Under FERPA, you have the right to inspect and review your child's education records. The school must comply within 45 days of your written request; some states require a shorter window. Submit the request in writing to the principal or district records officer and explicitly ask for records maintained by or on behalf of the district — including records held by third-party vendors under contract. That phrase matters. Without it, the district may return only the records it directly maintains and technically comply with the request while leaving out the behavioral data, monitoring flags, and AI-generated risk scores sitting in vendor systems. Ask specifically for any records related to behavioral monitoring, AI safety or wellness assessments, and learning analytics dashboards. Ask whether any AI-generated scores or flags about your child exist and, if so, what data they are based on. Get the school's response in writing.

FERPA's "directory information" exception allows schools to disclose certain basic student information — name, grade level, participation in activities, and similar data — without parental consent, as long as the school provides annual notice and an opportunity to opt out. Most parents never opt out because they don't know it's an option. Submit a written opt-out request to the district records officer before the beginning of each school year; your state's law may specify a deadline. Opting out does not prevent the school from sharing records for legitimate educational purposes, but it does close a disclosure channel that has historically been exploited by data brokers, marketing firms, and military recruiters. The district is required to honor the request.

No federal law requires districts to proactively publish the list of ed-tech vendors they share student data with. But several state laws do — notably Illinois, which requires districts to publish complete vendor lists publicly — and in every state, you can file a public records request for vendor contracts and data sharing agreements. In some states this is a formal Freedom of Information Act or state equivalent request; in others, a direct written request to the district will suffice. Ask for: the full list of ed-tech vendors with student data access, the data processing agreements or data sharing agreements with each vendor, documentation of what categories of student data each vendor receives, and whether any vendor uses student data for product improvement, research, or any purpose beyond the contracted educational use. The responses will tell you a great deal. The gaps in the responses will tell you even more.

If a school shares student data without proper authorization, allows a vendor to use student data for commercial purposes outside the educational contract, or denies a valid records request, that's a potential FERPA violation. Complaints are filed with the U.S. Department of Education's Student Privacy Policy Office at studentprivacy.ed.gov. The office investigates complaints and has authority to require districts to correct violations; in serious cases, it can refer matters to the Secretary of Education for enforcement action including the potential loss of federal funding — which is meaningful leverage. If the violation involves a COPPA issue (a commercial service collecting data from children under 13 without proper consent), file separately with the FTC at reportfraud.ftc.gov. The FTC's enforcement priorities are shaped in part by complaint volume. Individual complaints do move the needle over time.

A school board meeting speech that says "I'm concerned about student privacy" achieves little. A speech that says "This district has a contract with Vendor X. That contract allows Vendor X to use de-identified student data for product development. Here is the contract language. Here is the FTC guidance that says school consent under COPPA does not extend to commercial product development. I am asking the board to direct the superintendent to renegotiate this term before the contract renews in June" — that is actionable. Get the vendor contracts through a public records request. Read them. Find the language that doesn't match what the school told you, or what the law requires. Bring the specific page and paragraph number.

Ten parents showing up to a board meeting with the same prepared remarks are materially more effective than one parent showing up ten times. The math is not subtle — elected officials count constituents. Build a small coalition before you go public: three to five parents who have read the contracts, prepared coordinated remarks, and are willing to follow up in writing after the meeting. Librarians, school counselors, and teachers are natural allies — surveillance platforms affect their professional relationships with students as much as they affect families. A prepared group that can document what it asked and what response it received creates a paper trail that the board cannot easily walk back from.

Vague asks get vague commitments that evaporate. Specific asks produce specific answers that go on the record. Effective asks at a school board level include: requiring the district to publish its full vendor list and data sharing agreements on a publicly accessible page on the district website; requiring a privacy impact assessment before any new ed-tech tool is adopted; requiring that any AI monitoring or behavioral analytics tool be reviewed by an independent committee before renewal; requiring that the district notify parents when any vendor changes its data use terms. Ask for a specific timeline and a specific person responsible for follow-up. Put your contact information in the record so the board cannot claim it could not reach you.

School districts are sensitive to local press coverage in ways they are not sensitive to individual parent complaints. If you have documentation of a privacy-related vendor contract issue, a pattern of student data being used outside its stated educational purpose, or a board that has declined to act on specific documented concerns, a well-prepared briefing to a local reporter — with the contract, the relevant law, and the board's non-response in hand — often produces results that direct advocacy does not. Education reporters are chronically under-resourced and actively look for stories with documentation. The PowerSchool breach generated national coverage precisely because documents existed and parents could point to specific harms. Local vendor contract issues can do the same at the district level.

The Student Privacy Compass at studentprivacycompass.org, maintained by the Future of Privacy Forum, tracks state-level student privacy laws and provides a searchable database by state and topic. The Parent Coalition for Student Privacy at studentprivacymatters.org publishes state law summaries and grades state frameworks on their coverage and enforceability. Before you contact a legislator, spend 20 minutes understanding what your state already has and where the gaps are. Going in with "my state has no SOPIPA equivalent and here is the California model" is more credible than a general ask for "stronger student privacy laws."

State legislators are significantly more accessible than federal ones. Many state legislators have small offices, answer constituent emails personally, and are genuinely influenced by a handful of well-prepared constituents raising a specific issue. The formula that works: identify yourself as a constituent with school-age children, name the specific issue (e.g., "our state has no prohibition on ed-tech vendors using student data for commercial purposes"), name the specific bill or model you'd like to see introduced or supported, and offer to provide additional information or meet. Keep it to one page. Follow up once if you don't hear back. Organizations like the Parent Coalition for Student Privacy periodically organize coordinated advocacy campaigns around specific state legislation — joining those amplifies individual contacts.

State legislative hearings on children's privacy and ed-tech regulation frequently include public testimony periods, and they are often poorly attended. A parent who shows up with a specific, factual story — "here is what I found when I requested my district's vendor contracts; here is what those contracts permit; here is why the current law does not address it" — is among the most persuasive forms of testimony available to a committee. Check your state legislature's website for the education and technology committee calendars. Bills that reach the hearing stage are at their most moveable; constituent testimony at that point can change outcomes in ways that letter-writing campaigns cannot.