What Does “Protected Student Data” Mean for Your Child’s School Account?
On a school laptop, your child can go from a Classroom assignment to YouTube under the same login, if the school has turned YouTube on. The two run on different privacy rules. Then a permission form for a new AI tool comes home saying student data is protected.
The promise is probably accurate. It just skips the parts you can act on, like which of your child’s accounts it covers, what the school switched on and who to ask when you want something deleted.
Those details live in contracts and admin settings that parents don’t usually see. Two teachers’ unions and Microsoft put many of those details in writing in September 2026. Google sets out its own rules for school accounts in a separate privacy notice.
A promise that lives in a contract
On September 9, 2026, the American Federation of Teachers, the United Federation of Teachers and Microsoft announced a National AI Safety & Privacy Standard for schools. The full standard is a memorandum of agreement that AI companies sign. Its protections don’t reach a school district automatically. The district has to ask for them and add them to its existing privacy or licensing agreement with the provider, and from that point the district can enforce the terms.
Microsoft is the only company whose signature appears on the published standard. The company says it’s making the protections available to every US school district from November 1, 2026.
Four terms speak to parents directly. Student data can’t be used to train AI models, apart from a narrow safety and security exception for things like spotting threats of violence. It can’t be sold or used for ads, either. Once a district starts a deletion, the provider has 180 days to remove the data from its active systems. Providers also have 90 days from the agreement taking effect to publish a plain-language guide for families.
School logins and home logins follow different rules
The standard only reaches generative AI tools “primarily designed and marketed” for students, educators and administrators. They also have to be used through a login under a school agreement. If a tool is ordinary office, messaging or search software, the standard leaves it out unless the product was built mainly for education. So a word processor your child opens with a school email address can sit outside the new terms, even though Microsoft signed them.
Google’s own terms draw a similar line inside a single school account. Under the Google Workspace for Education privacy notice, last updated August 13, 2026, Core Services such as Gmail, Classroom, Drive and Gemini for Education follow the school’s instructions and show no ads. Search, Maps and YouTube count as Additional Services. Those run under Google’s general privacy policy, even when your child opens them with the same school login.
Some Additional Services do show ads. Google’s notice says K-12 users won’t see personalized ones there. Where the education notice and the general policy disagree, the education notice takes precedence, so a school login still carries some protection on services like YouTube.
A personal Gmail account or a family tablet profile is a different case. The standard and Google’s notice are both written around accounts a school issues and manages. For apps on a personal account, SafeSearchKids’ May 2026 guide starts with reading an app’s privacy policy before your child downloads it. Before anything else, find out whether each device your child uses is signed into a school account or a personal one, because that decides which of these sets of terms applies to everything they open.
Figure 1. On one school login, Classroom falls under the school’s contract with Google while YouTube falls under Google’s general privacy policy. A personal login brings each app’s own terms.
What did the school switch on?
Coverage also depends on settings chosen in an admin console most parents won’t ever open. Google’s notice lets school admins decide which Core and Additional Services students can reach. It’s the admin’s job, too, to get parental consent for any Additional Service they turn on. If YouTube works on your child’s school account, the school should have asked for your consent.
Memory is the setting to ask about. The standard gives students three controls over what it calls Memory Files, the details a tool saves from earlier chats. They’re named “See it,” “Erase it” and “Turn it off,” which a ten-year-old could follow. Viewing the saved details has to be possible “in plain language, at any time,” in the standard’s words. For a younger child, a parent can use the controls through the district.
SafeSearchKids’ guide to student data privacy tells teachers to follow the school’s approved list and to get approval before asking students to use a new program or website. That approval step means a staff member has probably looked at the tool before your child did. Ask your child’s teacher what’s switched on.
Questions about access and deletion go through the school
For children under 13, the Federal Trade Commission’s COPPA guidance lets a school consent on a parent’s behalf only when the data is used for the school and for no other commercial purpose. In that setup, it’s the provider’s job to let the school review and delete a child’s information when the school asks. The FTC also suggests schools consider letting parents review it. Google points families the same way. Its notice tells parents to “contact your school admin” with questions about how a child’s account is managed.
Under FERPA, the federal student privacy law, parents can also ask the school to see their child’s education records.
Timing depends on who sends the request. Under the new standard, the 180-day deletion clock starts when the district tells the provider to delete, and backups get the same window. That’s only true where your district has adopted the standard and the tool’s covered. Your own email won’t start the clock until the district passes it on.
Start with the school or district, not the company. The standard has each district work out how families send data requests and then tell them, so its privacy or technology contact should know the route even when the request goes on to the company. Put the tool’s name and the account in your first line, so nobody has to write back to ask which one you mean.
Before you sign the next AI permission form
If your school can tell you which login the tool uses and who handles data requests, you’ve got what the promise was missing. If it can’t name anyone, ask for the district’s privacy contact before you sign. You can still opt out after that. Asking first just means your child isn’t stuck doing an assignment without the tool the rest of the class has.
Keep your note to the school short. Two or three questions like these will do:
- Is the tool’s memory switched on, and can we clear it?
- Does the tool run on our child’s school login, or can it be used with a personal account too?
- If we want to see or delete what the tool has saved, who do we write to?
Your child can do one part of this on their own: before typing anything personal into an AI tool, they check which account is signed in. A name like “login first” helps it stick. The account they’re on decides whether the school’s contract covers what they type next, or whether Google’s general policy or some other company’s terms do instead.
About the Author:
Ryan Harris is a copywriter focused on eLearning and the digital transitions going on in the education realm. Before turning to writing full time, Ryan worked for five years as a teacher in Tulsa and then spent six years overseeing product development at many successful Edtech companies, including 2U, EPAM, and NovoEd.


Author bio: Cora Gold is the Editor-in-Chief of women’s lifestyle magazine, 








