Three weeks into the school year, something predictable has happened in almost every building: teachers have discovered new tools. A quiz app a colleague recommended. A reading tracker. A classroom behavior board. A free AI writing helper. Each one took two minutes to sign up for — and many of them asked for a class roster to get started.
This is good teaching instinct, and nobody should want to stamp it out. But every one of those sign-ups is a decision about where student data goes, made by one person, in two minutes, usually without anyone else knowing it happened. Student names, emails, grades, reading levels, sometimes behavior notes — sent to companies your school has never reviewed and has no agreement with.
Why "free" deserves a second look
Many classroom apps are excellent and handle data responsibly. Some are free because the data is the business model. The trouble is that from a teacher's screen, the two look identical. Under FERPA, the school remains responsible for student education records it shares — and a teacher uploading a roster to an unvetted service is, functionally, the school sharing it.
- Rosters uploaded to services with no data agreement — often the most common finding, and the easiest to fix
- Students signing in with their school accounts through "sign in with Google" or Microsoft, quietly granting apps access to more than the teacher realizes
- AI tools where students paste in writing, sometimes including personal details, under terms that allow the content to be retained
- Apps nobody remembers adopting — still holding last year's class data long after the teacher moved on
A lightweight approval process teachers will actually use
Heavy-handed bans get routed around. What works is making the right path the easy path:
- Publish an approved-apps list teachers can pick from freely — no request needed. Most requests end up here.
- Create a two-minute request form for anything new: app name, what it does, what student information it asks for. Commit to answering within a week.
- Check each new app for a published student privacy policy and, where possible, a signed data privacy agreement. Many edtech vendors already have one ready.
- Review third-party app access in your Google or Microsoft admin console. It shows every app students and staff have connected with school accounts — usually a surprise the first time.
- Remove what's no longer used at the end of each semester, and ask vendors to delete the data.
This belongs next to your account checklist
In July we wrote about closing accounts left behind by departed staff. App sprawl is the same problem from a different angle: access that nobody decided to keep, still holding student data nobody is watching. Handling both together each year gives your board and your families a clear answer to a question they're starting to ask — where does our children's information actually go?
Open your Google Workspace or Microsoft 365 admin console this week and look at the list of third-party apps connected to school accounts. Whatever you find is your starting approved-or-removed list. Our free school IT assessment includes this app and data-flow review — findings are yours either way.
Great teachers will always go looking for better tools. Give them a fast, friendly way to use the good ones — and your school gets both the innovation and the peace of mind.
Andrew — Founder, NextGen Strategy Partners
Veteran-owned managed IT for the nonprofits, schools, behavioral health providers, and medical & dental practices of McHenry & Lake Counties. Request a free security assessment →