State Guidance on Generative AI in Schools: Common Student Privacy Requirements Districts Can Standardize

Updated November 2026. State requirements and guidance can change; verify current rules with the relevant state agency before adopting a policy.

Across the United States, more states are issuing guidance on generative AI in K12 education. While the details vary, the privacy themes are consistent. Districts that standardize around those common expectations can reduce risk, avoid policy whiplash, and communicate more clearly with staff and families.

Key takeaways: Districts can build one practical AI governance framework by standardizing four things: prohibit student PII in unapproved tools, treat prompts and logs as student data, require vendor purpose limits and retention controls, and publish a clear approved AI tool list.

For an overview of state guidance, see Student Privacy Compass’s K–12 AI guidance roundup. The Oregon Department of Education’s generative AI guidance also provides a practical example of state-level guardrails on student information and human decision-making.

Why state AI guidance matters even when federal law exists

Districts already operate under federal student privacy baselines like FERPA and COPPA. State guidance on AI often does not replace those laws. Instead, it translates them into district actions: approval workflows, staff training, classroom rules, and vendor controls. In other words, guidance becomes the playbook districts use to show they are being intentional.

Even when guidance is not legally binding, it often signals what state leaders expect districts to implement, and what parents and school boards may ask about.

The patterns that show up across state AI guidance

A note on recently enacted state AI education mandates

Most states are still in guidance mode, but a small number have moved into mandates that require districts to adopt AI policies or embed AI literacy into curriculum frameworks. These laws are not always privacy laws, but they increase the urgency for districts to have a clear governance and privacy posture.

• Ohio: Under Ohio Revised Code § 3301.24, traditional public school districts, community schools, and STEM schools were required to adopt an AI use policy by July 1, 2026. The state published a model policy, but districts were not required to adopt that model verbatim.
• Tennessee: SB 1711 / Public Chapter 550 (2024) requires local boards of education and public charter school governing bodies to adopt policies on AI use by students and staff for instructional and assignment purposes. The policy implementation requirement began with the 2024–25 school year; check the state education department for current reporting requirements.
• California: Education Code § 33548 (AB 2876) directs the Instructional Quality Commission to consider AI literacy content when mathematics, science, and history–social science curriculum frameworks are next revised. This is a curriculum-related requirement, not a statewide mandate for every district to adopt a separate AI vendor policy.

1) Do not put student personally identifiable information into public AI tools

Many states emphasize that staff and students should not enter identifiable student information into consumer AI tools. A strong district policy makes this rule explicit, provides examples, and points staff toward approved alternatives.

2) Treat prompts and chat logs as student data

Prompts can contain sensitive context even when names are omitted. Districts should assume prompts, chat logs, uploads, and AI outputs are potentially identifiable and should be governed with retention and deletion controls.

3) Vendor review before classroom use

A practical district baseline is to require review before authorizing AI tools that collect student information or influence consequential student decisions. The depth of review should depend on the intended use, data involved, age group, and potential harms; not every AI-enabled feature has the same risk profile.

4) Purpose limitation and no secondary use

District policy should restrict student data to the authorized educational purpose. Where a vendor proposes model training or other secondary uses, districts should verify whether those uses are permissible at all under applicable law and agreements; an opt-out setting alone does not cure an otherwise prohibited use.

5) Transparency to families

Parents are increasingly asking which AI tools are used, what data is involved, and what guardrails exist. State guidance often points districts toward transparent vendor lists and plain language notices.

A standard district AI governance framework you can adopt

The goal is to create one governance framework that works across states, then layer state specific checks where needed.

Step 1: Create an AI intake and approval workflow

• Require staff to submit an intake request before use
• Collect the purpose, grade levels, data types, retention, and integrations
• Route requests into risk tiers and deeper review where needed
• Assign owners for review and a decision timeline so requests do not stall

Step 2: Set a default prohibition on student PII in prompts

• Allow only approved tools for any student identifiable use
• Train staff on safe prompting and examples of prohibited content
• Audit classroom practices periodically and reinforce expectations

Step 3: Require vendor commitments that match school expectations

• Data minimization and educational purpose only
• Clear retention schedule for prompts, logs, and uploads, including backups
• Subprocessor disclosures and change notification
• Security controls including multifactor authentication and logging
• No model training on student data unless explicitly authorized and limited

Step 4: Communicate clearly with families

• Maintain an approved AI tool list
• Explain what data is collected and what is prohibited
• Publish contact points for privacy questions

How state student privacy laws fit into AI governance

State requirements vary, and a COPPA school-consent determination does not override state laws requiring a signed Data Privacy Agreement. Use current state agency guidance and legal requirements to cross-check contracts, consent, and transparency obligations. EdPrivacy state guides can provide a starting point:

• Texas State Guide
• Florida State Guide
• Illinois State Guide
• New York State Guide
• California State Guide

Even when a state does not have a single comprehensive student privacy statute, districts can still use a consistent baseline: purpose limitation, transparency, retention limits, and vendor security safeguards.

What to put in your district AI policy

Acceptable use rules

• No student PII in prompts for unapproved tools
• No uploading student records, IEP documents, discipline records, or health information
• Use district managed accounts, not personal accounts
• Require staff to confirm they understand prohibited inputs

Approval criteria

• Clear description of data collected, retained, and shared, including prompts and logs
• Retention schedule and deletion controls
• Subprocessor list and change notifications
• Security controls appropriate for the data
• Training restrictions and purpose limits for model improvement

Operational oversight

• Publish and maintain an approved AI tool list
• Train staff quarterly on safe prompting and prohibited inputs
• Re review tools when features or terms change
• Run an annual tabletop exercise for AI data exposure scenarios

Vendor questions districts can standardize

Regardless of which state you operate in, these questions help convert guidance into a repeatable vendor review.

• What data is collected from students, staff, and parents, including prompts and logs
• Is data used for model training or product improvement, and can the district opt out
• How long are prompts, chat logs, and uploads retained, including in backups
• Who are the subprocessors and what access do they have
• What controls exist for admin access, logging, and exports
• What is the breach notification and incident response process

Want to put this framework into practice? Use the implementation plan below to create an initial policy, inventory, and vendor-review process. Then test how EdPrivacy can help your team document reviews and decisions.

Implementation plan: a realistic 30 day rollout

Week 1: Set rules and inventory usage

• Publish an interim rule: no student PII in unapproved AI tools
• Survey staff on current AI use and identify the highest risk workflows

Week 2: Stand up the approval workflow

• Launch an AI intake form and assign owners for review
• Define risk tiers and minimum vendor requirements per tier

Week 3: Approve a small starting set

• Select a small number of tools for pilot use with clear controls
• Document retention settings and staff training expectations

Week 4: Publish transparency and train staff

• Publish the approved AI tool list and plain language rules for families
• Deliver a short staff training module on safe prompting

FAQ

Do we need a separate AI policy if we already have an edtech approval process?

Not necessarily. A district can often incorporate AI-specific requirements into its existing technology policies and approval workflow, unless applicable state law requires a particular AI policy. Address prompts and logs, approved uses, model training, human oversight, staff guidance, and vendor commitments explicitly.

Should we approve one AI tool for the whole district

Many districts start with a small approved list. Standardizing reduces confusion and makes training easier. If you allow many tools, you need a stronger monitoring program and clearer role based access controls.

What is the simplest control that reduces risk immediately

Set and enforce a rule that prohibits student PII in prompts for unapproved tools, then follow it with a short training and a clear approved list.

How EdPrivacy supports districts

EdPrivacy helps districts centralize student data privacy, AI Risk Reviews, accessibility information, vendor agreements, and technology approval decisions. District teams can document AI safeguards, maintain an approved resource list, and monitor changes to vendor privacy policies over time.

Put state AI guidance into practice. Start your free EdPrivacy trial and review an application your district uses. No credit card required.