Home > School cybersecurity > Student data privacy
FERPA, COPPA, SOPIPA, AB 1584
Grades, health notes and home addresses are what attackers want most.
Student data privacy for California schools
Schools hold some of the most sensitive records in any community, and most of it now lives in Google, Microsoft and dozens of learning apps. Federal and California law set rules for who can see it and what vendors may do with it. Here is what applies and how we lock it down.
✓ Google Workspace and Microsoft 365 schools★ Public, charter, Catholic and private schools
The short answer
- FERPA protects student education records at schools that receive federal education funding.
- COPPA limits what online services collect from children under 13. Schools often give consent for classroom tools, so they must check those tools.
- California adds SOPIPA, which bars learning apps from selling student data or using it for targeted ads, and AB 1584, which sets what school vendor contracts must say.
- Many California districts use the California Student Privacy Alliance's standard data privacy agreement with vendors.
- Most real risk comes from weak accounts and sharing settings. We secure the accounts, devices and network and document it.
FERPAfederal education records law
Under 13COPPA applies
SOPIPAno selling, no targeted ads
AB 1584vendor contract rules
The laws in plain English
| Law | Who it covers | What it means for you |
|---|---|---|
| FERPA (federal) | Schools receiving federal education funds | Parents and eligible students control access to education records. Share only with consent or a legal exception, such as vendors acting as school officials. |
| COPPA (federal) | Online services used by children under 13 | Vet the apps you approve, since the school may be consenting for parents. |
| SOPIPA (California) | Websites and apps built for K-12 use | No selling student data, no targeted ads, no profiles except for school purposes, reasonable security. |
| AB 1584 (California) | Contracts between schools and vendors that handle pupil records | The school keeps ownership of records. Contracts must cover security, breach notice, deletion and no other use. |
| California breach law | Anyone holding personal information of California residents | Notify affected people when certain personal information is breached. |
Where student data leaks
🔑Weak accountsStaff email without multi factor sign in is the number one way in.
📤Open sharingDrives and folders shared with "anyone with the link."
📱Unvetted appsFree classroom apps that collect more than they should.
🖨Paper and copiersPrinted rosters left on copiers, and copier hard drives that store scans. See copier security.
Google Workspace and Microsoft 365 checklist
- Multi factor sign in for every staff and admin account.
- Few admins, each with their own account, never a shared one.
- External sharing limited, and student accounts unable to share outside the school.
- Third party app access reviewed, with unapproved apps blocked.
- Accounts disabled the day a staff member leaves, and graduating students handled on a schedule.
- Phishing and malware protection turned on, with staff training. See phishing training.
- Backups of email and drives, since the providers do not keep everything forever.
If student data is exposed
- Contain it: remove sharing, reset passwords, disable the affected accounts.
- Preserve evidence: save logs before they roll over.
- Find out what was exposed and whose records were involved.
- Bring in counsel or your diocese or district office to decide on notices to families.
- Fix the cause so it does not happen again, and record what was done.
How WENO protects student data
1. Account security reviewWe check Google or Microsoft settings, admin roles, sign in protection and sharing.
2. Lock it downMulti factor sign in, sharing limits, app controls and device management set up for you.
3. Secure the networkA WatchGuard® firewall with filtering, separate staff, student and guest networks, and secure copiers.
4. Vendor listA simple list of the apps that hold student data, so your administration can confirm each has a signed data privacy agreement.
5. Help when something goes wrongWe contain the problem, save the evidence and give your counsel the technical facts they need.
Questions people ask
Does FERPA apply to private and Catholic schools?
FERPA applies to schools that receive funds under U.S. Department of Education programs. Many private schools do not, but parents still expect the same protection, and other laws such as California's breach law still apply.
Are Google Workspace for Education and Microsoft 365 Education safe to use?
Both offer education agreements built for student data. The risk is usually in how the school sets them up, which is what we check.
Who signs the data privacy agreement with a vendor?
Your school or district administration. We help by listing which apps hold student data and what each one collects.
Protect the records families trust you with.Accounts, sharing, devices and network, secured and documented.
Review my student data securitySources
- U.S. Department of Education: Student Privacy
- FTC: Children's privacy (COPPA)
- California SOPIPA, Business and Professions Code 22584
- California AB 1584, Education Code 49073.1
General information, not legal advice. Your counsel, diocese or district office can confirm what applies to your school.