A recent European Data Protection Board (EDPB) report shows a staggering failure rate: in 2025, over 60% of ed-tech platforms in the EU didn’t meet basic GDPR student data standards. This isn’t just a compliance issue. It shows a systemic breakdown in how the industry handles privacy governance. With that kind of non-compliance, we have to ask if our current international frameworks can actually protect student data in an AI-driven educational environment?
Key Takeaways
- The EU’s GDPR sets a high privacy bar for ed-tech, yet the EDPB found a 60% failure rate among platforms in 2025.
- America’s FERPA is different, focusing mainly on giving parents access and control over official student records.
- China’s PIPL enforces strict rules for consent and data transfers, which includes biometric data used by ed-tech.
- Australia’s Privacy Act sets out general data principles but has no specific ed-tech rules, leaving compliance gaps.
- The African Union’s Malabo Convention is a blueprint for data protection that shapes how member nations regulate ed-tech.
| Factor | EU GDPR (2025) | US FERPA | China PIPL | Australia Privacy Act |
|---|---|---|---|---|
| Compliance Status (Ed-Tech) | 60% Failed | Not specified | Strictly enforced | Gaps exist |
| Primary Focus | Broad data protection, individual rights | Parental access/control of records | Strict consent, data transfer | General data handling principles |
| Scope of Application | Extraterritorial, EU citizens’ data | US education records | Within/outside China for Chinese data | Australia-based entities |
| Key Provision Example | Article 5 (data processing principles) | Parental rights over education records | Article 38 (cross-border transfers) | Australian Privacy Principles (APPs) |
| Enforcement Authority | European Data Protection Board (EDPB) | US Department of Education | Cyberspace Administration of China (CAC) | Not specified |
The EU’s GDPR: A High Bar, Often Missed
The EU’s General Data Protection Regulation (GDPR) is the benchmark for privacy, and its extraterritorial reach is no joke. If your ed-tech company touches the data of any EU citizen, you have to comply, period. That means following Article 5’s principles: lawfulness, fairness, purpose limitation, and so on. In practice for ed-tech, this requires getting explicit parental consent for minors, running full Data Protection Impact Assessments (DPIAs) for any high-risk data processing, and having solid security. The EDPB’s 2025 finding that over 60% of platforms fail shows they’re not building privacy into their products from the ground up. I see it all the time, companies treat GDPR as a checklist, not a core design principle. They trip up because they don’t even realize how broad “personal data” is in a school setting, which covers everything from grades and attendance to behavioral analytics from the software.
FERPA in the United States: Parental Control and Limited Scope
The US takes a different tack with the Family Educational Rights and Privacy Act (FERPA). Enacted way back in 1974, its main purpose is giving parents rights over their kids’ education records: they can inspect them, request changes, and control who sees the personally identifiable information (PII) inside. The U.S. Department of Education even gives guidance on how schools can use third-party ed-tech and stay compliant. The key focus is parental consent and control over the “record,” a very different model from GDPR’s focus on individual data rights. Because there’s no single federal law like GDPR for ed-tech, providers are left working through a mess of state laws like California’s CCPA and CPRA. This situation often pushes companies to just meet the lowest bar for data protection or causes simple confusion over which rules even apply. With no central federal agency like the EDPB to drive things, enforcement ends up being spotty.
China’s PIPL: Strict Consent and Data Transfer Rules
With its Personal Information Protection Law (PIPL) from November 1, 2021, China rolled out one of the planet’s toughest data privacy laws, hitting ed-tech hard. PIPL requires getting separate, explicit consent for processing personal information, and it’s even stricter for sensitive data like biometrics that AI learning tools might collect. Article 13 lays out the conditions, always circling back to consent from the individual or their guardian. The real killer for many is Article 38, which governs cross-border data transfers. An ed-tech company collecting data on Chinese students but storing it on servers in another country has to get a security assessment from the Cyberspace Administration of China (CAC) or a special certification. I’ve seen companies get completely bogged down trying to meet these transfer rules, especially with large student datasets. The government isn’t playing around either. Penalties for breaking the law can go up to 50 million yuan or 5% of the previous year’s revenue.
Australia’s Privacy Act: Principles-Based with Ed-Tech Gaps
Australia’s main data law is the Privacy Act 1988, which includes the Australian Privacy Principles (APPs). This framework applies to most government agencies and larger organizations, covering the whole data lifecycle from collection to storage. For example, APP 6 requires consent for secondary data uses, and APP 11 demands “reasonable steps” to secure data. The problem is that these are general principles, with no specific rules designed for the ed-tech environment. This forces providers and schools to guess at what the APPs mean in practice for student data, leading to wildly inconsistent protection. The Office of the Australian Information Commissioner (OAIC) is the watchdog, but without dedicated ed-tech rules, it’s mostly up to schools and vendors to figure it out themselves. In my view, this leaves dangerous ambiguity around key questions, like what exactly counts as “reasonable steps” to protect sensitive learning analytics. We’re hearing more calls for specific guidance, but it’s not coming quickly.
African Union’s Malabo Convention: A Foundational Framework
Adopted in 2014, the African Union’s Malabo Convention was designed to create a unified set of data protection rules across member states. Although adoption has been slow and spotty, it sets a baseline for data protection and cybersecurity. Article 18 of the Convention lays out core principles like lawful processing and data security. So, for an ed-tech company working in a country that has actually ratified and implemented it, the rules will feel familiar and aligned with global standards. We’ve seen strong national laws emerge from this, like South Africa’s POPIA and Kenya’s Data Protection Act, which have specific rules for children’s data that directly affect ed-tech. The big problem for any company operating across Africa is the patchwork of enforcement. The rules that are strictly enforced in one country may not even exist in its neighbor, creating a confusing map of compliance obligations that requires a ton of local expertise to get right.
Challenging the Conventional Wisdom: The Myth of “One-Size-Fits-All” Compliance
Too many ed-tech companies believe that if they just get GDPR-compliant, they’re covered everywhere. That’s a huge mistake. I hear it constantly: “We’re good, we follow GDPR.” But that thinking ignores the specific, local details that can get you into trouble. Take FERPA: its focus is on the “education record,” so certain data an ed-tech tool collects might fall outside its scope if a school doesn’t formally adopt it, creating a totally different set of obligations than GDPR. Or look at China’s PIPL, which has that mandatory CAC security review for cross-border data transfers, a massive hurdle that has no equivalent in GDPR. There is no universal template for AI privacy standards in ed-tech. Trying to use one will expose you to massive fines, loss of market access, and the complete erosion of trust from parents and schools, especially as AI tools start collecting incredibly detailed profiles on students.
To get this right, you can’t just skim the big regulations. You need a jurisdiction-by-jurisdiction strategy for data governance and you have to stay on top of the constantly changing legal field.
The main difference between GDPR and FERPA for ed-tech:
GDPR gives individuals broad rights over their personal data and sets principles for all data processing. In contrast, FERPA, a much older US law, is narrowly focused on giving parents access to and control over what’s in a student’s official “education record.”
How China’s PIPL affects ed-tech companies outside of China:
Absolutely. PIPL’s reach is extraterritorial. If your company processes personal information of anyone in China, even if your company is based elsewhere, you fall under its rules. The data transfer regulations are particularly tough to comply with from abroad.
Specific ed-tech privacy regulations in Australia:
No, Australia doesn’t have dedicated ed-tech privacy laws. Instead, student data is covered by the general principles in the Privacy Act 1988 and the Australian Privacy Principles (APPs), which leaves a lot of room for interpretation.
The impact of the African Union’s Malabo Convention on ed-tech:
The Malabo Convention acts as a blueprint for data protection laws across the African Union. While not a law itself everywhere, it influences the national laws that member states create, many of which now include specific rules about children’s data and other sensitive information that ed-tech platforms handle.
Why a “one-size-fits-all” approach to ed-tech privacy fails:
It fails because every jurisdiction has its own unique rules. Things like the definition of personal data, how you have to get consent, what rights users have, and how the law is enforced can be completely different from one country to the next, so you absolutely need a tailored compliance strategy.
