and contract)?