Education & Student Safety AI
MagicSchool AI
Medium riskTeacher-facing AI platform offering 80+ tools for lesson planning, differentiation, IEP drafting, and communication, plus a student-facing mode, widely adopted across K-12 districts.
Is MagicSchool AI safe for confidential data?
MagicSchool has one of the stronger compliance postures in classroom AI — SOC 2 Type II, iKeepSafe COPPA and FERPA certifications, a Common Sense Privacy Program Verified seal (93% rating), and published commitments that student data is not used to train models — but the risk profile depends almost entirely on how it enters a school. Under a signed district DPA it is a defensible choice; the common failure mode is individual teachers on free accounts pasting student work, grades, and IEP details into prompts with no agreement in place, which raises FERPA and IDEA questions the vendor's certifications cannot answer for the district.
Risk by plan
The same product often carries very different terms depending on the tier — consumer plans are where the exposure concentrates.
Same no-training policy, but no DPA with the district — a teacher pasting student work or IEP content is disclosing education records to a vendor the district has no agreement with.
Signed DPA, admin console, and district-level controls; this is the tier the FERPA School Official designation is designed to operate under.
Data handling
Training on inputs
MagicSchool states it does not permit third-party AI providers to use student data to train, fine-tune, or improve models, and does not sell student data. This applies across tiers; confirm the contractual version in your district's DPA.
Retention
Vendor states data is retained as long as needed to fulfill the processing activity; districts can negotiate deletion terms in their DPA. Free-account teacher data sits outside any district-controlled retention schedule.
Residency
No published residency guarantee; sub-processors are primarily U.S.-hosted. MagicSchool publishes a PIPEDA alignment statement for Canadian customers, but Canadian boards should still confirm cross-border transfer terms (and Quebec boards their Law 25 assessment) before deployment.
Compliance
- SOC 2Yes
- GDPR / DPAYes
- HIPAA BAANo
Certifications typically apply to specific tiers and contracts — confirm scope in writing before relying on them.
New to these frameworks? See our plain-language guides to SOC 2 and the other AI compliance standards.
Enterprise controls
- District DPA (customizable to state and local requirements)
- SSO / rostering integrations
- Admin console with usage visibility
- Content moderation on student-facing tools
- iKeepSafe COPPA and FERPA certifications
Frequently asked questions
Is MagicSchool AI FERPA compliant?
MagicSchool holds an iKeepSafe FERPA certification and signs district DPAs in which it acts as a School Official — under a district agreement, yes. FERPA compliance is a property of the deployment, not the product: a teacher using a free personal account has no such agreement, so pasting identifiable student work or IEP details into it is a disclosure the district has not authorized.
Is MagicSchool safe for students?
Its student-facing rooms run with teacher oversight and content moderation, the vendor states student data is not used for model training or sold, and Common Sense's privacy evaluation rates it 93% with a Verified seal. The residual risks are operational: age-appropriate rollout, parental notice where required, and keeping special-education details out of prompts unless the district's DPA covers them.
Our district hasn't adopted MagicSchool — are teachers using it anyway?
Almost certainly. It is one of the most-adopted teacher AI tools precisely because the free tier requires nothing from the district, and Canada's privacy commissioners' October 2025 joint resolution on edtech specifically targets this pattern of classroom tools arriving ahead of institutional review. The practical fix is to either sign the DPA and sanction it, or gain visibility into what staff are pasting into unsanctioned accounts.
Policy changelog
- Initial entry published from MagicSchool's published security documentation and cited coverage.
Sources
- MagicSchool privacy hub
- MagicSchool trust and data protection page
- Common Sense Privacy evaluation of MagicSchool
- iKeepSafe certification listing for MagicSchool
This profile summarizes the vendor's published policies as of the verification date. It is not legal advice.
MagicSchool AI is probably already in your organization.
Sanitized AI shows you who is using it and redacts sensitive data from prompts before it leaves your control.
More AI tool profiles
Chrome extension for teachers that layers AI onto Google Workspace and the sites they already use — generating feedback on student documents, creating materials, and replaying how a student's draft was written.
Consumer companion-chatbot platform where users chat with user-created AI personas; it has no education product, but is one of the most heavily used AI apps among teenagers.
District safety-monitoring service that uses AI plus human reviewers to scan student email, documents, and files in Google Workspace and Microsoft 365 for signs of self-harm, violence, and abuse.
Standalone AI-writing detector with a free web checker and paid tiers, widely used by individual teachers and professors to screen student work for AI generation.