Video Conferencing Privacy for Schools: A Procurement Guide
Video conferencing privacy for schools is settled before the first class starts: a district-approved tool, a signed data privacy agreement that keeps student data under the school's direct control, a documented risk review, and a plain-language notice to families. Teacher settings help, but they cannot fix a weak contract.
That order matters because the risk now sits with vendors as much as with classrooms. In the State of K-12 Cybersecurity 2026 report from CIS, MS-ISAC and CoSN, 51% of surveyed schools and districts reported a cyber incident in the past 12 months, and 34% said incidents affected school operations. Two-thirds of districts have just one or two people responsible for cybersecurity. Moody's Ratings, as reported by K-12 Dive, found that 57% of education-sector issuers it surveyed had suffered a third-party cyber incident since 2020, against 40% across all industries.
This guide to video conferencing privacy is written for the people who approve tools: principals, district technology leads, data privacy officers and school boards. If you are a teacher looking for classroom habits, read our companion piece on student data privacy in online learning instead; this article covers the institutional side and does not repeat that checklist.
In this guide
- Who is responsible for student data in a school video call
- What FERPA and COPPA expect from a video vendor
- A six-step approval workflow for video tools
- Contract criteria: what to get in writing
- Vendor questionnaire: 12 questions to send before you sign
- A school video conferencing policy template
- What to tell parents
- Where Meeyra fits
- Frequently Asked Questions
Who is responsible for student data in a school video call
Every live lesson creates personal data: names, faces, voices, chat messages, device and IP details, and, depending on the tool, recordings, transcripts and AI summaries. The legal question is who decides what happens to that data. In almost every system, the answer is the school or district, not the teacher and not the vendor.
| Setting | Who decides | Vendor's role | Contract you need | Typical signer |
|---|---|---|---|---|
| US public K-12 | District as the educational agency under FERPA | "School official" with a legitimate educational interest | Data privacy agreement (DPA) meeting state law | Superintendent or delegated officer |
| US private school receiving no federal funds | School under state law and COPPA | Operator under COPPA | Terms plus a DPA where state law requires | Head of school |
| International school in the EU or UK | School as controller under the GDPR | Processor | Article 28 data processing agreement | School leadership |
| Turkey | Ministry (public schools) or the operating institution (private schools) | Data processor under KVKK | Data processing contract | Ministry channel or school owner |
Two practical consequences follow. First, an individual teacher should not sign up for a free tool and invite a class. Click-through terms usually lack the controls FERPA and state laws expect. Second, a DPA only works if someone owns it: one named person who tracks the vendor's sub-processors, renewal date and deletion obligations.
What FERPA and COPPA expect from a video vendor
FERPA lets a district share education records with a vendor without parental consent when the vendor qualifies as a school official under 34 CFR 99.31(a)(1)(i)(B). The vendor must perform a service the district would otherwise use employees for. It must be under the district's direct control regarding the use and maintenance of the records. It must also follow the use and redisclosure limits of 99.33(a). Your annual FERPA notice must spell out who counts as a school official, as 34 CFR 99.7 requires, so check that your notice covers outsourced services.
"Direct control" is where most video contracts succeed or fail. If a vendor's terms let it change its privacy policy without telling you, keep recordings indefinitely, or use student data for product research outside the service, you cannot show direct control. The Department of Education's Privacy Technical Assistance Center covers this in Protecting Student Privacy While Using Online Educational Services and in its Model Terms of Service checklist, which lists warning signs to look for in vendor terms.
COPPA adds a second layer for students under 13. According to the FTC's COPPA FAQ, a school can consent in place of parents only where the operator collects data for the use and benefit of the school and for no other commercial purpose. The amended COPPA Rule, with a compliance date of April 22, 2026, requires operators to keep a written information security program and a written data retention policy. Ask vendors for both documents; a vendor that cannot produce them is not ready for an elementary school.
State law often goes further. In New York, Education Law 2-d requires contracts with third-party contractors that receive student data to include the vendor's data privacy and security plan and a signed Parents' Bill of Rights; NYSED publishes model forms on its data privacy and security page. You do not have to draft from scratch: the Student Data Privacy Consortium's National Data Privacy Agreement now underpins more than 222,000 signed agreements across 13,000+ districts and 35 state alliances. Search its registry first, because another district may already have signed with your vendor.
For international schools under the GDPR, the logic is similar but the paperwork has different names: an Article 28 processing agreement, a check on international transfers, and often a data protection impact assessment. Our guide to GDPR-compliant video conferencing covers those steps.
A six-step approval workflow for video tools
A repeatable workflow keeps video conferencing privacy decisions consistent from one school year to the next. It also gives you a paper trail when a parent or auditor asks why a tool was approved.
- Map the data. List what the tool collects in a normal lesson: account details, audio and video, chat, files, recordings, transcripts, AI summaries, and telemetry such as IP addresses. Mark what is optional.
- Check what you already have. Your state, your consortium or your learning platform may already include an approved video tool with a signed agreement. Adding a second tool doubles the work.
- Send the questionnaire. Use the 12 questions below and require written answers, not a sales call.
- Sign the agreement. Use the NDPA or your state template; attach the vendor's security plan and sub-processor list.
- Configure central defaults. Set recording, AI features, guest access and chat at the admin level before any teacher gets a license.
- Publish and review. Add the tool to your approved-tools list, update the parent notice, and calendar a yearly review of the agreement and sub-processors.
Contract criteria: what to get in writing
Use this table when you compare finalists. It reflects the institution's view of video conferencing privacy: what evidence to collect and when to walk away. For a quicker, classroom-level check, the teacher guide linked above has its own table.
| What to check | Evidence to request | Accept if | Walk away if |
|---|---|---|---|
| Data use limits | DPA clause on permitted purposes | Data used only to deliver the service | Advertising, profiling or "product improvement" with student data |
| Direct control and deletion | Retention schedule and deletion clause | Deletion on request and at contract end, with written confirmation | Vendor decides retention alone |
| Recordings and transcripts | Admin settings and storage terms | Off by default, admin can disable for all | Teachers cannot turn them off |
| AI features | Description of processing and model training | Optional, no training on student data, stated retention | Silent training or third-party AI with no contract |
| Sub-processors | Named list and change-notice clause | Advance notice of new sub-processors | No list, or "we may share with partners" |
| Data location and transfers | Hosting regions and transfer mechanism | Region and legal basis stated | Location "varies" with no safeguards |
| Breach notification | Incident clause with a deadline | Fixed notice period and contact | "Without undue delay" and no named contact |
| Security evidence | Independent audit report or certification | Recent third-party audit you can read | Only marketing claims |
| Student accounts | Join flow description | Guest links or school SSO, no personal profiles | Students must create consumer accounts |
| Exit plan | Export and termination terms | Data return, then deletion, within a fixed period | Data held after the contract ends |
A note on encryption: end-to-end encryption is valuable, but it is not a substitute for any row above. FERPA compliance depends on control, use limits and deletion, not on the cipher. Strict end-to-end encryption also rules out server-side features such as cloud recording or live AI translation, so ask vendors which mode applies to which feature.
Vendor questionnaire: 12 questions to send before you sign
Send these in writing and attach the answers to the agreement. Vague replies to questions 2, 5 and 9 are the most common red flags.
- What personal data does the service collect from students who join a lesson, including metadata such as IP addresses and device details?
- Do students need their own account, or can they join through a guest link or our single sign-on?
- Where is data stored and processed, and which countries can it be accessed from?
- Which sub-processors handle audio, video, chat, transcripts or AI features, and how will you notify us of changes?
- Is any student data used to train AI models, for advertising or for product research?
- Are recordings, transcripts and AI summaries off by default, and can an administrator disable them for the whole school?
- How long do you keep each data type, and how do we delete it on request and at contract end?
- How do you encrypt media in transit and data at rest, and which features are unavailable in end-to-end encrypted mode?
- What is your breach notification deadline, and who is our contact?
- Can you provide a recent independent security audit report?
- Will you sign our state's data privacy agreement or the NDPA without changes?
- How do parents exercise access and deletion rights through the school?
A school video conferencing policy template
A short video conferencing privacy policy beats a long one that nobody reads. Adapt this structure, keep it to two pages, and link it from your staff handbook and parent notice.
| Policy section | What it should say | Example wording |
|---|---|---|
| Scope | Which activities and people it covers | "Applies to all live online lessons, meetings with families and staff meetings that include student data." |
| Approved tools | Only listed tools may be used | "Staff may host only on tools listed on the approved-tools page." |
| Who may host | Roles that can create rooms | "Only staff accounts may host; students join as guests." |
| Joining | How students and families enter | "Share links through the learning platform or school email, never on public pages." |
| Cameras | Camera expectations and exceptions | "Cameras are encouraged, not required; teachers offer alternatives." |
| Recording | When recording is allowed | "Recording is off by default and needs written approval from the principal." |
| AI features | Transcripts, summaries and translation | "AI features are allowed only inside approved tools; third-party notetaker bots are not." |
| Chat and files | What may be shared | "No grades, health or discipline details in chat." |
| Incidents | What to report and to whom | "Report a suspected breach or intrusion to the data privacy officer within 24 hours." |
| Review | Who updates the policy | "Reviewed every year before the school year starts." |
Set the AI row deliberately. Translation and transcription can be legitimate accommodations, especially for multilingual families, but they create text records of minors' speech. Decide in advance who can see those records and how long they live.
What to tell parents
Families do not need the contract, but they deserve a clear summary of the school's video conferencing privacy commitments. Tell them which tool the school uses, what it collects, whether lessons are recorded, who can see transcripts, how long data is kept, and how to ask questions or request deletion. A short paragraph in your welcome letter works:
"Our school uses [tool] for live lessons and family meetings. Students join through a link and do not create personal accounts. Lessons are not recorded unless we tell you first. The school has a signed data privacy agreement that limits how the provider can use your child's information. Contact our data privacy officer at [email] with any questions."
Give parents a single contact for privacy questions. It also helps with family conferences, which bring their own scheduling and privacy questions; our guide to holding a parent-teacher conference online covers that format.
Where Meeyra fits
Meeyra is a browser-based video platform with real-time AI translation in 42+ languages, often used for multilingual lessons and family meetings. Run it through the same video conferencing privacy questionnaire as any other vendor. Here is what you will find:
- No student accounts. Students and parents join through a link in the browser as guests; only the host needs an account.
- Host-controlled rooms. The host can allow or block microphones, cameras, chat, translation and screen sharing for participants.
- Encryption in transit. Media is encrypted on its way to and from Meeyra's servers. Meeyra does not market itself as strictly end-to-end encrypted, because live translation requires server-side processing.
- Transient audio, text transcripts. Voice audio used for translation is processed in real time and not stored. When translation is on, the conversation is kept as a text transcript that you can ask us to delete.
- No meeting recording. Meeyra currently has no meeting recording feature, which takes one of the riskiest rows in the contract table off the list.
Frequently Asked Questions
Can a school use video conferencing without parental consent?
Usually yes. FERPA allows disclosure to a vendor acting as a school official under the district's direct control, and COPPA lets a school consent for students under 13 when data is used only for the school's educational purposes. State law or district policy may still require notice to families.
Will my child's online classes be recorded?
That depends on the school's policy, not on federal law. Many schools keep recording off by default and require approval for exceptions. Ask for the written policy, and ask how long any recording would be kept.
Who can see a transcript or AI summary of my child's lesson?
Only the people the school's settings and agreement allow, typically the host teacher and authorized staff. A transcript linked to a student and kept by the school or its vendor can become part of education records under FERPA. You can ask the school what it keeps and request access.
Where is my child's video and audio data stored?
The vendor's agreement with the school should state hosting regions and sub-processors. If the school's parent notice does not say, ask the data privacy officer; schools should have this answer on file before approving a tool.
Does end-to-end encryption make a platform FERPA-compliant?
No. Encryption protects data in transit, but FERPA compliance depends on use limits, direct control, deletion and redisclosure rules in the contract. A platform can be encrypted and still use data in ways a school cannot accept.
What happens to student data when the school stops using a tool?
A good data privacy agreement requires the vendor to return or delete student data within a fixed period after the contract ends and to confirm deletion in writing. If your agreement lacks this clause, add it at renewal.
Can teachers use free video tools with their own accounts?
They should not, unless the tool is on the approved list. Consumer terms rarely meet FERPA, COPPA and state contract requirements, and the school cannot show direct control over data it does not know exists.
What should a parent do if a video lesson seems insecure?
Report it to the teacher and the school's data privacy officer the same day, with the date, time and what you saw. Schools need these reports to meet their own incident and breach-notice obligations.
Video conferencing privacy is less about any single setting and more about the order of decisions: approve centrally, sign before you deploy, configure before teachers log in, and explain it to families in plain language. If you want to test a browser-based option with multilingual families, you can create a free Meeyra account and run it through your own questionnaire first.