Student Data Privacy for Online Course Creators

Student data privacy, for an independent course creator, means knowing what learner information you collect, being honest about why, keeping it secure and following the US laws that apply to your situation. FERPA mostly binds schools and the vendors they hire, not creators who sell directly to adults. COPPA, state laws and your own privacy policy still shape what you can do. This guide shows where each rule bites and what to put in place before your next sale.

Bibliowlteca

Build a More Trustworthy Course Business

Bibliowlteca helps creators publish and sell e-books, courses, and other digital products with tools for delivery, payments, and tax compliance.

Explore Bibliowlteca

TL;DR

FERPA protects education records held by schools. It reaches a course creator mainly when a school or university sends you student data under a contract.
If you sell directly to consumers, your duties come from your privacy policy, state consumer privacy laws and, for children under 13, COPPA.
Collect only what you need. Account, payment, progress, engagement and community data each need a stated purpose.
Most real-world violations come from third-party scripts, proctoring tools and open virtual classrooms, so audit every tool you add.
Publish a plain-language privacy policy that says what you collect, why, which vendors touch it and how learners can reach you.

What student data privacy means when you teach online
Does FERPA apply to you?
What learner data your course actually collects
Learning from real privacy failures
Children under 13 and COPPA
State laws worth knowing
Security practices that protect learners
What your privacy policy should say
Our perspective
Run your course on one platform
A practical checklist before your next launch
FAQ
Sources

What student data privacy means when you teach online

In the United States, the core idea is that information about a learner belongs to that learner, or to a parent while the learner is a minor, and anyone holding it must handle it for a stated purpose only. The central statute is FERPA, the Family Educational Rights and Privacy Act. The US Department of Education explains that it protects personally identifiable information (PII) in students' education records from unauthorised disclosure, and gives students the right to review their records, ask for corrections and limit disclosure.

That is the legal definition. In practice, an online course creator thinks about it more simply: every learner trusts you with a name, an email address and a payment, and then with a trail of behaviour. How far did they get? What did they score? What did they say in the community? Handling that trail carefully is both an ethical duty and a business asset, because buyers of educational content stay with sellers they trust.

Two questions decide most of your obligations:

Who are your learners? Adults buying for themselves, students enrolled through a school, or children under 13.
Who pays and who controls the data? You, directly, or an institution that has hired you to deliver learning.

The rest of this guide follows those two questions.

Does FERPA apply to you?

Only sometimes, and the dividing line is the school relationship.

FERPA is, in the words of the education-policy group New America, essentially technology neutral. It does not mention online learning specifically, and there is no official FERPA certification for third-party ed tech. Each institution must assess how a product affects its own ability to comply. So if a vendor, or a course creator, says it is "FERPA certified", treat that as marketing language, not an official status.

When a school sends you student data

Suppose a university or district licenses your course for its students and shares class lists or grades with you. That is the situation in which FERPA reaches your work. The Department of Education's guidance on online educational services says a provider can receive PII from education records under the school official exception. The conditions are that the provider:

performs an institutional service the school would otherwise use its own employees for;
meets the school's annual FERPA notification criteria;
is under the school's direct control over how records are used and maintained;
uses the records only for the authorised purpose and does not re-disclose PII.

The Future of Privacy Forum puts the point neatly in its guide for ed tech providers: although FERPA does not directly apply to service providers, student records a provider receives from a school are subject to FERPA. A provider acting as a school official must use the data only for the educational purpose in the contract, must not build profiles for advertising, must not collect more than necessary and must not share education-record information beyond approved subcontractors.

The school stays responsible too. The Department's vendor guidance says FERPA still governs PII disclosed under that exception and that the school or district remains responsible for protecting it. Expect a school to send you a data agreement, ask where data is stored and ask what happens at contract end. Answer those questions quickly and in writing.

When you sell directly to adults

If an adult buys your course from your own store, there is typically no school and no education record in the FERPA sense. FERPA is then not your governing rulebook. That does not mean there are no rules. Your privacy policy is a promise you can be held to, state consumer privacy laws may apply, and general security expectations still do. Treat FERPA's principles (purpose limits, access, correction, no sharing without a basis) as a sound design standard even where the statute does not demand them.

What learner data your course actually collects

Most creators underestimate how much they hold. A course business can quietly accumulate a detailed profile. One privacy-template publisher lists the typical categories: account, payment, progress, engagement, communication and marketing data, plus demographics from intake forms. The table below groups them with a practical question for each.

Data type	Typical examples	Question to ask yourself
Account	Name, email, profile photo	Do I need the photo, or is it optional?
Payment	Billing address, last four card digits, transaction history	Who processes it, and do I ever see full card numbers?
Progress	Lessons completed, time spent, quiz scores	Who can view individual scores besides the learner?
Engagement	Login frequency, pages viewed, video watch percentage	Is this tied to a named person or aggregated?
Communication	Support tickets, community posts, comments	Can learners delete their posts?
Marketing	Email opens, link clicks, segments	Did learners agree to this tracking?
Intake forms	Age, location, background	Is each question needed for teaching?

Why metadata counts

Behavioural metadata, such as how long a learner takes on a project or how many attempts they make, is easy to overlook. A professional analysis of online course provider agreements notes that metadata directly linked to a student is protected under FERPA when FERPA applies, while metadata stripped of all direct and indirect identifiers is not PII. The practical lesson: if you analyse behaviour, aggregate it or remove identifiers first. If you want to measure engagement without exposing individuals, our guide to course analytics and what to track shows which numbers protect revenue and outcomes.

Learning from real privacy failures

The cases that reached the news share a pattern. Rarely was a creator malicious. Usually a tool did something nobody had checked.

Session replay scripts. In 2018, researchers found that a popular grading service embedded a session replay script that sent student names, emails, grades and instructor comments to a third party. The company removed it within hours of being told.
Analytics leaks. In 2023, The Chronicle of Higher Education reported that a major courseware platform was sending a student's name, email and college to Google Analytics, contradicting its own privacy notice. It fixed the error after being notified.
Tracking tools on portals. A 2025 lawsuit alleges that students at a New Hampshire university had GPAs and contact details shared with advertising platforms through tracking tools on the student portal. These are allegations, not findings.
Proctoring breaches. In July 2020 a proctoring service suffered a breach in which sensitive details of 444,000 students were leaked, including home addresses and passwords. The same article describes strangers joining virtual classes.
Invasive monitoring. A federal judge in Cleveland ruled that requiring a student to scan his bedroom with a webcam before a test violated his Fourth Amendment right to privacy.

The lesson for a solo creator is not to fear technology. It is to keep a short list of every script, plugin and integration on your course pages and to know what each one receives. A tracking pixel placed on a lesson page can send a learner's identity to a third party without you ever seeing it.

Children under 13 and COPPA

If any of your learners could be younger than 13, a second federal law matters. COPPA, the Children's Online Privacy Protection Act, applies to operators of websites or online services directed to children, or with actual knowledge that children under 13 use them. Under the statute, those operators must give clear written notice of their collection practices, obtain verifiable parental consent, give parents a way to review their child's information and refuse further use, limit collection to what is reasonably necessary and protect confidentiality and security.

Five COPPA duties for child-directed course operators

The FTC's original rule, published in the Federal Register in November 1999, adds that operators must post prominent links to their notice, must not require a child to provide more information than reasonably necessary to take part, and must let parents review and delete a child's information.

One point trips people up. Education reporting notes that COPPA generally does not apply to schools or nonprofits but does apply to commercial operators of sites and apps directed at children under 13. A course creator is a commercial operator. If you teach coding to ten-year-olds, you are in COPPA territory. A common approach is to sell to parents, require an adult account holder and avoid collecting anything from the child directly. For a children's course, have a US privacy lawyer review the setup, because the rule has been updated since 1999 and details matter.

State laws worth knowing

Federal law is only part of the picture. Several states have student-specific statutes, and general consumer privacy laws add further rights.

California. SOPIPA applies to services designed and marketed for K-12 school purposes. According to a compliance guide, it prohibits targeted advertising with student data, profiling for non-school purposes and selling student information, and parental consent cannot waive those bans. The same guide reports that a 2026 amendment, AB 1159, adds a private right of action from 1 January 2027.
Texas. Texas Education Code section 32.151 restricts operators of platforms used for school purposes. A legal-industry guide says they cannot use covered information for targeted advertising, non-educational profiles or selling student data, and must keep reasonable security and delete data when a school contract ends.
Other states. The same guide notes that New York, Colorado, Illinois and Virginia have also enacted student privacy legislation, and that consumer laws such as the California Consumer Privacy Act and Colorado Privacy Act restrict profiling and automated decisions with significant effects.

If your learners are mostly adults in the general public, the consumer laws are the ones to watch. California residents, for example, may be entitled to rights to know, access, delete, correct and opt out of sale or sharing of their data. Whether a given statute reaches a small creator depends on thresholds such as revenue or the number of consumers, so check the current text for the states where your customers live.

If you also sell to European learners, a separate regime applies. Our GDPR checklist for course sellers walks through it.

Security practices that protect learners

A privacy promise is only as good as the security behind it. You do not need an enterprise team, but you do need a recognisable standard.

The Future of Privacy Forum advises providers to adopt a recognised framework such as the NIST Cybersecurity Framework or the CIS Controls. Aligning with one gives you tested controls: secure configurations, encryption, role-based access, detailed logging and routine audits.

Translate that into creator-sized habits:

Encrypt in transit and at rest. One industry guide cites TLS 1.2 as a minimum for data in transit and AES-256 for data at rest, and notes that FERPA requires institutions to record each disclosure of education records (34 CFR § 99.32). Ask your platform and email tools what they use.
Give people only the access they need. The same guide explains role-based access control, which assigns permissions to roles such as administrator, instructor and learner, and the principle of least privilege from NIST SP 800-53. If you have a virtual assistant, give them support access, not payment access.
Keep a vendor list. Write down every tool that touches learner data, what it receives and where its privacy terms are.
Delete on a schedule. Data you no longer hold cannot leak. Decide how long you keep inactive accounts, support tickets and community posts.
Control community spaces. Require login for live sessions and community areas so strangers cannot sit in on a class.

Also think about what you demand from learners. Proctoring that scans a home, or tools that capture face scans and voiceprints, raise the risks the research literature highlights. For most creators, project-based assessment or quizzes avoid the problem entirely.

What your privacy policy should say

Searchers often ask what a privacy policy for an online course needs. Legal publishers summarise the core as follows: explain what data you collect, why you collect it, how you use vendors and how users can contact you. That is the minimum. Education-focused policies commonly go further, and the FPF guide lists commitments such as using student information only for educational purposes, not selling it, avoiding behavioural advertising, retaining it only as long as necessary and giving notice before material changes.

A workable structure for a course creator:

What we collect. Use the categories in the table above, in plain words.
Why we collect it. Delivering the course, processing payment, issuing certificates, supporting you, sending course emails.
Who else sees it. Payment processors, email tools, video hosting, analytics. Name the categories, and name the vendors where you can.
What we never do. Only promise what you can keep. If you do not sell data, say so, and then make sure it stays true.
How long we keep it. Give periods or the rule used to decide.
Your rights. How to access, correct or delete data, and how California and other state residents can exercise their rights.
Children. State your age policy and what happens if a child under 13 signs up.
Changes and contact. How you announce updates, and a real email address that someone reads.

Write it for learners, not for lawyers. A short, readable policy that matches your actual practice protects you better than a long one copied from a template. Where your course involves post-purchase emails, check that your onboarding email flow matches what the policy says about marketing messages. If you offer refunds, make sure your refund policy and your data-retention promises do not contradict each other.

Our perspective

We built BibliOWLteca for people who teach, and teaching rests on trust. A learner who hands over an email address and a payment is trusting the creator, and the creator needs infrastructure worthy of that trust.

Our view is that a creator should not have to assemble payments, delivery, hosting and tax handling from half a dozen separate tools, each one a new place for learner data to travel. A single platform built specifically for educational content keeps that picture simpler: one storefront, secure digital delivery, course hosting with video and quizzes, and payment processing that runs through checkout rather than through ad hoc forms.

We also think the economics should leave room for good practice. With no monthly fee and charges only when you sell, a new creator can spend time writing a clear policy and choosing what to collect instead of paying for tools before the first sale.

Our advice is to start small. Collect what teaching requires, say plainly what you do with it, keep the tool list short and revisit it every time you add a feature.

BibliOWLteca

Run your course on one platform

If you want to sell courses, e-books, templates or mentorship without stitching together separate tools, BibliOWLteca gives you a customisable storefront, secure digital delivery, course hosting with video and quizzes, community features and analytics in one place. Payments run through our checkout in multiple currencies, with options such as Pix, SEPA and Klarna, and European tax compliance is built in. There is no monthly fee: our model is a transaction fee on completed sales, from €0.99. See the details on the pricing page.

Bibliowlteca

You can also browse what other creators sell in our product categories to see how a store can be laid out.

A practical checklist before your next launch

List every data type you collect, using the table above.
Decide which learners are covered by which rule: school-contract learners (FERPA terms in the contract), children under 13 (COPPA), and consumers in states with privacy laws.
List every third-party script and integration on your course pages and checkout, and what each receives.
Remove or aggregate anything you do not need, especially identifiable behaviour data.
Set access roles for anyone who helps you, and require login for community areas and live sessions.
Publish or update your privacy policy so that it matches reality, and put a working contact address on it.
Set a retention schedule and a simple process for access and deletion requests.
Recheck the list whenever you add a tool, a new market or a new age group.

FAQ

What is student data privacy?

It is the set of rules and practices that control how information about learners is collected, used, shared and protected. In the US, FERPA is the main federal law for school education records. Creators selling directly also rely on their privacy policy, state laws and, for under-13s, COPPA.

What counts as a student privacy violation?

Typical examples are sharing identifiable learner data with third parties without a lawful basis, leaking it through a breach, or letting strangers into a private virtual class. Reported cases include tracking scripts sending names and grades to outside servers and proctoring-service breaches. Whether something breaches FERPA specifically depends on whether education records held by a school are involved.

Is FERPA still in effect?

Yes. It remains a federal law, codified at 20 U.S.C. § 1232g with regulations in 34 CFR Part 99, and the Department of Education continues to publish guidance on it. Check that page for current updates.

Do I need a privacy policy for my online course?

If you collect names, emails or payments, yes, and many payment processors and ad platforms expect one. It should explain what you collect, why, which vendors you use and how to contact you. Have a lawyer review it if you teach children or sell to schools.