> For the complete documentation index, see [llms.txt](https://docs.layerlens.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.layerlens.ai/more-in-this-section-2/compliance.md). # Education and EdTech compliance Education AI compliance braids **federal student-record law (FERPA) + child-data law (COPPA) + civil rights statutes + state student-data laws + accessibility law**. Stakes are high because student trajectories are at issue and regulators (OCR, FTC, state AGs) are active. ## Regulatory frame | Regime | Applies when | Evaluation-evidence shape | | ------------------------------------ | ----------------------------------------------- | ------------------------------------------------------------------ | | **FERPA (20 USC § 1232g)** | Schools/agencies receiving DOE funds | School official exception evidence; consent/notice; records access | | **PPRA** | Surveys / behavioral data of minors | Notice, parental consent for protected categories | | **COPPA (15 USC § 6501)** | Online services likely used by under-13 | Parental consent, data minimization, retention limits | | **IDEA / Section 504 / ADA** | Students with disabilities | Accommodation accuracy, accessible delivery | | **Title VI** | Federally-funded programs | Disparate impact monitoring | | **Title IX** | Sex discrimination in federally-funded programs | Bias audit on grading and admissions | | **State student-data privacy laws** | Varies by state — most states now have one | Specific notice/consent/data-localization rules | | **State AI laws** | E.g., NY Education Law § 2-d, CA AB 2273 | Per-state requirements | | **Department of Education guidance** | Federal funded programs | Reasonable use of AI evidence | | **OCR enforcement** | Federally-funded programs | Investigation cooperation; corrective action plans | | **GDPR / UK GDPR** | EU/UK students | Lawful basis; DPA; transfer mechanism | ## FERPA 20 USC § 1232g, 34 CFR Part 99. Core requirements: * Schools may disclose education records only with parent/eligible-student consent or under exceptions * **School official exception** — most common AI-vendor pathway; vendor must perform institutional service, be under direct control, and use records only for authorized purpose * Records access rights for parents/eligible students * Limited directory information disclosure with notice/opt-out **Stratix evaluation evidence:** * DPA executable as a school-official-exception agreement * Audit trail of who accessed which records * Tenant isolation — one school's records never touch another's ## COPPA For services likely used by children under 13: * Verifiable parental consent before collecting * Limited data; no behavioral targeting against under-13 * Strict retention and deletion * FTC has specifically called out AI services that train on under-13 data **Stratix evaluation evidence:** * Hard age-band gate * Audit log of consent state at the time of trace * No training on tenant data without consent (enterprise contractual term) ## IDEA / Section 504 / ADA For students with disabilities: * **IDEA** — IEP-based services; AI tools must support, not replace, IEP-required services * **Section 504** — accommodations for substantially limiting impairments * **ADA Title II** (public schools) and **Title III** (private schools / EdTech vendors) — accessible delivery **Stratix evaluation evidence:** * Accessibility scoring on AI outputs (reading level, alt-text, captioning WER) * Accommodation-database matching as code assertion * Audit trail of accommodation delivery ## Title VI / Title IX Federal civil rights statutes: * Disparate impact on protected class triggers OCR investigation * AI grading, AI integrity-detection, AI admissions all currently in OCR scrutiny * Settlement consent decrees include monitoring and retraining obligations **Stratix evaluation evidence:** * Group-fairness scorers per scenario * Audit-trail per evaluation showing the decision basis * Retention to support OCR investigation timelines ## State student-data privacy laws Most US states have at least one. Notable examples: * **NY Education Law § 2-d** — strict vendor data agreement requirements; "Bill of Rights" * **CA Student Online Personal Information Protection Act (SOPIPA)** * **CT, IL, CO, FL, KY, NC, TX, UT** — varying flavors Many require: * Specific data-handling notices to parents * No targeted advertising to students * No selling student data * Specific deletion / retention rules * Per-vendor public agreement registry **Stratix evaluation evidence:** * Per-state DPA addenda available under Enterprise tier * Tenant isolation with state-specific configuration * Audit retention matching state requirements ## State AI in education laws Emerging: * **NY** — guidance on AI in K-12 (2024-2025) * **CA** — multiple bills around AI literacy and disclosure * **TX, FL, OH, others** — proposed and adopted bills around AI assessment, integrity Track state-by-state; defaults below cover most current frameworks. ## US Department of Education guidance ED has issued non-binding guidance on AI in education (2023-2024) including: * "Designing for Education with AI" report * Guidance on AI accessibility * Cybersecurity advisories for AI-enabled services Treat as non-binding-but-influential — many state and district policies cite ED. ## OCR enforcement US Education Department Office for Civil Rights investigates Title VI / Title IX / Section 504 / ADA / IDEA complaints. Recent focus areas: * AI-detection bias against non-native English writers * Accessibility of AI-generated content * Disparate-impact investigations on AI grading **Stratix evaluation evidence supports OCR cooperation:** * Pull-on-demand fairness reports * Audit trail of AI-influenced student outcomes ## GDPR / UK GDPR For EU/UK students: * Lawful basis (consent or legitimate interest, with care) * DPIA for high-risk AI use * Cross-border transfer mechanism * DPA with the institution ## Recommended setup 1. Pro tier minimum; Enterprise for large districts and university systems 2. SSO + RBAC scoped to district / school / class / role 3. DPA executable as FERPA school-official-exception 4. State-specific DPA addenda for NY § 2-d and similar 5. Hard rules: instructor-final-decision on grading, age-band gating, accommodation match 6. Group fairness scorers on all student-affecting AI 7. Accessibility scoring on every student-facing output 8. Audit retention matching the longest applicable state requirement (default 5 years post-graduation) 9. No training on tenant data without explicit consent 10. BYOK custom models for the most sensitive student data ## See also * [Education scenarios](/more-in-this-section-2/scenarios.md) * [Education eval patterns](/more-in-this-section-2/eval-patterns.md) * [Concept: Multi-tenancy](/7.-observe-see-whats-happening/multi-tenancy.md) * [Enterprise](/4.2-industry-use-cases/education.md) * [BYOK custom models](/5.-select-pick-the-model/byok-custom-models.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.layerlens.ai/more-in-this-section-2/compliance.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.