Consent and Student Data in Education Apps
A teacher finds a great app on Friday and a class is using it on Monday. Multiply that by a district and you get hundreds of tools holding student names, work, voice recordings, and behavior data, many never reviewed by anyone with privacy in their job title.
This guide is for the adults in that chain: what consent means when the users are children, the questions a school or parent should ask before an app reaches students, and the red lines that should end the evaluation immediately.
Who actually consents for classroom tools
Children generally cannot provide legal consent themselves, and classroom use is not optional for the student, which makes the familiar banner model meaningless. Instead, schools authorize tools under their educational mandate and applicable student privacy laws, and parents receive notice and, in many frameworks, rights to inspect and delete records. That shifts the burden to procurement: the review before adoption is where privacy is decided. Districts that maintain an approved app list with a real vetting process prevent more harm than any policy teachers are asked to enforce app by app.
Data minimization is the core test
Ask what the app collects and grade every item against the lesson. A spelling app needs student responses; it does not need precise location, contacts, advertising identifiers, or indefinite voice recordings. Accounts should use the minimum identity possible, ideally district single sign on with pseudonymous profiles where the pedagogy allows. Retention needs a number: data deleted at term end or within a set period after last use, with the deletion confirmed, not described as happening eventually. Vendors who cannot answer minimization questions crisply have not done the work.
Red lines that end the evaluation
Some practices should disqualify a school tool outright: behavioral advertising to students, selling or renting student data, building profiles for non educational purposes, training general AI models on student work without explicit district agreement, and requiring students to accept consumer terms of service that contradict the school agreement. Also treat vague security answers as a red line; student records breaches are routine news, and encryption, access controls, and breach notification timelines are basic questions with right answers.
What parents and teachers can do practically
Parents can ask the school for its approved app list, the data agreement in place for each tool, and how to request their child records or deletion; these are reasonable questions with established answers in well run districts. Teachers can route new tools through the review process even when it is slow, use district accounts rather than personal ones, and avoid uploading class lists or grades to unvetted services. The culture goal is modest: make the reviewed path the easy path, because workarounds, not malice, are how unvetted apps spread.
Related reading
These earlier guides cover connected questions in more depth: Consent in Connected Cars: Infotainment, Apps, and Driver Data, Consent by Voice: What Smart Speakers Record and Who Agrees to It, and Consent on a Wrist: Smartwatch Data, Companion Apps, and Choices Too Big for the Screen.
Frequently asked questions
Can a school app train AI models on student work?
Only if the agreement with the school explicitly says so and the use is lawful for children data in that jurisdiction. Silent training on student submissions, discovered later in updated terms, is one of the fastest ways for a vendor to lose district trust and contracts.
What should a data agreement between a school and an app include?
The essentials: data collected and purposes, a ban on advertising and sale, security standards, sub-processor disclosure, retention and deletion timelines, breach notification duties, and return or destruction of data at contract end. Many districts use standard agreements so vendors sign the school terms, not the reverse.
Do homework apps used at home follow the same rules?
If the school directs the use, its agreement and student privacy obligations generally follow the tool home. Truly optional parent chosen apps are consumer products, where parents should apply the same minimization questions and check the child privacy policy directly.
How long should apps keep student data?
No longer than the educational purpose requires. Common practice is deletion at the end of the school relationship or within a defined window after inactivity, with backups expiring on a stated cycle. Indefinite retention for product improvement is not an educational purpose.