Parent Opt-Out Policy: Student Monitoring, FERPA, and District Rights

Key Takeaways

You can opt your child out of certain surveys and data collection, but not everything under FERPA gives you that right

Under COPPA’s 2026 overhaul, the “school authorization exception” still exists — but only for purely educational use

PPRA gives you the strongest opt-out protections for mental health screenings and surveys covering sensitive topics

Over 121 state laws now protect student privacy, and many states give parents even more control than federal law requires

The Lower Merion case (2026) shows parents actively suing districts that repeal opt-out policies — the legal landscape is still evolving

Parents’ Rights Are Real — But They’re Not Unlimited

Here’s what most parents don’t realize: the laws that protect your child’s privacy don’t all work the same way, and not every one of them gives you an opt-out right.

If your school district installs real-time student monitoring software, scans student typing patterns, or collects behavioral analytics from your child’s laptop, you’re not powerless — but you do need to know which law applies, what you can opt out of, and how to file a complaint if the district ignores you.

This isn’t theoretical. As of mid-2026, the U.S. Department of Education is actively investigating districts that have denied PPRA opt-out requests. Seven families in Pennsylvania have filed a federal lawsuit after their district voted 7-2 to repeal a parent opt-out for school-issued devices. The debate is live, and the outcome will reshape student privacy for millions of families.

Let’s break down exactly what you can opt out of, what you can’t, and what your district is required to tell you.

What FERPA Actually Lets You Opt Out Of

The Family Educational Rights and Privacy Act (FERPA) is the oldest and most well-known student privacy law. It was enacted in 1974, and it’s enforced by the Department of Education — not the FTC. But here’s where most parents get confused: FERPA does not provide a universal opt-out clause for real-time monitoring or active surveillance.

What FERPA lets you opt out of:

Directory information sharing — the public disclosure of student records to outside organizations
Disclosure of education records — your child’s actual transcripts, grades, disciplinary records, and health records shared with third parties

What FERPA does NOT let you opt out of:

Real-time student monitoring — if the software is used by the school as a “school official” under FERPA’s internal exception, the district can share education records with that software without parent consent
Active surveillance tools — screen recording, typing-pattern analysis, and behavior monitoring fall under the “school official” exception
Annual notifications — districts must notify parents of their FERPA rights every year, but they don’t need individual consent to collect data

The “school official” exception is the loophole that makes most real-time monitoring tools legally permissible under FERPA. If your district contracts with a monitoring platform and it’s used for educational purposes — academic integrity, classroom management, or student engagement — that vendor is considered a “school official” and can access student education records without your permission.

Practical reality: If your district uses monitoring software that analyzes student activity during exams or assignments, FERPA alone doesn’t block that. You’d need PPRA or a state-specific law to challenge it.

COPPA 2026: What Changed for Parents

The Federal Trade Commission’s COPPA overhaul took full effect on April 22, 2026, and it significantly narrowed how EdTech vendors collect student data. Here’s what actually changed:

Before 2026: Schools could broadly consent on behalf of parents for almost any data collection from children under 13 — a catch-all “school authorization” that covered educational tools of every type.

After April 2026: The school authorization exception still exists, but only for purely educational purposes under district control. If an EdTech vendor uses student data for product improvement, behavioral analytics, commercial profiling, or AI model training, school consent is null and void.

What parents can now opt out of:

Commercial EdTech data collection — if the tool uses student data beyond the core educational feature, vendors must obtain verifiable parental consent
AI training data — disclosures of children’s personal information to third parties for AI training now require separate parental consent under amended 16 CFR 312.5(a)(2)
Third-party data sharing — vendors can no longer bundle data disclosures into broad consent; each third-party disclosure needs its own parental permission

What parents still can’t opt out of:

Purely educational tools — if the software is used only for classroom instruction, the district still acts as the “parent” for data collection purposes
Core monitoring features — typing patterns, screen capture, and video monitoring during tests remain permissible if used only for academic integrity

The bottom line: COPPA 2026 didn’t give parents a blanket opt-out right. It tightened the rules around what “educational use” means and cracked down on vendors trying to sneak commercial data collection behind the school exception.

According to the FTC’s compliance guidance, penalties for COPPA violations now reach $51,744 per affected child — and the agency has signaled intense enforcement against EdTech operators who treat children’s privacy as optional.

PPRA: The Law That Actually Gives Parents Strong Opt-Out Rights

The Protection of Pupil Rights Amendment (PPRA) is the most powerful federal opt-out tool available to parents, and it’s rarely used because most parents don’t know it exists. PPRA applies when schools administer surveys, questionnaires, or assessments covering eight protected categories:

Political affiliations of the student or parent
Mental or psychological problems of the student or family
Sexual behavior or attitudes
Illegal, anti-social, self-incriminating, or demeaning behavior
Critical appraisals of other individuals with close family relationships
Legally recognized privileged relationships (lawyers, physicians, ministers)
Religious practices, affiliations, or beliefs
Student or parent income (with exceptions)

PPRA opt-out thresholds depend on federal funding:

Federally funded programs — schools must obtain written parental consent (opt-in) before administering surveys covering the protected categories
Non-federally funded programs — schools must provide notice and an opportunity to opt out

The Department of Education has been actively enforcing PPRA in 2026. In August 2026, the ED’s Student Privacy Policy Office issued a Dear Colleague Letter clarifying that behavioral health screeners fall under PPRA’s “protected information” category. The ED partnered with the DOJ to expedite enforcement investigations and warned that violations can result in complete termination of federal funding.

What PPRA gives you:

Right to inspect — you can examine the questions, materials, and instructional tools before your child takes them
Right to opt out — if the screening isn’t federally funded, you can opt your child out of any survey covering the eight categories
Annual notice — districts must distribute a PPRA notification at the start of each school year with the approximate dates of scheduled screenings

Important: Mental health screenings now require mandatory written parental consent in many states, and the ED has already initiated investigations into Colorado and Washington districts for failing to honor PPRA opt-out requests.

The Lower Merion Case: What It Means for Parent Opt-Out Rights

The Lower Merion School District in Pennsylvania is the most visible case study in parent opt-out rights right now — and it ties together every legal issue covered in this guide.

The background: Lower Merion has a history. In 2010, the district paid $610,000 to settle lawsuits after school-issued laptop webcams were found secretly recording students inside their homes — the infamous “WebcamGate” case. The district maintained a parent opt-out policy for its school-issued devices starting in 2010.

The 2026 reversal: In June 2026, the school board voted 7-2 to repeal the opt-out policy. Over 600 parents signed a petition titled “Pencils Over Pixels” arguing that the devices — Chromebooks, MacBooks, iPads — had become too invasive. More than 430 parents formally requested opt-outs for their children.

The district’s defense: School officials stated that full opt-out was “not feasible” because the curriculum is delivered digitally. They argued that technology has become so intertwined with learning that you cannot realistically participate in the curriculum without a device.

The lawsuit: Seven families filed a federal lawsuit alleging the district violated their children’s Fourteenth Amendment due process rights — the constitutional right of parents to direct the care and education of their children. The case is being backed by Pencils Over Pixels, an advocacy group representing families who want to opt out of EdTech surveillance.

What happened next: By August 2026, the district had passed a new tech policy that limited screen time and scaled back device usage for younger students. But the opt-out repeal stood — and the lawsuit continued.

Why this matters to every parent: The Lower Merion case puts the central question to court: can a school district repeal an opt-out policy if technology has become “essential” to the curriculum? Courts haven’t ruled yet, and the answer will affect districts nationwide.

As the Washington Post reported in May 2026, at least 14 states have proposed laws limiting screen time in schools, and four states — Alabama, Tennessee, Utah, and Iowa — have already passed such legislation.

The State Patchwork: 121+ Laws Protecting Student Privacy

Beyond the three federal laws, the state landscape is even more complex. More than 121 state laws now protect student privacy, and many provide opt-out rights that federal law doesn’t.

Notable state protections:

New York: Education Law 2-d mandates a parent bill of rights that includes detailed opt-out provisions for student data collection
California: SOPIPA (Student Online Personal Information Protection Act) restricts vendor data use and sharing, and gives parents stronger opt-out rights than FERPA provides
Utah: Statute 53E-9-203 requires parental consent for all surveys covering PPRA-sensitive topics, regardless of federal funding source. Parents must be given at least two weeks’ notice to inspect instructional materials
Colorado and Washington: Both states have had districts investigated by the ED for failing to honor PPRA opt-out requests — state courts are beginning to hear cases that could expand opt-out rights
Multiple states: Require parental consent for surveys covering PPRA topics regardless of whether the program is federally funded, closing the federal “opt-out vs. consent” gap

The practical implication: Even if federal law doesn’t give you a specific opt-out right, your state law might. Check your state’s student privacy statute — the rights vary significantly depending on where you live.

FERPA / COPPA / PPRA Comparison: What You CAN Opt Out Of

Here’s the single most useful table for parents navigating student privacy law. It shows exactly what you can and cannot opt out of under each major law.

Protection Area	FERPA	COPPA (2026)	PPRA
Real-time student monitoring	❌ No opt-out right (school official exception)	⚠️ Only if not purely educational	❌ Not applicable
Screen recording / typing analysis	❌ No opt-out right	⚠️ Only if not purely educational	❌ Not applicable
Surveys covering mental health	❌ No opt-out right	⚠️ Only if not purely educational	✅ Strong opt-out right
Surveys covering political/religious beliefs	❌ No opt-out right	⚠️ Only if not purely educational	✅ Strong opt-out right
Directory information sharing	✅ Opt-out of public disclosure	⚠️ Not applicable	❌ Not applicable
Third-party data disclosure	✅ Opt-out of disclosure	✅ Separate consent for non-educational sharing	✅ Opt-out of marketing surveys
Inspection of instructional materials	❌ Limited right	⚠️ School may review vendor notice	✅ Full inspection right
Annual district notification	✅ Required	✅ Required for school authorization	✅ Required annually

How to read this table:

✅ Means you have a clear opt-out or consent right
⚠️ Means it depends on whether the tool is purely educational — the vendor must prove educational use
❌ Means no federal opt-out right exists for that activity

Key insight: The PPRA column shows the only law that gives parents direct opt-out rights for surveys and screenings. FERPA and COPPA are more about consent mechanisms and disclosure limits. That’s why PPRA matters most for parents trying to opt their children out of mental health screenings, college readiness surveys, and social-emotional assessments.

Practical Steps: How to Exercise Your Opt-Out Rights

You don’t need to be a lawyer to assert your child’s privacy rights. Here’s a step-by-step guide to exercising opt-out protections:

1. Review Your District’s Acceptable Use Policy (AUP)

Every district publishes an AUP — but most parents never read it. Look for:

Student data collection practices
Third-party vendor list
Opt-out procedures
Annual notification dates

2. Send a Written Opt-Out Request

If your district administers surveys covered by PPRA, send a formal written request to the district’s administration or principal. Include:

The date you’re exercising the opt-out
The specific law (PPRA, COPPA, or state statute)
The activity you’re opting out of
A request for confirmation of receipt

Keep a copy. Send it via email with read receipt, or via certified mail.

3. File a Complaint if the District Ignores You

If the district denies your opt-out request or fails to respond:

FERPA complaint: File with the Department of Education’s Office of the Secretary
PPRA complaint: File with the ED’s Student Privacy Policy Office
State complaint: Many states have their own student privacy complaint processes

4. Check State-Specific Provisions

Your state law may give you stronger rights than federal law. Search “[Your State] student privacy opt-out law” — many states have statutes that go beyond FERPA and PPRA. For example, Utah requires two weeks’ notice for inspection; New York mandates a parent bill of rights.

5. Ask About Vendor Data Practices

During procurement season, ask your district:

What data is collected through EdTech tools?
How is that data stored?
Who has access to it?
How long is it retained?
Is it used for anything beyond classroom instruction?

If the district cannot answer clearly, that’s a red flag. The FTC has warned that a one-time, blanket sign-off may not count as valid notification under COPPA, especially if it doesn’t list the specific services students will use.

Related Guides

If you want to dive deeper into student privacy compliance, the following articles provide additional detail:

FERPA, COPPA, and State Privacy Laws for K-12: A Combined Compliance Guide — comprehensive coverage of all three federal laws and state statutes
EdTech Surveillance: What Parents Need to Know in 2026 — practical parent perspective on classroom monitoring tools and data collection practices

Bottom Line

The law is not on the side of parents who assume every student monitoring practice is off-limits. FERPA doesn’t block real-time classroom monitoring. COPPA still lets schools authorize educational tools. But PPRA gives you strong opt-out rights for surveys and screenings, and many state laws go even further.

Your district may tell you that opting out is “not feasible.” That was Lower Merion’s defense. But the law doesn’t say the district gets to decide what’s convenient — it says what the law requires. Know which law applies, know what you can opt out of, and know how to file a complaint if the district ignores you.

The Lower Merion lawsuit will reshape this territory. Until it does, you have more leverage than you think — if you know where to use it.