Schools are legally responsible for every app that touches student data. Here are 8 education apps with verified FERPA protections — from iKeepSafe certifications to signed National Data Privacy Agreements.
FERPA — the Family Educational Rights and Privacy Act — gives parents and eligible students control over their education records. For schools, it means every edtech app that accesses student data must operate under strict privacy rules, and the school itself is accountable if a vendor mishandles that data.
Unlike COPPA, which targets app operators directly, FERPA places responsibility on schools and districts. When a teacher signs up for a classroom app, the school is disclosing student records to a third party. Under FERPA's “school official” exception, this is permitted only if the vendor has a written agreement limiting data use to authorized educational purposes — typically through a Data Privacy Agreement (DPA).
The Student Data Privacy Consortium (SDPC) has streamlined this process with a standardized National DPA used across 37 states, with over 275,000 DPAs executed since 2016. In March 2025, the Department of Education took the unprecedented step of requiring all state agencies to certify FERPA compliance by April 30, 2025, signaling a new enforcement posture. Third-party data sharing violations rose 34% in 2024 alone.
We evaluated education apps based on iKeepSafe FERPA certification, signed National DPAs through the SDPC, Common Sense Privacy scores, data minimization practices, and independent privacy audits. These 8 apps have the strongest verified FERPA protections for classroom use.
Khan Academy Kids offers free, comprehensive early learning content covering reading, math, and more for children ages 2-8.
Starfall teaches reading through systematic phonics with engaging activities for Pre-K through 5th grade.
IXL is a comprehensive adaptive learning platform covering all subjects from Pre-K through 12th grade.
ABCmouse offers a full early learning curriculum with thousands of activities for children ages 2-8.
Zearn is a standards-aligned digital math platform offering comprehensive instruction, practice, and remediation. Free for families, premium for schools.
SplashLearn offers game-based math and ELA practice for Pre-K through 5th grade. Known for engaging gameplay that keeps kids motivated.
FERPA (Family Educational Rights and Privacy Act) compliant means an app handles student education records according to federal requirements. For edtech apps, this means the app only accesses student data under a legitimate educational interest, does not re-disclose personally identifiable information without consent, implements appropriate data security measures, and allows schools to maintain control over how student records are used.
A Data Privacy Agreement (DPA) is a legal contract that defines how an edtech vendor will handle student data. Without a signed DPA, districts risk FERPA violations and loss of federal funding. The SDPC created a standardized National DPA template now used by 37 states, with over 275,000 agreements executed since 2016.
Under FERPA, schools can share student records with edtech vendors without individual parent consent IF the vendor qualifies as a "school official" with a legitimate educational interest. This requires a written agreement (typically a DPA) that specifies the vendor performs an institutional function, uses data only for authorized educational purposes, and is under the direct control of the school regarding data use and maintenance.
FERPA protects student education records held by schools receiving federal funding, while COPPA protects children under 13 from online data collection. FERPA is enforced by the Department of Education and applies to schools; COPPA is enforced by the FTC and applies to app operators. Many education apps must comply with both laws. The key difference: FERPA governs how schools share records with apps, while COPPA governs how apps collect data from children.
The most significant penalty for FERPA non-compliance is the loss of federal education funding administered by the Department of Education. The Family Policy Compliance Office (FPCO) investigates complaints and can require corrective action. While FERPA does not provide a private right of action for lawsuits, schools face reputational damage, community trust erosion, and potential state-level penalties. Third-party data sharing violations rose 34% in 2024.
Check for iKeepSafe FERPA certification, which independently verifies compliance. Search the SDPC Resource Registry for signed National DPAs between the vendor and your state or district. Review the app's privacy policy for FERPA-specific disclosures about student data handling. Check Common Sense Privacy evaluations for independent scoring. Finally, confirm the app appears on your district's approved vendor list.
FERPA protects all "education records" — any records directly related to a student that are maintained by a school or a party acting on behalf of the school. This includes grades, transcripts, class schedules, disciplinary records, financial information, and any personally identifiable information (PII) linked to those records such as names, addresses, student ID numbers, and dates of birth.
Yes. SpellingJoy does not access or store student education records without school authorization, does not re-disclose student data to third parties, serves no advertising, and gives teachers full control over classroom data through their dashboard. Teachers manage all student accounts and can delete data at any time.
Prodigy Math leads with the strongest FERPA credentials: iKeepSafe FERPA, COPPA, and CSPC certifications, a 92% Common Sense Privacy score, SDPC membership, and 1EdTech TrustEd App verification. For schools that need a single, thoroughly vetted math tool, it is the safest choice.
If budget is the priority, Khan Academy Kids, Starfall, and Zearn prove that strong FERPA protections and free access can coexist. Khan Academy Kids backs its DPAs with assertions of FERPA, COPPA, and PPRA compliance. Starfall, as a 501(c)(3) nonprofit, collects zero personal information from children — making FERPA compliance straightforward by design.
For schools with formal certification requirements, IXL and ABCmouse hold KidSAFE seals, while BrainPOP and SplashLearn participate in the SDPC framework with signed National DPAs available through state privacy alliances.
With the Department of Education's new compliance certification mandate and rising enforcement, now is the time to audit your classroom app list. Verify that every app has a signed DPA on file, check for iKeepSafe FERPA certification or equivalent, and search the SDPC Resource Registry for your district's existing agreements.
Looking for a privacy-conscious spelling app? SpellingJoy is 100% free, does not access student education records without authorization, serves no advertising, and gives teachers full control through a classroom dashboard. Try SpellingJoy free today.
About the Author
SpellingJoy Team
The SpellingJoy team is dedicated to creating free, high-quality spelling resources for K-6 students and their families. We test every app we review and provide honest assessments to help parents make informed decisions.