Student Data Privacy: DPA-Ready Education Apps (2026)

A Data Privacy Agreement (DPA) is a legally binding contract between a school district and an education technology vendor that specifies how student data will be collected, used, stored, and protected. DPAs define what data the vendor can access, how long it can be retained, what security measures must be in place, and what happens to the data when the contract ends. Most states now require districts to have a signed DPA before using any edtech product that handles student information.

The SDPC National Data Privacy Agreement (NDPA) is a standardized contract template created by the Student Data Privacy Consortium, a project of Access 4 Learning (A4L). Since its launch in 2016, over 275,000 standard DPAs have been executed through the SDPC system. The NDPA streamlines the process so districts and vendors do not have to negotiate individual contracts from scratch. Version 2.2 was released in November 2025, and the SDPC Resource Registry hosts over 130,000 signed agreements between 12,000+ districts and 6,674 vendors.

The Future of Privacy Forum retired the Student Privacy Pledge on April 25, 2025, after 10 years of operation. During its tenure, approximately 500 edtech companies signed the voluntary pledge. It was retired because more than 40 states have since passed student privacy laws that codify the Pledge's principles and apply to all companies regardless of whether they signed. Schools are now directed to the SDPC National DPA and the CISA Secure by Design Pledge as stronger, enforceable alternatives.

Any education app that collects, stores, or processes personally identifiable student information should have a signed DPA with the district before classroom use. This includes apps that require student accounts, track progress, or collect any data beyond anonymous usage. Most states now mandate DPAs for edtech vendors, and districts risk violating FERPA and state privacy laws if they allow apps without signed agreements.

COPPA is a federal law that restricts how companies collect data from children under 13. A DPA is a contract between a specific school district and a vendor that governs how student data is handled. An app can be COPPA compliant without having a DPA, and vice versa. For full protection, schools should verify both: the app follows COPPA rules for under-13 data collection, and the district has a signed DPA that covers data handling, retention, and deletion.

The SDPC operates alliances in 28 states where districts collaborate to negotiate DPAs collectively. When a state alliance signs a DPA with a vendor, every district in that alliance can subscribe to the agreement rather than negotiating individually. Each state alliance can add state-specific clauses to the National DPA template to address unique requirements from their state privacy laws. This saves thousands of hours of individual negotiation across the alliance.

Visit the SDPC Resource Registry at sdpc.a4l.org, which is freely accessible and hosts over 130,000 signed DPAs. You can search by vendor name or browse by state to see which apps have agreements with districts in your state. You can also check your own district's approved vendor list, contact your district technology coordinator, or ask the vendor directly for a copy of their standard DPA.

Yes. SpellingJoy does not collect personal information from children without school or parental consent, does not serve advertising, and does not share student data with third parties. Teachers manage all student accounts through their classroom dashboard, and SpellingJoy supports district DPA requirements with transparent data practices and clear data deletion policies.