ETLA Safe

Learn21 powers the EdTech Leaders Alliance (ETLA), a member driven organization focused on empowering educators with the knowledge and skills required to transform education through the purposeful and safe use of technology. ETLA is a CoSN Chapter, ISTE Partner, SDPC Alliance, SETDA Affiliate, and NCTET Member.

We know Microsoft 365 is part of daily life in many of your districts, so here’s where things stand. Microsoft hasn’t signed the NDPA yet, and we’re actively negotiating a DPA for Microsoft 365 Education Core Online Services on your behalf. Our goal is a signed agreement every ETLA member district can use, and we’ll share it as soon as it’s final. Thanks for your patience, and reach out to your ETLA Data Privacy Strategist with any questions.

Wondering which Microsoft tools are covered? You’ll find the Core Online Services list, including the services in Microsoft 365 for Education, here: https://www.microsoft.com/licensing/terms/product/PrivacyandSecurityTerms. Your ETLA Data Privacy Strategist is happy to help you find what applies to your district.

Google has not signed a Data Privacy Agreement (DPA). We’re actively negotiating a Data Privacy Agreement (DPA) with Google Workspace for Education - Core Services. A legal review of Google Workspace for Education Terms of Service was conducted in October 2025 by ETLA legal partners (TEC) and at that time found that Core Services met the requirements of the Ohio NDPA. 

Additional Services, such as YouTube, do not meet the NDPA requirements. Before students under 18 use any Additional Service, districts must obtain parental consent to be compliant with FERPA. Other Google products are not approved for use without that consent.

Wondering which Google tools count as Core Services? Google keeps the current list here: https://workspace.google.com/intl/en/terms/user_features.html

We also recommend that every LEA review and accept Google’s Cloud Data Processing Addendum (formerly the Data Processing Amendment). A Google super administrator can accept it in the Admin console. Need help finding it? Your ETLA Data Privacy Strategist is happy to walk you through it.

Here’s a quick look at the laws that shape how student data is protected:

• FERPA is a federal law that protects student education records. Its school official exception allows schools to share those records with vendors, without parent consent, when the vendor stays under the school’s direct control.
• COPPA is a federal law that governs how companies collect personal information online from children under 13. Schools may consent on behalf of parents when a tool is used only for the school’s educational purposes and for no other commercial purpose.
• Ohio SB29 adds state requirements. Student data belongs to the school district, not the technology provider. Parents receive notice about vendor contracts, and monitoring of school-issued devices is limited.

Before you stop using a product, export any records you need to keep. Then send the vendor Exhibit D of the NDPA (Directive for Disposition of Data) to request deletion or return of all student data, and ask them to sign the verification and send it back. Turn off all accounts and integrations, update your registry and approved tools list, and file the signed Exhibit D with your records. Your ETLA Data Privacy Strategist is ready to help with any step.

Confirm with the vendor what data was involved and which students were affected. Then follow your district’s approved incident response plan, and share everything you receive from the vendor with your ETLA Data Privacy Strategist. Throughout the process, keep a record of every step you take. You don’t have to handle this alone, and we’re ready to help. *Familiarize yourself with your district’s incident response plan prior to an event occurring. 

We know many of you use Adobe, so here’s where things stand. Adobe hasn’t signed the NDPA yet, and we’re actively negotiating a DPA on your behalf. Our goal is a signed agreement every ETLA member district can use. As soon as it’s final, we’ll share it along with the list of covered products. Thanks for your patience, and reach out to your ETLA Data Privacy Strategist with any questions.

We know many of you rely on Apple, so here’s where things stand. Apple has not signed the NDPA, and states that it doesn’t collect student data unless a district uses Apple School Manager. If your district uses Apple School Manager, we recommend reviewing the Apple School Manager Agreement (Section 3 and Exhibit A cover student data) and posting it with your approved tools. We’ll keep asking Apple to sign a DPA each year and will share any updates. Questions? Your ETLA Data Privacy Strategist is happy to help.

Great question. We don’t recommend Google Forms for parental consent, because it can’t reliably confirm that the person giving consent is actually the student’s parent or guardian. The good news: your ETLA Data Privacy Strategist has sample consent forms that meet this requirement and is happy to share them.

A DPA is required before any student data is shared with a vendor that provides a service. That includes any tool students log in to, whether through single sign-on or by entering their name and email. It also includes tools where teachers or staff log in and share student personally identifiable information (PII), such as names, grades, or student work. If you’re unsure about a tool, your ETLA Data Privacy Strategist is ready to help.

Yes, and it’s a great question. Whether a tool is free or paid doesn’t change the answer. If it collects, accesses, or processes student data, it needs a DPA. Free tools often collect just as much student information as paid options. Not sure about a specific tool? Your ETLA Data Privacy Strategist is happy to take a look.