The Case for Making EdTech Companies Liable Under FERPA

The Case for Making EdTech Companies Liable Under FERPA reports that schools now rely on an average of 2,591 edtech tools in a single school year, tools that can track private conversations and store comprehensive academic and personal records.

It notes that many edtech companies do not clearly disclose how they collect and use student information, with one nonprofit claiming that 96% of apps used in schools share student data with third parties such as advertising entities, often without parental or student consent and potentially breaching FERPA.

The piece explains FERPA requires educational institutions that receive federal funding, and third parties with whom they share student data, to protect privacy and obtain parental or student consent before releasing records. It states that the Department of Education is solely responsible for enforcing FERPA, and, given the department’s impending closure and the rising use of student data by vendors, Congress should amend FERPA to hold vendors directly responsible for compliance, rather than schools. According to TechPolicy[.]Press, these arguments framing vendor liability are central to the debate. Published on 11 November 2025.