Free Edtech and the Vetting a School Board Still Owes Students

Free edtech is a business model question, not a safety verdict. Some free products are paid for by institutions, some by an upgrade path, and some by advertising. Human Rights Watch reviewed 163 government-endorsed learning products in 2022 and found that 145 of them could surveil children. The model is the thing you vet.

TL;DR: The word free tells you who pays, not how a product treats children. Before any tool reaches students, get four documents: the advertising and third-party language in the privacy policy, the upgrade path, the field list for a child account, and a signed data privacy agreement with a retention period in it. Price is not one of the four.

Why we did not pay for it is the weakest sentence in an incident

A paid tool arrives through purchasing. A free tool arrives through a teacher on a Tuesday. That difference, not the price, decides whether your district ends up with a contract, a retention period, or any record that the product exists at all.

LearnPlatform by Instructure's 2026 Edtech Top 40 report puts districts at an average of 3,001 distinct digital tools they maintain access to, while students and educators each interact with about four. Most of that inventory was never voted on by anyone. As of 2026 the pattern is stable enough to plan around: if a story breaks about one of those tools, your exposure gets measured by what the district agreed to in writing, and a free tool with no agreement has nothing to point at.

The invoice decides your budget exposure and the agreement decides your privacy exposure, and free tools skip the second one by default.

Three ways a free product gets paid, and one of them is invisible

Ask which line of the vendor's revenue your students sit on. There are only a few honest answers, and each implies a different question.

May 2023 gave this a case. The Federal Trade Commission announced an order against Edmodo, a platform that was free to teachers, alleging it collected students' names, email addresses, dates of birth and phone numbers beyond what its service required, used persistent identifiers to serve advertising, and pushed its own COPPA notice and consent duties onto schools and teachers. The $6 million civil penalty was suspended because the company could not pay it.

One order binds one company. What transfers is the theory of the case: a vendor cannot make your teachers the consent mechanism for its data collection, and nobody's obligations got smaller because no invoice was issued.

If a free product's revenue line is advertising, your consent workflow is the product.

The four documents to have before a tool reaches students

This is a twenty-minute sequence and staff can run it. Ordered by how often each one changes the answer:

1. The privacy policy, searched rather than read. Search for advertising, sell, share, affiliates, profiling and third parties. You are checking what the policy permits, not what the founder intends.
2. The field list for a child account. Ask the vendor to name every field it stores on a student. Meta Typing Club is the one I can speak for: a teacher or parent creates the student account from a first name, a last name and the practice languages, no email is required for the child, and no age or date of birth is ever collected. The details of what a teacher-created student account actually stores should be answerable in one screen by any vendor.
3. Retention and deletion in writing, with a number in it. Our own answer here is incomplete and you should hear it from us rather than find it later: an adult can delete their own account in Settings and a child account is deleted by the parent, teacher or school that created it, but our published policy names no retention period.
4. The agreement. The Student Data Privacy Consortium's national agreement has been executed more than 222,000 times since 2016 on a template built with state alliances. Nobody sends you a bill for that template. What it removes is negotiation, which SDPC sizes at one hour for the district and one for the vendor per agreement, valued at an average of $250 an hour of legal time, so the number to put in your budget is your own counsel's hour. Illinois SOPPA requires a written agreement before covered information moves and public posting of each executed agreement within 10 business days. New York's Education Law 2-d requires the parents' bill of rights for data privacy and security in every contract with a third-party contractor that receives student data.

Run the sequence on us and it produces a mixed report, which is exactly why a board should run it. Meta Typing Club's privacy policy names no sub-processors and no retention period, while our public School Agreement states that student data is stored and processed in the United States; we cannot assert FERPA or COPPA compliance, and a vendor blog is not where you should accept one. There is no Clever, ClassLink or OneRoster integration either, so no district can upload a roster. What we can put in writing is narrower and checkable: the account fields above, homework with optional due dates, and per-student accuracy and words per minute for the teacher who assigned it.

A vendor that answers all four questions in writing has told you more than any certification badge will.

The strongest argument against a board-level checklist

A trustee reading privacy policies is doing a technology director's job badly. Districts with fully executed agreements still get breached. A vendor can answer honestly in March and add a sub-processor in June, and no signature on a template has ever stopped a single byte from moving.

That wins the technical argument. It loses the governance one. FERPA's school-official exception depends on the provider performing an institutional service under the district's direct control, using the data only for the purpose of the disclosure, and meeting the criteria set out in the district's annual notice; the Department of Education's student privacy guidance on the school official exception lists those conditions plainly. COPPA's school-consent route holds only where the information serves a school-authorized educational purpose and no other commercial purpose, per the FTC's COPPA guidance for edtech companies and schools. Both are contractual constructions. The paper is not a security control, and it was never meant to be. The paper is what makes the exception exist.

The practical form is policy rather than case-by-case review: a written adoption standard that staff apply the first time a tool touches a student, plus one inventory the board sees each year. If nobody in the building has the hours to run that across 3,001 tools, the honest agenda item is not vetting. It is how many tools a school your size should be carrying.

Key Takeaways

• Human Rights Watch reviewed 163 government-endorsed learning products in 2022 and found 145 of them could surveil children, so government endorsement is not a safety proxy.
• Districts hold access to about 3,001 digital tools on average, so a board sets one adoption standard rather than reviewing tools one at a time.
• The FTC's May 2023 Edmodo order alleged a free-to-teachers platform used children's data for advertising and outsourced its COPPA duties to schools; the $6 million penalty was suspended for inability to pay.
• Illinois SOPPA requires each executed student data agreement to be posted publicly within 10 business days, which makes the record checkable by any parent in that state.
• Budget an hour of your own counsel's time per agreement: that is the negotiation the Student Data Privacy Consortium's standard template removes, and its savings math values an hour of legal work at $250, which makes it a defensible line in a total-cost estimate.
• Four artifacts settle most of the question: advertising language, upgrade path, the child account field list, and a signed agreement naming a retention period.
• Meta Typing Club is free for individuals, families and parents with their own child; an independent teacher can evaluate on their own account at no cost and with no student limit; schools have published yearly plans, and districts and school networks receive a quote.

All four artifacts can be requested in a single email, and how fast a vendor sends them is itself a data point.

Questions a trustee asks before a vote

Does a free tool still need a data privacy agreement?

Yes, if it touches student records. FERPA's school-official exception and COPPA's school-consent route are both contractual, depending on written terms that limit use and keep the district in control. Price has no bearing on either. Illinois goes further and requires the executed agreement to be posted publicly within 10 business days.

How do I tell an ad-funded product from an institution-funded one?

Read the money, not the mission statement. Institution-funded products have a school price, even when it is quoted rather than published. Ad-funded products carry the permissions in their policy: targeted advertising, affiliates, profiling, sale or share. If a product has no price for anyone and no advertising, ask who pays the engineers.

What does the FTC's Edmodo order actually require of other vendors?

Nothing directly, because an order binds the company named in it. What transfers is the theory: the FTC alleged Edmodo collected more student data than its service needed, used it for advertising, and pushed COPPA notice and consent onto schools and teachers. Assume the agency will run that theory again.

Is Meta Typing Club free for our schools?

Only at a small scale. Individuals, families, parents with their own child and students learning on their own are free. An independent teacher can evaluate on their own account at no cost, with no student limit. A school can stay on School Free with 3 teachers, 3 classes and up to 9 students per class; School Plus is USD 250 a year and School Pro USD 500 a year, and districts and school networks receive a quote.

Should the board run this vetting, or should staff?

Staff run it and the board sets it. A trustee reading policies one app at a time cannot cover an inventory of roughly 3,001 tools. What scales is a written adoption standard applied when a tool first touches a student, plus one annual inventory report to the board, with the exceptions named.

What to do with this at your next meeting

Free is a funding arrangement, and it says nothing about the child record, the retention period or who else sees the data. Put the four artifacts into your adoption standard and require them of every vendor, including us: the advertising language, the upgrade path, the field list for a child account, and a signed agreement with a retention period. Then hold our mixed report against it. If your elementary grades are the pressure point, look at the grade-band keyboarding lesson sequence, read how to design a six-week classroom pilot that produces evidence, and ask us for a school access quote in writing before anything reaches a vote.

A board that cannot price a tool can still govern it, and the written standard is how.