Data and information privacy
Data privacy remains one of the most important aspects of implementing any digital tool, and generative AI introduces new complexities.
The AZ AI Alliance Privacy Checklist
Responding to a frequently shared need — how do we vet an AI-powered tool for privacy and ethics? — the Alliance worked with practitioners and experts around the state and the country to build a checklist schools and districts can send to prospective vendors, or to vendors adding generative features to a product you already bought.
Get your own copy of the Privacy Checklist
Opens a Google Doc and makes a copy in your own Drive. The Alliance does not see your copy and does not collect anything.
What changes when the tool is generative
Given how generative AI systems use data, they can store, process, or disclose personally identifiable information, and schools should not assume that a platform's privacy practices adequately address legal mandates. Some platforms retain prompts, uploaded content, or user interactions to train models or improve performance — which is exactly why vendor review has to be rigorous rather than procedural.
In Arizona, schools and districts also have a responsibility to honor the data authority of the state's 22 sovereign tribal nations. Schools serving tribal communities or tribal citizens should engage with tribal leadership and consider each tribe's laws, agreements, protocols, and expectations related to data and AI.
The second risk is not the system at all — it is the user. The personal, almost human-like feel of a chatbot makes people more willing to share private information than they would with a form. This "illusion of privacy" is not hypothetical. Without a clear understanding of how a tool collects, stores, and uses data, staff and students are drawn into sharing details better kept private.
Risks
- Use of certain tools may place a school or district at risk of violating student privacy laws or contractual obligations.
- Sensitive data that is not properly classified within protected systems may be mishandled by AI tools.
- Generative AI may introduce new cybersecurity risks, including breaches, hacking, or unauthorized access that compromise student data.
- Publicly available information may be collected, aggregated, or reused by AI systems in unintended ways.
- Use of GenAI in schools may raise concerns among families, communities, or tribal nations regarding privacy, trust, and data sovereignty.
Relevant policies in the US and Arizona
| Provision | What it asks of a district |
|---|---|
| CIPA — Children's Internet Protection Act | Ensure AI tools and platforms align with internet safety policies, web filtering, monitoring requirements, and provisions protecting students from harmful content. |
| FERPA — Family Educational Rights and Privacy Act | Safeguard student education records. Train staff to manage records securely and to avoid disclosing personally identifiable information without proper consent. |
| COPPA — Children's Online Privacy Protection Rule | Consider age requirements, parental consent obligations, and vendor practices for collecting and sharing personal information from children under 13. |
| PPRA — Protection of Pupil Rights Amendment | Be mindful of AI tools or activities that request student information in protected areas, and follow applicable notice and consent requirements. |
| A.R.S. § 15-142 | Ensure the use of generative AI safeguards student directory information and school property data. |
| A.R.S. § 15-117 | Follow survey protocols, obtain parental consent where required, and maintain informed consent procedures when using GenAI tools. |
| A.R.S. § 15-1046 | Implement robust student data privacy measures to protect sensitive information and secure student data confidentiality. |
Vetting a tool is action one of the 3ssential.
The checklist is most useful before a tool reaches your approved list and before staff share data with the vendor.