If you’ve ever tried to look up what the law says about AI and kids, you’ve probably landed in one of two places: dense legal language written for compliance officers, or vague reassurances that don’t actually answer your question.
That gap isn’t an accident. Most of the frameworks governing AI were designed for enterprise — for businesses managing risk, protecting assets, and avoiding regulatory fines. Even the newest AI-specific legislation was written with corporations in mind, not classrooms. And the older laws that were written with students in mind — FERPA, COPPA, IDEA — were drafted long before anyone imagined a chatbot tutoring a third grader or an AI grading system flagging a student’s essay.
What we’re left with is a patchwork of protections that partially apply, sometimes overlap, and frequently leave the most important questions — Is this AI safe for my child? Who’s responsible when something goes wrong? What rights do students actually have? — without clear answers.
This page won’t pretend otherwise. What it will do is break down each major framework in plain language: what it covers, who it protects, what it misses, and what it means for you as a parent, educator, or administrator. Knowledge is the first step toward advocacy — and right now, advocacy is exactly what students need.
One important note on age: most of these frameworks focus on children under 13 or K–12 students. But developmental research is clear that the brain continues developing through approximately age 25. College students and young adults face many of the same risks from AI — cognitive, social, emotional — with far fewer protections. Keep that in mind as you read.
The Frameworks — In Chronological Order
Seeing these in order tells a story. Notice how many were written for a world that didn’t have smartphones, let alone AI — and how recently the field has been scrambling to catch up.
Section 504 of the Rehabilitation Act (1973)
What it is: A federal civil rights law prohibiting discrimination against individuals with disabilities in programs receiving federal funding — including public schools.
Who it protects: Students with disabilities that substantially limit a major life activity, including learning. Applies K–12 and in higher education.
What it covers:
- Requires schools to provide equal access to educational programs and activities
- Mandates reasonable accommodations for qualifying students
- Applies to any tool or system used in instruction — including AI tools
What it means for AI:
- If an AI tool creates barriers for students with disabilities — through inaccessible interfaces, biased outputs, or lack of accommodation features — that may constitute a 504 violation
- Schools adopting AI tools have an obligation to evaluate accessibility before deployment, not after
- Students with 504 plans have the right to accommodations even when AI is involved in instruction or assessment
What it doesn’t cover: It doesn’t regulate AI directly or require schools to audit AI tools for bias. Enforcement is complaint-driven, meaning it typically requires someone to flag a problem first.
Bottom line: Predates AI entirely, but its civil rights protections still apply. Schools can’t use “the AI did it” as a defense for inequitable outcomes.
FERPA — Family Educational Rights and Privacy Act (1974)
What it is: A federal law protecting the privacy of student education records. Applies to any school receiving federal funding.
Who it protects: Students of all ages in schools receiving federal funds. Parents hold rights until the student turns 18 (or enrolls in post-secondary education), at which point rights transfer to the student.
What it covers:
- Schools must have written permission from parents/eligible students before releasing education records
- Parents/students have the right to review and request corrections to records
- Schools may share records with “school officials” with “legitimate educational interest” — a category that increasingly includes EdTech vendors
What it means for AI:
- AI tools that collect, process, or store student data — grades, behavior logs, writing samples, learning analytics — may be handling education records covered by FERPA
- Vendors must agree to use student data only for the purposes for which it was shared — not to train their models, not for advertising
- Schools are responsible for ensuring their AI vendors comply with FERPA, even if the vendor is the one mishandling data
What it doesn’t cover: FERPA was not written for AI. It doesn’t address AI-generated outputs, algorithmic decision-making, or what happens when a student’s writing sample is used to train a model. The “legitimate educational interest” loophole is broad and frequently exploited.
What parents/educators can do:
- Request a list of all EdTech vendors your school shares data with
- Ask whether AI tools used in your child’s classroom have signed FERPA-compliant data agreements
- Review your school’s annual FERPA notification for how they define “school officials”
Bottom line: FERPA is the most directly relevant law for students and schools — but it’s a 50-year-old privacy law being asked to do work it was never designed to do.
IDEA — Individuals with Disabilities Education Act (1975, reauthorized 2004)
What it is: A federal law guaranteeing students with disabilities the right to a free and appropriate public education (FAPE) in the least restrictive environment. It’s the law behind IEPs — Individualized Education Programs.
Who it protects: Students ages 3–21 with qualifying disabilities, in public schools.
What it covers:
- Mandates individualized support and services for qualifying students
- Requires schools to develop, implement, and monitor IEPs with family involvement
- Governs how students with disabilities are evaluated, placed, and supported
What it means for AI:
- AI tools used in assessment, instruction, or progress monitoring for students with IEPs must align with the goals and accommodations outlined in those plans
- If an AI system makes or influences decisions about a student with a disability — placement, services, graduation eligibility — IDEA’s procedural safeguards apply
- AI-based adaptive learning tools must not inadvertently narrow or limit educational opportunities for students with IEPs
- Families have the right to challenge decisions, including those influenced by AI systems
What it doesn’t cover: Like Section 504, IDEA doesn’t regulate AI directly. It doesn’t require schools to audit AI tools for compatibility with IEP goals or potential bias against students with disabilities.
What parents/educators can do:
- Ask specifically how AI tools interact with IEP accommodations before adoption
- Ensure IEP teams — not algorithms — are making eligibility and placement decisions
- Document any AI-influenced decisions affecting a student with an IEP
Bottom line: IDEA’s protections are strong and enforceable — but schools need to actively apply them to AI contexts rather than waiting for guidance.
COPPA — Children’s Online Privacy Protection Act (1998, updated 2025)
What it is: A federal law restricting the collection of personal data from children under 13 by online services.
Who it protects: Children under 13. Note: the age threshold came from a political negotiation in 1998, not developmental science.
What it covers (original):
- Requires verifiable parental consent before collecting personal data from children under 13
- Mandates clear privacy notices
- Gives parents the right to review and delete their child’s data
What the 2025 update added:
- Using children’s data to train AI models now requires separate parental consent — it is not considered “integral” to the service
- Strengthened consent requirements for AI-driven personalization
- Expanded protections for teen users in some contexts
What it means for AI:
- AI tools used with children under 13 must obtain clear consent before collecting data
- If a child’s interactions with an AI tool are being used to improve the model, parents must be explicitly informed and consent separately
- The “educational exception” (schools can consent on behalf of parents for legitimate educational purposes) still applies — but schools must use it responsibly
What it doesn’t cover: COPPA is a data privacy law, not a child safety law. It protects your child’s data. It says nothing about whether the experience of interacting with an AI is developmentally appropriate, emotionally safe, or psychologically harmful. A tool can be fully COPPA-compliant and still be deeply inappropriate for a young child.
What parents/educators can do:
- Verify that any AI tool used with children under 13 has a COPPA-compliant privacy policy
- Check whether the tool claims a school consent exception — and if so, whether your school has actually reviewed and approved the tool
- Ask specifically: “Is any student interaction data being used to train or improve AI models?”
Bottom line: COPPA’s 2025 update was a meaningful step forward on the data training issue. But it still doesn’t touch the question most parents are actually asking: Is this safe for my kid to interact with?
NIST AI Risk Management Framework (2023)
What it is: A voluntary framework from the National Institute of Standards and Technology for managing AI-related risks. Not a law — a set of guidelines and best practices.
Who it’s for: Primarily organizations developing, deploying, or using AI. Not written for schools or families specifically.
The four core functions:
- Map — identify the context, uses, and risks of an AI system
- Measure — assess and analyze those risks
- Manage — prioritize and address risks
- Govern — build organizational culture and accountability around AI risk
What it means for AI in education:
- Provides a useful vocabulary for schools evaluating AI vendors — you can ask whether a vendor has conducted a risk assessment aligned with NIST RMF
- The “Map” function is essentially what a district should do before adopting any AI tool: who uses it, what data does it touch, what are the risks?
- Because it’s voluntary, it has no enforcement mechanism — but it’s widely referenced in policy conversations
What parents/educators can do:
- Use NIST RMF language when talking to administrators: “Has this tool been through a risk assessment? What were the findings?”
- Reference it in advocacy — the fact that the US government has a voluntary framework for AI risk management, and your school hasn’t followed it, is worth naming
Bottom line: A genuinely useful framework — but voluntary, enterprise-oriented, and not written with developing brains in mind. Think of it as the vocabulary of responsible AI governance, which schools should be speaking but mostly aren’t yet.
U.S. Executive Order on Safe, Secure, and Trustworthy AI (October 2023)
What it is: A presidential executive order directing federal agencies to develop AI safety standards, guidelines, and assessments across sectors including education.
Who it’s for: Federal agencies, with downstream implications for institutions receiving federal funding — including schools.
What it covers:
- Directs the Department of Education to develop resources on AI in schools
- Emphasizes safety, security, equity, and civil rights in AI development and deployment
- References the need to protect children from AI harms
- Calls for transparency from AI developers
What it means for AI in education:
- The Department of Education has since released guidance on AI in education — worth reading, though advisory in nature
- Creates political and regulatory momentum for stronger protections
- Signals that the federal government views AI in schools as a priority — even if binding rules haven’t followed yet
What it doesn’t cover: Executive orders are not laws. They direct agencies — they don’t create enforceable rights for students or families.
Bottom line: More significant for what it signals than what it requires. The conversation is happening at the federal level. Whether it translates into meaningful protection for students depends on follow-through.
EU AI Act (2024 — phased implementation through 2027)
What it is: The world’s first comprehensive, binding AI regulation. Passed by the European Parliament in 2024, with requirements phasing in through 2027.
Who it’s for: Any organization developing or deploying AI that affects people in the EU. US companies whose tools are used in EU schools must comply.
The four-tier risk classification:
- Unacceptable risk (prohibited): Social scoring systems, subliminal manipulation, real-time biometric surveillance in public spaces
- High risk (strict obligations): AI used in education — including adaptive learning, student assessment, and behavior monitoring — falls here. Requirements include transparency, human oversight, bias testing, and documentation
- Limited risk (transparency required): Chatbots must disclose they are AI. Deepfakes must be labeled
- Minimal risk (no obligations): Spam filters, AI in games
What it means for AI in education:
- Education AI is explicitly classified as high risk — meaning tools used to influence student outcomes must meet strict standards
- Vendors selling to EU schools must provide documentation, conduct bias assessments, and ensure human oversight of AI decisions
- The “limited risk” transparency requirement means any AI chatbot interacting with students must identify itself as AI — this includes tutoring bots and classroom assistants
What it means if you’re in the US:
- It doesn’t directly apply — but it sets a global standard that US companies operating internationally must meet
- It’s increasingly the benchmark advocates use when pushing for equivalent US protections
- Several US states are looking at EU AI Act-style legislation as a model
Bottom line: The most comprehensive child-relevant AI regulation currently in existence — and it’s European. US students have no equivalent binding protection yet.
UNESCO AI Competency Frameworks (2021–2024)
What it is: A set of non-binding international frameworks from the United Nations Educational, Scientific and Cultural Organization, covering AI competencies for students, teachers, and school leaders.
Who it’s for: Educators, school systems, and policymakers worldwide. Advisory in nature.
What it covers:
- AI literacy competencies for students across developmental levels
- AI integration guidance for teachers — including ethical reasoning, not just tool use
- Leadership frameworks for school administrators navigating AI adoption
What it means for AI in education:
- Provides a globally recognized vocabulary for what “AI-ready” education looks like
- The student framework outlines 12 competencies across three progression levels — useful for curriculum planning
- Critically: UNESCO’s frameworks emphasize ethical reasoning alongside technical skills — flagging that knowing how to use AI is not enough without knowing how to question it
What it doesn’t cover: UNESCO frameworks carry no enforcement authority. A school can ignore them entirely with no legal consequence.
Bottom line: Best understood as an aspirational standard — what responsible AI education should look like. Useful for advocacy and curriculum design, not for legal protection.
AI4K12 Initiative (Ongoing)
What it is: A national initiative — a collaboration between CSTA (Computer Science Teachers Association) and ISTE (International Society for Technology in Education) — developing K–12 AI education guidelines and curriculum resources for the United States.
Who it’s for: K–12 educators and curriculum developers. Advisory, not regulatory.
What it covers:
- Five “Big Ideas in AI” framework for K–12 learning
- Grade-band progressions for what students should understand about AI at different developmental stages
- Curriculum resources, lesson plans, and professional development materials
What it means for AI in education:
- Provides a practical framework for teaching about AI — not just using AI
- The developmental progression is useful context: what a K–2 student can understand about AI is genuinely different from what a high schooler can understand
- Growing adoption in school districts as a curriculum anchor
What it doesn’t cover: Like UNESCO, AI4K12 is curriculum guidance, not student protection. It addresses what students should learn about AI — not whether the AI tools they’re interacting with are safe.
Bottom line: Valuable for teachers and curriculum designers. Not a protection framework. Knowing about AI and being protected from AI are two different things — and right now, only one of those is getting real attention.
What to Watch: Emerging Policy
The policy landscape is moving fast — faster than this page can track in real time. Here are the areas most likely to produce significant changes for students and families:
State-level student AI privacy laws — Several states (including California, Texas, and New York) have passed or are considering legislation specifically addressing AI in schools — student data protections, algorithmic transparency, and vendor accountability. These vary widely and are evolving quickly.
FTC AI enforcement — The Federal Trade Commission has signaled increased scrutiny of AI tools marketed to children and families. Watch for enforcement actions that clarify what “deceptive” AI practices look like in educational contexts.
COPPA expansion — Advocacy is building for COPPA expansion to cover teens up to 16 or 18, with stronger protections for AI interactions specifically. The 2025 update was a step — more are likely coming.
EU AI Act implementation — As the EU’s phased implementation continues through 2027, US companies serving EU schools will be required to meet high-risk obligations for education AI. This will create pressure for US equivalents.
Congressional AI legislation — Multiple AI bills have been introduced at the federal level. None have passed as of this writing. The landscape could shift significantly.
This section will be updated as significant developments occur.
The Bottom Line: What This Means for You
Reading through all of this, one thing should be clear: the protections that exist were not designed for this moment.
The laws written with students in mind are too old to address AI. The frameworks written for AI weren’t written for students. And the gap between them is where your child’s education is actually happening.
That’s not a reason to despair. It’s a reason to be informed — because informed parents and educators are the most powerful advocates students have right now.
If you’re a parent:
- Ask your child’s school what AI tools are in use and what data they collect
- Request to see any vendor data agreements related to EdTech tools
- Ask whether tools used with your child have been evaluated for developmental appropriateness — not just data compliance
- Know that FERPA gives you the right to review your child’s education records, which may include AI-generated data
If you’re a teacher or administrator:
- Understand that adopting an AI tool is a data governance decision, not just a pedagogical one
- FERPA obligations extend to your AI vendors — you are responsible for their compliance
- IDEA and 504 protections apply to AI-influenced decisions about students with disabilities
- “The vendor said it was compliant” is not sufficient due diligence
If you’re an advocate:
- The EU AI Act’s classification of education AI as high risk is a powerful reference point
- The gap between existing US law and actual student protection is well-documented and growing
- Parents, teachers, and students have standing to demand better — and a growing body of research to support that demand
The rules are incomplete. The technology is moving faster than policy can follow. But understanding what exists — and what doesn’t — is where the power to change it begins.
Have a question about a specific regulation or tool? [Contact Mia] or join the conversation in [the community].
Related reading: [Not All AI Is the Same — A Guide for Parents and Educators] | [Is Your Child Ready for AI? What Developmental Science Actually Tells Us]