Federal and State Privacy Regulations
There are numerous federal and state policies associated with student data privacy that are crucial to be aware of when determining policy and guidance for the use of genAI in schools including the
Family Educational Rights & Privacy Act (FERPA), the
Children’s Internet Privacy Act (CIPA), the
Children’s Online Privacy and Protection Act (COPPA) and the
Oregon Student Information Protection Act (OSIPA) under ORS 336.184. The federal and state regulatory landscape related to youth online safety, data privacy, and artificial intelligence continues to evolve, and it is recommended that
districts plan for ongoing review and periodic updates of local policies and guidance.
COPPA, in particular, impacts technology users under the age of 13 in that companies are not allowed to collect personal information from them without parental consent, while OSIPA lays out certain requirements that must be met when using digital platforms of any kind, including the following:
-
Disclosing any covered information provided by the operator to subsequent third parties, except in furtherance of kindergarten through grade 12 school purposes of the site.
-
Engaging in targeted advertising on the operator’s site, service, or application.
-
Selling a student’s information, including covered information.
When developing district policies and guidance, it is essential to ensure that they are not in violation of crucial data privacy laws such as FERPA, COPPA, or OSIPA. All schools and districts engaging with genAI technologies (or any technology broadly) can regularly review the company’s usage and privacy policies to ensure that they are not in violation. Again, please refer to ODE’s
Developing Policy and Protocols for the use of Generative AI in K-12 Classrooms document, a step-by-step guide for Oregon school leaders navigating this uncertain AI landscape.
District leaders are also encouraged to work in coordination with IT, procurement, and legal counsel to
ensure vendor agreements clearly define expectations for data collection, use, retention, security, and third-party sharing, and to verify that only district-approved tools are used for instructional purposes. In evaluating generative AI tools, districts can consider how commercial incentives may shape product design and data practices in ways that may not fully align with educational priorities. Careful review of vendor terms, data practices, and default settings can help ensure student information collection is limited to educational necessity and supports the protection of student privacy, well-being, and instructional integrity.
NOTE: Federal youth online safety and privacy proposals remain under active consideration at the national level. Districts should monitor federal and state developments and consult counsel as policies evolve. One example includes the
Kids Online Safety Act (KOSA), which, as of early 2026, has not yet passed through Congress and is still in legislative limbo.
Recommendations And Resources For Student Data Privacy Implications
Whenever new technology is introduced, reviewing the data use and privacy policies is of key importance. For example, for the purposes of ChatGPT, a starting place is to read the
privacy policy of OpenAI, the developer of ChatGPT. The privacy policy includes specific information related to the use of ChatGPT for children:
"7. Children.Our Services are not directed to, or intended for, children under 13. We do not knowingly collect Personal Data from children under 13... Users under 18 must have permission from their parent or guardian to use our Services."
Schools and districts are also encouraged to look over OpenAI’s Educator Considerations for ChatGPT for additional information.
District AI Tool Vetting and Approval Roles. District IT personnel play an essential role in establishing approval processes to vet AI tools for data privacy, security, and legal compliance, including protections for personal and personally identifiable information (PII). However, effective reviews should not be limited to a single department. Districts are encouraged to use a cross‑functional approach that includes Curriculum and Instruction leaders, IT personnel, Special Education (SPED) staff, English Language Development (ELD) departments, and equity‑focused teams to evaluate tools for instructional alignment, accessibility, and impact on diverse learners. Teachers should only use AI tools that have been formally approved through this shared process. Doing so helps protect students while ensuring compliance with district policies, federal regulations, and best practices.
Personally Identifiable Information (PII), oversharing, and genAI.
ORS 339.329 (c) defines the state of Oregon’s statewide tip line concerning threats or potential threats to student safety. In it Personally Identifiable Information (PII) is defined as any information that would permit the identification of a person… and is not limited to name, phone number, physical address, electronic mail address, race, gender, gender identity, sexual orientation, disability designation, religious affiliation, national origin, ethnicity, school of attendance, city, county or any geographic identifier included in information conveyed… or information identifying the machine or device used by the person…”
Users, both school staff and students, should be cautious when entering any personal information into any and all digital applications, including generative AI tools. Entering Personally Identifiable Information (PII) into any generative AI system should always be avoided. This is a particularly important consideration when using generative AI applications such as ChatGPT, as the information entered by users (including prompts and questions posed, etc.) is stored on the application’s server and integrated into the large language model used to respond to user prompts. Essentially, generative AI tools are learning from every single piece of text or other input typed into their platforms.33 While this statement generally still holds true as of the most recent release of this guidance document, many genAI tools are now offering a 'private mode' and/or education versions in which the companies that own then state that they are not retaining data for model training, though this cannot be independently verified.
Oversharing occurs when individuals share too much of that PII or other sensitive information in inappropriate or unsecured contexts. When we think of genAI tools like ChatGPT specifically, oversharing can lead to significant risks.
These risks can potentially include:
-
Exposure to data breaches
-
Misuse of information
-
Unintended data harvesting
GenAI tools, while powerful in processing and generating content based on vast data sets, can retain or expose information in ways that might compromise privacy. This makes understanding and mitigating oversharing critically important in K-12 educational settings where schools are dealing with minors and the federal privacy regulations cited above, like
FERPA and
COPPA.
School Staff Oversharing. For school staff, the dangers of oversharing with generative AI tools can have potential professional and legal ramifications. Staff might inadvertently, or even intentionally, enter sensitive information such as student performance data, behavioral reports, or even personal health information into AI systems. Staff should also avoid entering any student information into AI tools when drafting feedback, behavior documentation, communications, or instructional materials unless the tool has been formally approved and vetted for compliance with privacy requirements.
All staff must be vigilant with protecting student personal information when using AI systems.
When school staff enter sensitive student information into genAI systems, whether intentionally or inadvertently, the consequences can be serious. Doing so poses potential risks of violating privacy regulations like FERPA, which could lead to legal consequences for the school and the individual. Moreover, such data breaches can damage the trust between educators and students and potentially harm the school’s reputation. It is crucial for all school staff to be trained on the appropriate use of AI tools and the types of information that should never be entered into such systems.
Student Oversharing. Students are at heightened risk when it comes to data privacy, not because of carelessness, but because they are still developing an understanding of how personal information can be stored, shared, or misused in digital spaces. This is particularly true with genAI chatbots, which are programmed and trained to respond like humans.34,35 When students disclose personal anecdotes, family details, or sensitive identifiers in generative AI tools and other online platforms, that information may be retained, logged, or exposed through data breaches, weak security practices, or misuse across platforms. Such exposure can create opportunities for cyberbullying, identity theft, online sextortion, trafficking, or other forms of exploitation. To reduce these risks, educators and schools should consider proactively teaching safe digital practices as a part of a larger effort to teach AI and information literacy, embed privacy awareness into learning experiences, and ensure strong protections through secure platforms, strict privacy settings, and clear usage policies. Safeguarding student data is a shared responsibility that requires both systemic protections and ongoing staff and student guidance.
It is highly recommended that school districts incorporate explicit instruction on privacy, consent, and digital identity protection into existing digital citizenship, health education, and AI literacy learning so students understand how synthetic media and data sharing can affect their safety and well-being.
While there is a growing number of online resources for teacher professional development and K-12 student lessons that focus on these issues, including many listed below, Oregon has a number of resources helpful in this specific area.
Oregon’s Health Education Standards include age-appropriate requirements related to social media, AI, and data privacy in order to promote student safety with skills-based education. Also created specifically for Oregon youth,
SafeOregon, Oregon’s statewide tipline, provides a curriculum and accompanying
Teacher’s Guide for middle and high school students on topics of recognizing and analyzing risky online behavior and seeking help through trusted adults. These resources, free to all Oregon schools and districts, align with standards and are easily implemented in classrooms. Another valuable resource worth highlighting here is the Commonsense.org
Quick Digital Citizenship Lessons for Grades K-12, which includes lessons that are divided by grade level.
The Implications of Synthetic Media and Deepfakes
Synthetic media refers to digital content that is created using genAI tools like OpenAI’s
Dall-E (image generation),
Kling (video generation), and audio tools from
Lovo AI (audio generation). GenAI’s ability to make these media appear real (i.e., photorealistic) and/or authentic (i.e. portray known people, events, etc.) is increasing at a rapid pace. These online tools allow anyone to take images, photos, etc. from social media or other online platforms and manipulate them using genAI tools. A recent study from the University of Waterloo,
Can You Tell AI-generated People From Real Ones?, found that a large number of participants (39%) struggled to correctly identify synthetic media versus real photographs of people and that many participants overestimated their own ability to recognize synthetic media.36
The continued development of genAI tools able to produce realistic synthetic media offers educators some promising opportunities for student learning. For example, teachers could use these genAI tools to:
- Create engaging and interactive learning materials, such as virtual simulations and educational videos, that can enhance students’ understanding of complex concepts.
- Create personalized learning experiences by generating customized content tailored to individual student needs and interests.
- Work with students to explore digital storytelling, multimedia projects, and other creative endeavors that foster critical thinking as well as digital citizenship and information literacy skills.
Analyzing and understanding synthetic media can help encourage students to think critically about authenticity, bias, and manipulation.37
School district leaders can help staff and students alike by prioritizing the understanding of the risks posed by deepfakes and other synthetic media, which include potential risks of
harassment, intimidation, bullying, and cyberbullying as defined in Oregon’s ORS 339.351. More resources are becoming available regularly around this topic; one good option available from AI for Education is their
Uncovering Deepfakes, Classroom Guide + Discussion Questions.
School district policies, guidance, and student codes of conduct designed to address the use and misuse of genAI tools will want to include clear definitions and prohibitions of the creation and dissemination of deepfakes and other synthetic media designed with the intention to harm or harass others. These efforts should include mechanisms for reporting such incidents, as mandated by
ORS 339.356, which requires schools to have a uniform procedure for reporting and investigating acts of harassment, intimidation, bullying, and cyberbullying. Oregon’s anonymous school safety tip line,
SafeOregon, is available to all districts and schools and should be a part of reporting procedures to ensure safety for all students and school communities.
District leaders should be aware that Oregon law (ORS 163.472) prohibits the unlawful dissemination of an intimate image.
House Bill 2299, which took effect January 1, 2026, expanded this law to explicitly include images that have been digitally created, manipulated, or altered using artificial intelligence. Under the updated statute, distribution of AI-generated intimate deepfakes is now a Class A misdemeanor punishable by up to 364 days in jail and a fine of up to $6,250, with felony enhancement for repeat offenders.
This law has direct implications for school response when AI-generated or manipulated intimate images are created or shared in ways that harm students or staff.
Additionally, school district leaders should be aware of a growing number of cases involving AI-generated media being characterized as child sexual abuse material (CSAM), as defined by the US Department of Justice in their report on
Child Sexual Abuse Material. The US Department of Justice
Citizen's Guide To U.S. Federal Law On Child Pornography resource explains the federal laws that criminalize the creation, distribution, and possession of such material, including
18 U.S.C. § 2256 and the
PROTECT Act of 2003. These laws have been used to prosecute individuals even when no real child was involved. In May 2024, the Federal Bureau of Investigation stated that AI-generated CSAM is still CSAM and that those who create it will be held accountable.
More recently, the federal TAKE IT DOWN Act, signed into law in May 2025, makes it a crime to publish non-consensual intimate images, including AI-generated deepfakes, of both minors and adults. The law also requires online platforms to remove such content within 48 hours of being notified by a victim. Schools should be familiar with these federal protections, as they provide additional legal recourse for students and families harmed by synthetic intimate imagery.
In a
May 2024 press release, the Federal Bureau of Investigation stated, “CSAM generated by AI is still CSAM, and we will hold accountable those who exploit AI to create obscene, abusive, and increasingly photorealistic images of children.”
Several other states, including Pennsylvania with
Acts 125 of 2024 and 35 of 2025 and Artificial Intelligence (AI) Generated Abuse, have enacted laws addressing deepfakes and nonconsensual synthetic media, efforts at the federal level, including the previously introduced H.R. 5586 (DEEPFAKES Accountability Act), have not yet resulted in enacted legislation. In the absence of new federal or Oregon-specific laws, school districts should consult legal counsel regarding related policies and ensure staff are trained to recognize the dangers and legal implications of AI-generated CSAM and other synthetic media.
For a concise list of additional resources that may help guide you and your school leaders in developing a robust, well-thought-out AI policy for your district see:
Recommendations to Prevent Impacts of Synthetic Media and Deepfakes.