FERPA and COPPA for Tutoring Businesses: What Actually Applies

Does FERPA apply to tutors? Usually not directly. FERPA binds schools and institutions that receive funding from the US Department of Education, along with their contracted vendors acting as a "school official" — most independent tutoring businesses operate outside that scope unless they're under a specific contract with a school or district. This is a general explainer, not legal advice. The confusion is understandable: tutoring businesses handle exactly the kind of information FERPA was written to protect — grades, test scores, learning plans — which makes it easy to assume the law must apply just because the subject matter does. It doesn't work that way. FERPA attaches to the institution's relationship with federal funding, not to the sensitivity of the data itself, and that distinction matters a lot for how you should actually set up privacy-first review replies for tutors on your own, independent of which law technically governs you. FERPA private tutoring company: what the law actually covers FERPA (the Family Educational Rights and Privacy Act, 20 U.S.C. §1232g) restricts how a covered institution discloses a student's education records — grades, attendance, disciplinary history, special education plans. It applies to schools and institutions that receive US Department of Education funding, and it extends to vendors under contract acting as a "school official" performing a function the school would otherwise handle itself. That extension matters for tutoring businesses in one specific scenario: if you tutor under a contract with a school or district — providing Title I services, an after-school intervention program, or similar — that contract may place FERPA-style obligations on you specifically, even though you're not a school. Read the actual contract rather than assuming either way; some school contracts spell out data-handling requirements explicitly, and some don't address it at all. Outside that arrangement — a private tutoring center, an independent tutor working directly with families, an online tutoring marketplace — FERPA generally doesn't apply, because there's no federally funded institution in the relationship. That's good news for most of the industry, but it doesn't mean student privacy stops mattering. It just means a different, more informal standard of care is doing the work instead of a federal statute. If you're uncertain whether a specific school partnership puts you in "school official" territory, a useful starting question is whether the school would otherwise be performing the exact function you're providing using its own staff and resources. If yes, that's typically the kind of arrangement that can trigger FERPA-style obligations in the contract; if you're simply a vendor families pay independently, even if the school refers families to you, that's a different and generally lower-risk arrangement. COPPA for online tutoring: a narrower, different rule COPPA (the Children's Online Privacy Protection Act, 16 CFR Part 312) governs online collection of personal information from children under 13 — think a sign-up form, an account, or an app a child under 13 interacts with directly. It's relevant if you operate an online tutoring platform, app, or learning portal where a child under 13 creates an account or submits personal information themselves. COPPA is not, on its own, about reviews. A parent leaving a public review about their child's experience with your tutoring service isn't a COPPA event — COPPA concerns the data a company collects directly from a child online, not what an adult chooses to publish about their own kid. If your online tutoring product does collect account data from under-13 users directly, that's a separate compliance question worth a proper legal review, distinct from how you handle review requests and replies. Where COPPA does change your workflow concretely: review requests, surveys, and any form that collects an email or contact detail should go to the parent's account, not a form a young student fills out directly inside your platform. If your product currently lets a student under 13 submit anything with personal information attached — a name, an email, a photo — without a parent in the loop, that's worth reviewing regardless of how your reviews process works. Student privacy tutoring: the practical standard that applies either way Here's the part that matters regardless of whether FERPA or COPPA technically covers your business: parents expect their child's academic details to stay private, and that expectation doesn't disappear just because no federal law forces the issue. A handful of state laws add their own layer on top — student privacy statutes like California's SOPIPA apply specifically to ed-tech operators and may be relevant if you run an online tutoring platform, though the details vary by state . The practical rule that works regardless of which law technically applies: never disclose a student's name, grade, test score, or learning difference in a public reply, even if the parent included those details in their own review first. Our guide to how to respond to parent reviews walks through exactly how to acknowledge a glowing or difficult review without repeating identifying details back. This standard should also shape what you ask for, not just how you reply. A review request template that prompts "tell us about your child's grade improvement" invites exactly the kind of detail you'll then have to carefully avoid repeating in your reply. A prompt that asks about communication, scheduling, and whether the tutor was a good fit tends to produce reviews that are both useful to future parents and easier to respond to without a privacy tightrope. Privacy-first review replies for tutors in practice Building this into your actual review workflow means a few concrete habits: review request templates that ask about the parent's experience — communication, scheduling, whether the tutor was a good fit — rather than prompting for a specific grade or score; reply templates that default to "your son" or "your daughter" instead of a name, even when the review used one; and a pause step for anything that touches a diagnosis or learning difference before a reply goes live , since that's the category of review most likely to need a second look before responding. None of this requires FERPA or COPPA to apply to be worth doing. It's closer to a basic professional standard for a business that works with minors, and it holds up regardless of which specific regulation does or doesn't technically cover your setup. The same logic that keeps you out of trouble with student privacy also applies to how you collect reviews in the first place — see our rundown of the FTC's rule on fake and deceptive reviews for what it requires around disclosure, incentives, and gating. Train anyone else responding to reviews on your behalf — a front-desk manager, an assistant, another tutor — on this same short list of defaults, rather than assuming only the owner will ever reply. A single inconsistent reply from someone who didn't get the same training can undo the habit you've otherwise built consistently. What a reasonable internal policy looks like Most tutoring businesses never need a formal written privacy policy beyond what's already covered by basic contract terms with families, but a short internal reference document is worth having once more than one person might reply to reviews or handle review requests on your behalf. A one-page list — never name a student in a public reply, never repeat a grade or score the parent mentioned, send review requests to the parent's contact rather than a student's, pause and ask before replying to anything mentioning a diagnosis — covers most of the practical ground without needing to reference specific statutes at all. Revisit this short policy whenever you take on a new contract with a school or district, since that's the one circumstance most likely to actually change your obligations rather than just your best practices. Can students under 13 leave reviews about my tutoring? Most review platforms, including Google, require an account holder to be 13 or older . Practically, this means the review should come from the parent, who's also the one who did the comparison shopping and is paying the invoice — not from the student. Is my tutoring business "FERPA compliant" if I never mention students in replies? Being careful about student privacy in replies is good practice, but it's not the same thing as being a FERPA-covered entity, and it's not accurate to market your business as "FERPA compliant" as if that were a certification you hold. No vendor can claim compliance with a law that may not apply to it in the first place — what you can accurately say is that you treat student data as private by default. What about state laws beyond FERPA and COPPA? Several states have their own student data privacy laws aimed at ed-tech providers, and requirements vary enough that a blanket answer isn't responsible here. If you run an online tutoring platform that collects student data, a lawyer familiar with your specific states of operation is the right source for a definitive answer — this article is a starting map, not a substitute for that review. Can I share a student's progress with a school counselor or teacher? Generally only with the parent's permission, and ideally documented rather than assumed. Even outside a formal FERPA relationship, sharing a student's academic details with a third party — including a school employee — without the parent's knowledge is the kind of practice that erodes trust even if no specific law technically prohibits it in your situation. Get explicit consent, in writing where practical, before any such exchange. Does a school contract automatically make my business FERPA-covered? Not automatically — it depends on the specific terms of the contract and whether you're functioning as a "school official" performing a service the school would otherwise provide itself. Some tutoring contracts with districts spell this out explicitly; others leave it ambiguous. Reading your actual agreement, or having counsel review it, is the only reliable way to know where you stand. Should I mention FERPA or COPPA on my own marketing materials? Only with care, and ideally only after legal review of the specific language. Describing honestly how you handle student data — "we never discuss a specific student's grades or performance in public replies" — is safer and more accurate than claiming compliance with a law that likely doesn't directly govern your business in the first place. Every review from Google, Yelp and Facebook in one inbox → Try Tailwind free. Tailwind runs $5 a month per tool, or $50 a month for the Full plan covering every tool, with the first month free and no card required to start.