FERPA, COPPA and the School Official Consent Model

This is a plain-language explainer, not legal advice. Check specifics with your district counsel or data protection officer before relying on any of it.

A question that stops a lot of school technology purchases cold: "Do we need every parent to sign a consent form before we can use this attendance app?" The intuitive answer is yes. The actual answer, in US schools, is usually no — and understanding why saves a great deal of unnecessary paperwork, while making the real obligations clearer.

Two laws do most of the work here. They are often mentioned in the same breath and they are not the same thing.

FERPA governs the records

FERPA — the Family Educational Rights and Privacy Act — is about education records held by schools that receive federal funding. It gives parents rights over their child's records (and transfers those rights to the student at eighteen), and it restricts when a school can share those records with anyone else.

Attendance records are education records. So when a school hands them to an outside company's software, FERPA is in the room.

The default rule is that disclosing a student's records to a third party needs parental consent. If that were the end of it, no school could use any external system without a mountain of signed forms. But FERPA includes an exception built precisely for this situation.

The "school official" exception, in plain terms

A school can share education records, without separate parental consent, with a third party it has designated as a "school official" with a "legitimate educational interest" — essentially, a vendor doing a job the school would otherwise do in-house.

This is the mechanism that lets a school use an attendance or gradebook platform the way it would use an employee. It is not a loophole; it comes with conditions the school must actually meet:

1. The vendor performs a genuine institutional service — running attendance, for example — that the school would otherwise handle itself.
2. The school keeps control. Direct control over how the vendor uses the data, written into the agreement.
3. Use is limited to that purpose. The vendor may use the records only for the service, not for its own aims, and may not re-disclose them.

In practice this lives in your contract with the vendor, not in a form sent home. The consent model is institutional: the school, acting for the families, designates the provider — provided the provider behaves like an extension of the school and not like a data broker.

Where COPPA comes in

COPPA — the Children's Online Privacy Protection Act — is a different animal. It targets commercial online services that collect personal information from children under thirteen, and it normally requires verifiable parental consent before that collection.

The wrinkle for schools: regulators have accepted that a school can provide consent on parents' behalf when a service is used strictly for an educational purpose and the operator collects data only for that purpose — in effect, standing in for the parent in the classroom context. That permission is narrower than it sounds. It holds only while the data is used for the school's educational ends. The moment a provider wants to use children's information for advertising or its own commercial products, the school's stand-in consent does not stretch to cover it, and real parental consent is back on the table.

So the two laws point the same way: a provider is allowed to behave like part of the school, and only like part of the school.

The questions that actually matter

Because the consent model rests on how the vendor behaves, your due diligence is about the vendor's conduct, not about collecting signatures. Before adopting any tool that touches student data, get clear answers to these:

• Will you use our students' data only to provide this service to us? The answer must be an unambiguous yes.
• Will you ever use it for advertising, or sell it, or build your own products from it? The answer must be no.
• Do you let us see, correct, export and delete our data? FERPA rights only work if the tooling supports them.
• How long do you keep it, and what happens when we leave? Retention and deletion should be defined, not improvised.
• Is each school's data isolated from every other school's? On a shared platform, this is not optional.

If a vendor's business model depends on doing something with student data beyond serving your school, no amount of paperwork makes that a good fit.

The practical upshot

The consent model for ed-tech is less about forms and more about trust properly structured: the school stands in for families, the vendor behaves as an arm of the school, and the contract holds everyone to it. Get the vendor relationship right and the legal basis mostly takes care of itself.

Classable is built to sit on the right side of that line — student data used only to run attendance and grades for your school, isolated per organisation, with export and deletion you control — which is exactly what the school official model assumes of a provider.