FERPA Student Privacy Gate
9 of 17 data elements have findings (28 findings, 21 high severity); most common: recipient outside the district's direct control, verifiable parental consent needed (COPPA) and no legitimate educational interest.
The educational purposes are 'Assessment', 'progress reports to teachers'; 'product improvement' is product development, a use beyond the purpose of the disclosure (99.33(a)).
Method1FERPA school official exception (34 CFR 99.31(a)(1)(i)(B)): each element needs an educational purpose, must stay under the district's direct control, and may be used only for the purpose of the disclosure (99.33(a)).
2Purposes are read from the text: instruction, assessment, rostering, login, support and similar are educational; product development and research are secondary; advertising, marketing, profiling and sale are commercial.
| Field | Category | Rule |
|---|---|---|
| Reading assessment scores | Education record | Use beyond the authorized purpose |
| Reading assessment scores | Education record | Retention beyond the DPA limit |
| Parent email address | PII | Targeted advertising or marketing |
Data inventory of fields collected, purposes and recipients
Field-level findings and a DPA exhibit draft (DPA exhibit draft (Schedule of Data), Schedule of data (CSV), Field-level findings (CSV))
$2,500 / month, 30% to the referring partner
Read in memory for the session, never stored, never used to train a model.
Privacy and security findings are not legal advice or an audit opinion. Confirm them with privacy counsel or a qualified assessor. Letters, notices and legal analysis are drafts, not legal advice. Have a qualified lawyer review them before they are sent or relied on.