A school app can be a homework portal, a bus tracker, or a reading game. It can also ask for a child’s name, student ID, birth date, or Social Security number, and then keep that information long after the assignment is done. You cannot unplug the school’s network. You can ask a short list of questions, and you can refuse the one number that does not belong on a classroom form.
This guide is for parents and guardians in the United States, and for a grandparent or adult child filling out school forms with them. It explains rights the U.S. Department of Education and the Federal Trade Commission have published. It is not legal advice, and it is not a claim that every state follows the same extra rules. State laws can be stricter. The district’s own notice is the paper that applies to your child. Checked September 25, 2026.
Two different piles of information
Some facts live in the child’s education record. The Department of Education says the Family Educational Rights and Privacy Act, FERPA, protects personally identifiable information in those records. Parents have the right to inspect and review the records, to ask that wrong information be corrected, and to have some control over who else sees them. Schools must send an annual notice of those rights. When a student turns 18, or starts college at any age, those rights move to the student. The Department calls that person an eligible student.
Other facts are what the child types into an app that is not part of the school record at all: a game they downloaded at home, a social account, a shared photo album. FERPA does not run those. Phone controls do. Those guides are iPhone Screen Time and Google Family Link.
The messy middle is an app the school tells you to use. A login for grades, a reading program, a video class. The Department of Education says a teacher who wants to use an online tool should first check whether the district has approved it. You can ask the same question.
What the school is allowed to share without asking you first
FERPA usually requires written consent before the school shares personally identifiable information from education records. There are exceptions. Two matter for apps.
Directory information is the exception families trip over. The Department’s guidance says students do not attend school anonymously, and that a school may release information it has designated as directory information without consent. Examples the Department has listed include name, address, telephone listing, email address, date and place of birth, photographs, and, for athletes, height and weight. Common uses include a yearbook, a concert program, and a phone directory. Parents have a right to opt out. The opt-out is not automatic. It is on the annual notice. If you do not want a photo or an address treated as public, ask for that form at the start of the year and return it. A verbal “please don’t” in August is weaker than the form.
The school-official exception is how a district gives student data to an app company. The Department says the company must:
- Do a job the school would otherwise do with its own staff
- Be under the school’s direct control for how that information is used and kept
- Use the information in a way that matches the school’s annual FERPA notice and its definition of a school official
- Not disclose the data again, or use it, for a purpose the school did not authorize
A reading app that also wants to advertise to your child, or to train a product on their schoolwork, is a question for the district, not a setting you can flip at home. Ask whether that use is authorized. If the teacher found the app on their own, the Department’s FAQ says they should have checked with the administration and with the school’s technology staff first, because an unapproved app can open a security hole. You can ask whether this one was approved.
Questions worth asking before you type a Social Security number
The FTC’s child-identity-theft guide says that if a school asks for a child’s Social Security number, ask:
- Why do you need it?
- How will you protect it?
- Can you use a different identifier?
- Can you use just the last four digits?
A student ID is enough for most classroom apps. A full Social Security number on a permission slip is a reason to pause. Identity thieves use that number to open accounts and apply for benefits. How to freeze a child’s credit, which is free, is in how to freeze a child’s credit. A freeze does not replace these questions. A form can still leak a number that never touches a credit bureau.
Add these, in ordinary language, when the school assigns an app:
- Is this app on the district’s approved list?
- What student information does it receive, and who at the company can see it?
- Does the company use school data for advertising? The school-official rules say use has to stay inside the job the school authorized.
- How do I see my child’s education records, and who do I email if something in them is wrong?
- Where is this year’s FERPA notice, and where is the directory-information opt-out?
- What should my child do if the app asks for a photo of their face, their location, or access to their contacts? Those are phone permissions. The school portal may not need them.
Ask in writing. A short email is enough. Save the reply with the annual notice. You are not suing anyone. You are making a record of what the district said the app does.
What you can do at home the same week
- Use a school login that is not the child’s personal email, if the district gives one. A school password should not also open TikTok.
- Turn off contact upload, location, and microphone for the app unless a teacher has said that feature is required for class. Check again after an update. Updates turn permissions back on.
- Do not put the child’s Social Security number, full birth date, or home address into a class profile “so the teacher can find them.” The teacher has a roster.
- Sign out of the app on a shared family tablet when homework is done. A shared login mixes siblings and mixes you.
- If a message inside the app asks you to buy a gift card or to call a number to fix the account, that is not the school. Close it and call the school on the number you already have. The gift-card rule is in gift cards are only for gifts.
What to skip
- Do not refuse every app and assume the child can still turn in work. Ask which apps are required and which are optional.
- Do not post the class roster, the bus stop, or a child’s student ID in a parent group chat. That chat is not the school’s secure system.
- Do not sign a consent you do not understand because the form says the child will be locked out of class tomorrow. Ask for one extra day. A real portal will still be there.
Checklist
- You have this year’s FERPA annual notice, or you have asked for it.
- You know whether you opted out of directory information, including photos.
- You asked why any form needs a Social Security number, and you offered a student ID instead.
- Each required app is on the district’s approved list, or you have asked and saved the answer.
- The app does not have location, contacts, or the microphone unless class requires it.
- The school login is not the password for everything else. A household password setup is in a password manager for a household.
What this means for you
A parent’s job is the question list, not a private audit of the district’s servers. You will not get the company’s source code. You should get a yes or no on advertising, a name for who to email about records, and a form to opt out of directory information.
A grandparent raising a child has the same questions. If the school says only a parent can see records, ask what document a guardian should bring. Do not hand over a Social Security card as a shortcut.
An adult child helping from another city can draft the email and let the parent send it from their own address. The reply should go to the person the school already knows.
FAQ
Can the school give an app my child’s grades without asking me?
Sometimes. The Department of Education says schools may share education-record information with a company under the school-official exception if the company does a school job, stays under the school’s control, follows the annual notice, and does not reuse the data for an unauthorized purpose. Ask whether this app meets that test. Do not assume every free classroom tool does.
Can I stop the yearbook from using my child’s photo?
Ask for the directory-information opt-out on the annual FERPA notice. The Department says parents have a right to opt out. The photo may still exist in the school’s own files. Opting out limits the public use the school designated, which is why you want the form, not a guess.
Do my rights end when my child turns 18?
The Department says FERPA rights transfer to the student at 18, or when they enter college at any age. Before that, the rights are the parent’s. After that, the student has to authorize you if you still want access.
Who do I complain to if the school ignores the notice?
The Department says the annual notice must tell parents they can file a complaint with the Student Privacy Policy Office about possible FERPA violations. Start with the district. If you escalate, use the contact on the notice or on studentprivacy.ed.gov, not a third-party site that offers to “file it for a fee.”
Sources
- U.S. Department of Education, Student Privacy Policy Office, “A Parent Guide to the Family Educational Rights and Privacy Act (FERPA),” last updated July 2021, studentprivacy.ed.gov, accessed September 25, 2026.
- U.S. Department of Education, “I want to use an online tool or application as part of my course. However, I am worried that it is a violation of FERPA. What should I do?” studentprivacy.ed.gov FAQ, accessed September 25, 2026.
- U.S. Department of Education, Protecting Student Privacy While Using Online Educational Services, training summary, studentprivacy.ed.gov PDF, accessed September 25, 2026. Used for directory information examples and the school-official exception.
- Federal Trade Commission, “How To Protect Your Child From Identity Theft,” consumer.ftc.gov, accessed September 25, 2026. Used for the four Social Security number questions.
Photo: children at a computer, by jennie, CC BY 3.0, via Wikimedia Commons.
This is not legal advice. FERPA is federal. Your state may add rules. The district’s annual notice controls the local opt-out. If a menu or a form has changed, use the notice and the Department of Education links above.
Update this guide if the Department changes the school-official test, or if the FTC changes its advice on schools collecting Social Security numbers.