Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that personal information from students using the service in a U.S. school context may constitute education records under FERPA or equivalent state laws, and that collection and use of such Student Personal Data is governed by contracts with schools and applicable privacy law.
This analysis describes what Khan Academy's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that school-context student data may be subject to FERPA's protections and that Khan Academy's contractual commitments to schools govern the permissible scope of Student Personal Data use. Compliance teams at schools and districts should confirm that executed contracts with Khan Academy reflect the required FERPA protections and data use limitations.
Under this provision, personal information collected from students using Khan Academy in a school setting may qualify as FERPA-protected education records. The agreement states that use and disclosure of Student Personal Data is governed by contracts between Khan Academy and the school, and by applicable privacy law.
Cross-platform context
See how other platforms handle Student Personal Data and FERPA Compliance and similar clauses.
Compare across platforms →Monitoring
Khan Academy has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"When the Service is used as part of a US School's educational program, the personal information related to the School's student users ("School Users") may include information defined as "education records" by the Family Educational Rights and Privacy Act ("FERPA") or other information protected by similar state student data privacy laws. We refer to this information as "Student Personal Data". Our commitment: Our Website and services are designed to comply with applicable U.S. student data privacy laws. Our collection and use of Student Personal Data is governed by our contracts with Schools, by our Privacy Policy, and by applicable privacy laws. For example, we work with Schools to protect Student Personal Data consistent with FERPA.Excerpt from Khan Academy's Privacy Policy
1. REGULATORY LANDSCAPE: This provision directly engages FERPA (20 U.S.C. 1232g), which restricts the disclosure of student education records and requires schools to maintain oversight of third-party service providers handling such records. Applicable state student data privacy laws (including California SOPIPA, New York Education Law Section 2-d, and equivalents in other states) may impose additional restrictions on Khan Academy's use of Student Personal Data. The U.S. Department of Education holds FERPA enforcement authority; state education agencies hold authority over applicable state statutes. 2. GOVERNANCE EXPOSURE: Medium. The policy states that Student Personal Data use is governed by school contracts, which means the scope of permissible data use varies by the specific contract terms negotiated with each school or district. Institutions should not rely solely on the policy text to define their FERPA protections; the underlying contract terms are controlling. 3. JURISDICTION FLAGS: All U.S. schools receiving federal funding are subject to FERPA. State-specific student data privacy laws impose additional obligations that vary by state, with California, New York, and Illinois generally imposing the most stringent requirements. Districts in these states should evaluate whether their contracts with Khan Academy include state-law-specific data use limitations. 4. CONTRACT AND VENDOR IMPLICATIONS: School and district procurement teams should review Khan Academy contracts to confirm that Student Personal Data is defined consistently with FERPA and applicable state law, that permissible data uses are limited to educational purposes, and that Khan Academy is designated as a school official or contractor under FERPA as appropriate. The policy's acknowledgment that Student Personal Data use is contract-governed makes the specific contract terms the primary compliance instrument. 5. COMPLIANCE CONSIDERATIONS: Districts should maintain executed DPAs with Khan Academy as part of their vendor data governance records. Annual review of contract terms against any changes to Khan Academy's privacy practices, including the material change notification obligation stated in the policy, is advisable. School technology officers should confirm that School Accounts are properly established and recognized under the criteria stated in the policy, as the policy notes that accounts not meeting specific setup criteria may not be recognized as School Accounts.
Regulatory citations, enforcement risk, and due diligence action items.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision establishes that school-context student data may be subject to FERPA's protections and that Khan Academy's contractual commitments to schools govern the permissible scope of Student Personal Data use. Compliance teams at schools and districts should confirm that executed contracts with Khan Academy reflect the required FERPA protections and data use limitations.
Under this provision, personal information collected from students using Khan Academy in a school setting may qualify as FERPA-protected education records. The agreement states that use and disclosure of Student Personal Data is governed by contracts between Khan Academy and the school, and by applicable privacy law.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Khan Academy.