FERPA Compliance Statement

The Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g, is a federal law that protects the privacy of student education records. FERPA applies to educational agencies and institutions that receive funds from the U.S. Department of Education. Under FERPA, "education records" include records directly related to a student that are maintained by an educational institution or by a party acting on its behalf.

FERPA gives parents (and students who have reached 18 or attend a post-secondary institution) the right to access, review, and request corrections to education records. It also restricts the disclosure of personally identifiable information (PII) from those records without prior written consent.

When a teacher uses a third-party web-based tool in connection with their classroom, FERPA may be implicated if the tool receives or stores "education records" ; which can include student names combined with grades, attendance, or behavioral notes.

There are two primary FERPA-compliant pathways for a teacher using WiseBoard:

When a school district enters into a Data Privacy Agreement (DPA) with WiseBoard, LLC, the District thereby designates WiseBoard, LLC as a "school official" with a "legitimate educational interest" in education records, under the exception at 34 C.F.R. § 99.31(a)(1)(i)(B). This designation is the legal basis on which the District may disclose personally identifiable information (PII) from education records to WiseBoard without obtaining individual parental consent for each disclosure.

WiseBoard meets the four criteria the U.S. Department of Education requires for the school official exception:

1. Outsourced institutional service or function. WiseBoard performs an institutional service or function (classroom management, attendance, grading, behavior tracking, parent communication) for which the District would otherwise use its own employees.
2. Direct control of the District. WiseBoard operates under the direct control of the District with respect to the use and maintenance of Education Records, as defined in the executed DPA. The District retains ownership of all student data, instructs WiseBoard on permitted uses, and may direct WiseBoard at any time to return, delete, or correct records.
3. Compliance with re-disclosure limits (§ 99.33(a)). WiseBoard uses Education Records only for the authorized educational purpose and will not re-disclose PII from Education Records to any further third party except (a) to a subprocessor that is itself bound to act on the District's behalf, (b) as directed in writing by the District, or (c) as compelled by law.
4. Legitimate educational interest. WiseBoard accesses only those Education Records reasonably necessary to provide the contracted service, and only personnel with a documented need-to-know may view them.

WiseBoard's executed DPA also confirms that we (i) maintain administrative, physical, and technical safeguards for Education Records (see the Security Overview at the Trust Center), (ii) cooperate with parent inspect-and-review requests routed through the District (FERPA § 99.10), (iii) notify the District without unreasonable delay of any unauthorized disclosure of Education Records, and (iv) return or destroy Education Records at termination of the agreement, as the District elects.

Districts that need this language in writing may use our standard DPA template, the SDPC National DPA, or the District's own form. We will sign whichever the District prefers.

• We do not sell student data to any third party
• We do not use student data for advertising or behavioral profiling
• We do not share student data with any entity other than the teacher who entered it
• We do not retain student data after account deletion (beyond the 30-day window in our Privacy Policy)
• We do not provide student data to any government entity except when legally compelled

The Children's Online Privacy Protection Act (COPPA), 15 U.S.C. §§ 6501–6506, and 16 C.F.R. Part 312, applies to operators of online services that collect personal information from children under 13. WiseBoard is directed at teachers (adults), not students. Students do not create accounts or directly provide information to WiseBoard. Personal information about a student under 13 enters WiseBoard only when a teacher chooses to enter it (e.g., a first name on a roster).

For that limited collection, WiseBoard relies on the FTC-recognized school-as-agent consent model (16 C.F.R. § 312.5(c) and the FTC's COPPA FAQs section M, "Schools"): the school or district authorizes WiseBoard, on the parent's behalf, to collect a student's personal information for the use and benefit of the school and for no other commercial purpose. Under this model:

• Personal information collected from a child is used solely to provide the educational service the school requested. We do not use it for advertising, marketing, profiling for non-educational purposes, or sale.
• WiseBoard provides this Privacy Policy and FERPA Compliance Statement to the school so the school can include them in any direct parental notice the school chooses or is required to provide.
• We will provide direct parental notice and obtain verifiable parental consent ourselves only if a school requests it or applicable law requires it.
• Parents may review, request deletion of, or refuse further collection of their child's information by contacting the child's teacher or the district's data privacy officer; the school routes the request to us and we respond to the school within 30 days.

For teachers who do not have a District-signed DPA, WiseBoard's Anonymous Code and Student-ID modes ensure no child's personal information enters our systems at all ; which keeps the teacher COPPA-safe regardless of district agreement status. See Section 11 of our Privacy Policy for the full COPPA disclosure.

Many states have enacted student data privacy laws that complement or exceed FERPA. WiseBoard's posture covers, at a minimum:

• Illinois ; SOPPA (105 ILCS 85) ; annual subprocessor list publication and 30-day breach notification to affected parents. WiseBoard publishes its subprocessor list at /trust/subprocessors.md and follows the breach notification flow in our Incident Response Runbook.
• California ; SOPIPA (Cal. B&P Code § 22584) and Ed. Code § 49073.1 ; prohibits ed-tech operators from selling student data, advertising to students, or building profiles for non-educational purposes. WiseBoard contractually affirms each of these prohibitions.
• New York ; Ed. Law § 2-d ; requires a Parents' Bill of Rights and a signed DPA before third-party contractors may receive student data; Provider Data Security and Privacy Plan is incorporated by reference.
• Texas ; SB 820 / Education Code § 32.151 et seq. ; districts must adopt a cybersecurity framework. WiseBoard's controls map to NIST Cybersecurity Framework categories (see Security Overview).
• Colorado ; CRS § 22-16-101 et seq. ; operators of school service websites must maintain data security and publish an annual list of contracted operators. WiseBoard's Trust Center serves this purpose.
• Florida ; HB 379 (2023) ; restricts the use of TikTok and certain social platforms on district networks and devices, and requires ed-tech vendors to disclose any in-product social-media integrations and data flows to those platforms. WiseBoard does not embed TikTok, Snapchat, X/Twitter, or any consumer social-media SDK in the product, and does not transmit student or teacher data to any consumer social platform.
• Texas ; SB 168 (2025) ; strengthens parental notice and consent for ed-tech vendors handling student information. Districts that have executed our DPA receive a Parents' Bill of Rights summary suitable for distribution; teachers without a district DPA should use Anonymous Code mode to remain outside SB 168's scope.
• Pennsylvania ; Act 18 of 2023 (Education Empowerment / data security update) ; the operator's home state. Pennsylvania districts are covered by our DPA's data-security and breach-notification commitments, which meet or exceed the Act's minimum standard.
• SOPPA / SOPIPA / NY 2-d / TX SB 820 / CO CRS ; state-supplemental terms are incorporated as Exhibit G to our DPA template and apply automatically to districts in those states.

WiseBoard's Anonymous Code mode is designed to keep teachers compliant with all of these laws by ensuring no student PII enters our systems. For districts that execute a DPA, WiseBoard contractually agrees to the data security and use limitations required by applicable state laws. See our DPA template on the Data Privacy Agreement tab, or download the SDPC National DPA from the Trust Center.

If your school district requires a signed DPA before authorizing teacher use of WiseBoard, we are happy to execute one. Our standard DPA template can be found on the Data Privacy Agreement tab. To initiate the process, contact us at: