How shared privacy agreements can help more schools access digital reading resources
By Alana Winnick, Data Protection Officer and Educational Technology Director at Pocantico Hills Central School District
When I think about how technology earns its place in a classroom, I think about what it makes possible for learners. Does it provide access, enhance an experience, or transform what students can do? A student might use text-to-speech to access a book they could not yet read independently, or speech-to-text to express ideas that are difficult to put on paper. A creation tool might allow students to bring their thinking to life through a digital book, podcast, or video, making choices about how to communicate what they know. The value comes from how the technology supports the learner and the purpose of the experience. Those are the possibilities that make me excited about educational technology, and exploring them comes with a responsibility to understand how the tools we choose collect, use, and protect student information.
In our district, privacy compliance comes first. We begin by checking whether a tool meets applicable state and federal requirements, including the Children’s Online Privacy Protection Act (COPPA), which governs how covered online services collect and handle personal information from children under 13, and the Family Educational Rights and Privacy Act (FERPA), which protects education records. In New York, Education Law 2-d adds requirements for protecting student information. Our privacy review considers how those requirements apply to the tool and how we plan to use it. If it does not meet them, we stop there. Once it passes that review, we evaluate if it fits within our curriculum and budget before adding it to our inventory of approved tools. Completing those reviews takes time and expertise, and trusted support can help districts work through them.
During this review, we look closely at what happens to student information when a tool is used in the classroom. What information does it need, and is it collecting anything beyond that? For a digital reading platform, this might include which books a student opens or how much time they spend reading. That information can help teachers suggest books or plan conversations, but we need to know who can access it, how it can be used, and how long it is kept. We should also understand how the company protects information, how it will notify the school if someone gains unauthorized access, and what happens to student work when the school stops using the product. If a tool includes AI features, I would ask whether student information can be used to train its models. A company should be able to explain these practices clearly.
For me, this work used to involve relying heavily on our district’s own data privacy agreement, or DPA, and asking companies to sign it before moving forward. The agreement puts those expectations into writing and establishes the company’s responsibilities for protecting student information. Having those expectations in writing is essential, but getting an agreement signed can take time. A company may request changes, often called redlines, which then need to go back to the district’s attorney for review. That back-and-forth can add legal costs and delay access to a tool. My recommendation has always been to work with your attorney on a clear, established agreement that covers the required protections without introducing unnecessary complexity.
I also leaned heavily on state and regional agreements whenever they were available. Before beginning a separate negotiation, I wanted to know whether an organization we trusted had already done that work and whether our district could participate. In New York, Boards of Cooperative Educational Services (BOCES) and Regional Information Centers (RIC) support districts with student data privacy and vendor agreements, with RIC One helping coordinate that work. In other states, similar support may come through regional education service agencies, service centers, statewide privacy alliances, or state education departments. The names and services vary, but having access to that expertise can make a difference.
That same collaborative approach can extend across the country through the Student Data Privacy Consortium (SDPC), which is part of the Access 4 Learning Community. SDPC brings schools, technology companies, education organizations, and privacy professionals together to establish shared expectations for protecting student information. Its National Data Privacy Agreement provides a common starting point while allowing for state-specific requirements. If your district’s legal team permits shared agreements, SDPC’s Resource Registry can help you find one already in place for a tool you’re considering. For districts with limited staff, reducing that back-and-forth could make it more manageable to review educational technology and bring useful resources into classrooms.
When districts have support with the privacy review process, they can spend more time considering what a tool could make possible for their students. That brings us back to the learning opportunities that prompted us to explore it in the first place. Take Epic as one example. A digital reading platform can put thousands of books at students’ fingertips, giving them room to follow their curiosity, read to learn, and read for fun. A student interested in space can explore more books about the planets, while another might discover a new author or a type of story they haven’t tried before. Alongside the books they borrow from the school library, that choice can help students find something they want to read and keep coming back to it.
Access also means being able to engage with the content. Epic’s books in other languages, Read-To-Me titles, and audiobooks offer additional ways to support multilingual learners and students with learning differences. The opportunity extends beyond having a book available to having a way into its stories and ideas. This is how I think about intentional technology: start with the learner and ask what becomes possible with the right support. Can a student explore an interest further? Read with greater independence? Share an idea they have struggled to express? Those questions should guide the tools we choose and how we use them.
The privacy work is part of delivering on that purpose. When districts can build on shared agreements with their legal teams’ approval, we can put less time into repeating the same negotiations and more into making thoughtful choices for students. Every agreement represents a responsibility to the children who will use that tool. We owe them both the protection of their information and the opportunity to see what they can do.
A Note from Epic:
Looking for Epic’s Data Privacy Agreement (DPA)? Visit the Student Data Privacy Consortium (SDPC) to search for Epic and explore available agreements. Schools and districts can use this resource to support their privacy review and determine whether an existing agreement meets their requirements.
Frequently Asked Questions
▶ What is student data privacy in schools?
Student data privacy means protecting information that identifies or relates to students, including information collected through educational technology. Schools review how digital tools collect, use, share, store and delete student information before approving them for classroom use.
▶ What is the Student Data Privacy Consortium?
The Student Data Privacy Consortium (SDPC) is part of the Access 4 Learning Community. It brings education and technology stakeholders together to support student data privacy. Its National Data Privacy Agreement establishes common expectations for handling student information while accommodating state-specific requirements.
▶ What should schools ask technology providers about student data privacy?
Schools should ask what student information a tool collects, why it needs that information, who can access it and whether it is shared with others. The review should also address security, retention, breach notification and deletion when use ends. For tools with AI features, schools should ask whether student information is used to train AI models.
▶ Where can schools find Epic’s data privacy agreement?
Schools and districts can visit the SDPC Resource Registry to search for Epic and explore available data privacy agreements. A district’s privacy or legal team should review the applicable agreement to determine whether it meets local requirements.
