Questions NYC public school parents should ask schools about their use of ed tech and privacy practices

The NYC Department of Education and public schools are using more than 500 ed tech programs and other apps that collect, process and at times redisclose personal student data in ways that undermine children’s privacy.  We have found that the privacy policies and practices of some of these programs are not fully compliant with the NY State student privacy law passed in 2014, NY Ed Law § 2-d or its regulations.  For more on this issue, see the presentation we gave parents on October 22, 2025.

During that presentation, we also suggested some questions parents should be asking their schools about their use of ed tech products and their impact on privacy.  Parents asked us to put together a list of these questions in written form, which is below.

If your school refuses to answer your questions, or if any the answers concern you, feel free to contact us at info@studentprivacymatters.org  We also have posted a summary of Parent Bill of Privacy Rights here, as laid out in NY Ed Law § 2-d.  This includes the right to file a complaint to the DOE or the State Education Department if you believe your child’s data privacy has been violated.  These questions are also available as a downloadable pdf here.

Questions about opting out of certain data disclosures & to find out which third parties are receiving your child’s personal information

• Ask your school for their Directory Information opt-out form, so you can learn about which non-school vendors will receive your child’s personal data unless you opt out.

• What are the data privacy and security policies for the non-school vendors with whom your school plans to share your child’s Directory Information?

• What are the names of the other ed tech products or organizations that are being provided access to your child’s personal information that you do not have the right to opt out of, whether used by teachers, administrators or students themselves?

• Be sure to request the names of all the products that DOE has told the school to use, as well as those the school has itself chosen to use, that can access, collect or process your child’s personal student data. Also ask which types of data they will be able to access.

• If your school is reluctant to provide this information, remind them that NY Ed Law 2D provides parents with the right to see the data for their child collected by outside agencies, companies, organizations or other third parties. Parents cannot do that unless they know the names of these programs or apps.

• Point out that the federal law COPPA requires parent consent for the use of products that collect personal information directly from children under 13.  If so, has the school asked for your consent, and if not, why not?[1]

• What are the privacy and security protections for each of these products, to show how the data is being secured, minimized and deleted when it is no longer necessary to provide the contracted services?

• Ask if these products transmit personal student data to third-party software APIs in the form of queries used to operate the DOE contracted product. If so, has the third-party software vendor themselves undergone DOE security and safety procedures? Are these APIs providing access to DOE data in ways that are compliant with the law?

• Have these products undergone security audits and/or privacy impact assessments? If they have, ask for a copy of these reports.  If they haven’t, ask them why not.

• Is there any independent research to show the efficacy of these products in terms of improving learning or other student outcomes?  If they don’t know any such research, ask why a privacy-invasive product should be used without that evidence.

Questions about the school’s use of AI

• Be sure to ask which if any of the ed tech products being used in your school employs Artificial Intelligence, and what additional privacy protections these programs have, if any, since most AI products mine personal student data to improve their products, which is illegal under Ed Law §2-d regulations.

• Which specific AI program does the product rely upon, whether it be ChatGPT, Google Gemini or another such program?

• If it’s ChatGPT, are they aware that its privacy policy says that it is prohibited to be used by any student under 13, and students older than 13 to 17 only with parent consent?

• Some teachers are apparently using AI to write IEPs for students with disabilities. Is this happening in your school, and if so, why is it allowed given the serious risk to student privacy?

• If they say the specific AI programs being used in the school are not data-mining student personal data to improve their products, how do they know this to be true?  Has anyone checked, and if so how?

• Have the AI products been assessed for the presence of algorithmic bias against racial and/or ethnic groups?  If not, why not?  If so, can you see a copy of that analysis?

• Have these products been independently evaluated for their impact on learning? If so, ask for that research.  Many studies show that the use of AI in the classroom undermines cognition, creativity and critical thinking.

Questions about student computer use and screen time in general

Now that cell phone use has been banned in schools, it’s time to start thinking seriously about the overuse of computers in classrooms in general.  There is much evidence that learning via computers is less engaging compared to classroom discussion and debate, and less effective than having students read, write and do math on paper.

• How many hours per day and week is your child spending on computers while in class?

• Which computerized programs have been assigned for them to use?

• What independent studies exist for these programs’ effect on learning?

Class Size Matters/Parent Coalition for Student Privacy, 10/25/25.  Questions? Email us at info@studentprivacymatters.org

[1] The FTC has put out guidance that schools can consent on behalf of parents to allow third parties to collect personal information directly from students under 13, as long as the data is used for purely educational purposes.  Yet this guidance does not have the force of law.  Thus many schools and districts ask for parent consent as a best practice. For more on this, see https://studentprivacymatters.org/ferpa_ppra_coppa/#COPPA