To evaluate a virtual classroom for FERPA and accessibility, review its data practices and contract terms, request a current Accessibility Conformance and VPAT Report, and test essential classroom tasks. Together, these checks help a district assess privacy protections and whether students with disabilities can participate.
A district needs attendance data, participation records, and recordings to support teaching and student services. Each capability also raises questions: who can access the information, how it is used, and whether students can use the tools that generate it.
This article helps Directors of Virtual Learning, IT leaders, and accessibility teams organize that review before selecting a platform. It covers the school official exception under the Family Educational Rights and Privacy Act (FERPA), Child Online Protection Act (COPA), the Americans with Disabilities Act (ADA) Title II web rule, and the evidence to keep in the procurement file.
FERPA protects student education records and places obligations on covered educational agencies and institutions. Under the school official exception, a vendor receiving records must perform an institutional service the district would otherwise use employees to provide, remain under district control over the use and maintenance of records, and follow applicable use and redisclosure restrictions. The vendor must also meet the school official and legitimate educational interest criteria in the district’s annual FERPA notice. [1]
A written agreement helps establish responsibilities and direct control. FERPA does not universally require a contract under this exception, although state laws or local procurement rules may require one. District counsel should assess the agreement alongside the vendor’s practices and the district’s intended use. [2]
Education records are directly related to a student and maintained by the district or a party acting for it, subject to the exclusions in FERPA’s definition. Identify what the platform collects, including information generated by optional AI features. [1]
|
Data type |
Question for the vendor |
|---|---|
|
Class recordings |
Who can view, download, share, and delete recordings? How are access requests involving multiple students handled? |
|
Chat and shared work |
Which messages and files are retained, who can access them, and how does the district export or delete them? |
|
Attendance and engagement analytics |
Which student identifiers and participation events are stored? Are they used beyond the authorized educational purpose? |
|
AI inputs and outputs |
Which prompts, transcripts, summaries, and outputs are retained? Which providers receive them, and may they be used for model training? |
Recordings need a case-specific assessment. A student’s incidental appearance in the background does not automatically make the video that student’s education record. A recording focused on a student presentation, or containing information from a student’s education record, can meet the direct-relationship test. Maintenance by the district or its agent also matters. [3]
The following are recommended procurement checks. Counsel should distinguish the conditions of the school official exception from additional safeguards required by state law, district policy, or the proposed agreement.
|
Review area |
Evidence to request |
|---|---|
|
Authorized use and direct control |
Data-use terms defining the educational purpose, district authority over records, and vendor responsibilities. |
|
Access and redisclosure |
Role permissions, subprocessor list, authorized sharing terms, and procedures supporting district responses to records requests. |
|
Retention and exit |
Retention schedule, export formats, deletion timing, backup handling, and procedures at contract termination. |
|
Security and incidents |
Security documentation, incident notification terms, and independent audit reports available for review. |
|
AI features |
Written terms covering provider access, retention, model training, feature controls, and deletion of inputs and outputs. Ability to turn off AI features. |
|
Release management |
Service time, scheduled maintenance windows, and release process. |
If the vendor supplies a SOC 2 Type II report, review the service covered, audit period, auditor’s opinion, exceptions, and controls the district must implement. Use it to assess security practices alongside the contract and operational review.
The ADA Title II web rule sets WCAG 2.1 Level AA as the technical standard for covered state and local government web content and mobile apps, including services provided through vendor arrangements. Existing duties to provide effective communication and equal access continue while entities prepare for the rule’s compliance deadlines. [4]
Following the April 2026 extension, the deadline is April 26, 2027 for entities with populations of 50,000 or more, and April 26, 2028 for those below 50,000. School districts are not special district governments for this calculation. City and county districts use their respective government populations; independent districts use the applicable Census Small Area Income and Poverty Estimates population. Confirm the district’s classification and deadline with counsel. [4]
The Voluntary Product Accessibility Template (VPAT) is the form used to report accessibility testing. The completed document is an Accessibility Conformance Report (ACR), which records the product’s performance against the standards assessed. [5]
Request an ACR covering WCAG 2.1 Levels A and AA, or a later version that includes the applicable criteria. Check the product version, report date, platforms tested, evaluation methods, and who performed the assessment. Read each conformance rating with its supporting explanation, including any partially supported or unsupported criteria.
Ask how documented barriers affect student tasks, which fixes are planned, and when updated evidence will be available. Test the release and configuration your district expects to use. Ask for an Accessibility Guideline report in the classroom.
Ask students and staff who use assistive technology to participate where possible. Record the device, browser, assistive technology, task, result, and any barrier. These checks help evaluate common classroom workflows and general compliance; they do not constitute a full conformance audit.
Agree who will address platform barriers and who will prepare accessible slides, documents, and lesson materials. Keep unresolved barriers, affected tasks, remediation dates, and the district’s decision in the evaluation record.
Engageli is an AI-powered virtual classroom platform built for teaching and learning. Virtual tables support small-group collaboration, while polls, shared documents, and other participation tools give teachers ways to involve students throughout a lesson. Engagement analytics and attendance reporting cover live and asynchronous participation.
Those capabilities give districts specific workflows to include in a privacy and accessibility review. Test joining a virtual table, answering a poll, accessing shared work, and using Playback Rooms. Review who can access attendance and engagement records and how the district manages their retention.
Playback Rooms include recordings with searchable transcripts. Ask for separate evidence about live and recorded captions, keyboard operation, screen reader access, and the current accessibility assessment for the workflows your district needs.
Engageli has published a SOC 2 Type II renewal announcement. During evaluation, request the current report and relevant contract terms, together with accessibility findings and documentation for the AI features under consideration.
For more context on teaching workflows, see our guide to virtual classroom software.
Use this checklist to assign reviewers and track evidence. For each item, record the document or test result, any unresolved issue, and the next action before approval.
|
Check |
Suggested reviewer |
|---|---|
|
Map student data, AI processing, and vendor access |
IT and privacy lead |
|
Review the school official exception, contract, and state requirements |
District counsel |
|
Check security evidence, retention, exports, and deletion |
IT and procurement |
|
Review the current ACR and remediation commitments |
Accessibility lead |
|
Test live class and recording workflows with assistive technology |
Accessibility team and educators |
|
Document open issues, owners, and the purchase decision |
Procurement lead |
Use the statement to begin the review. The district still needs to evaluate the applicable disclosure conditions, actual data practices, contract terms, and intended use.
Recordings can qualify when they are directly related to a student and maintained by the district or its agent. Evaluate the context; incidental identification alone does not settle the question. [3]
An ACR documents assessed conformance and can identify barriers. Check its scope and findings, then test the tasks students and teachers need to complete. [5]
Request documented test results, assessment scope, and a remediation plan. Arrange a qualified evaluation of essential tasks and record the findings before deciding whether the evidence supports a purchase.
Identify which features process student information, which providers receive it, and the rules for retention, training, and deletion. Review written terms and the controls available to district administrators.
To discuss Engageli’s classroom workflows and the documentation your district needs for evaluation, Book a demo.
1. FERPA regulations: education records and school official exception
2. U.S. Department of Education: written agreements under the school official exception
3. U.S. Department of Education: photos and videos under FERPA
4. U.S. Department of Justice: Title II web rule and updated deadlines
5. Information Technology Industry Council: VPAT and ACR guidance