Under FERPA, a Paper Sent to an AI Detector Is an Education Record

Yes, once the school holds it. FERPA covers records directly related to a student and maintained by the school, or by a party acting on the school's behalf ¹. A graded essay meets both halves. Sending it to a licensed detector changes who holds a copy, not what the copy is.

That lands on the registrar. Department of Education guidance from 2014 on online educational services says a school or district must be able to give a requesting parent or eligible student access to records a provider holds ³. So a detection report sitting in a vendor console still has to be reachable through the school, and a district that can't pull one on request has an access problem whatever the contract says.

Redaction does less than it looks. A paper's topic, class and voice can point to one writer, so stripping the name from the header doesn't reliably break the link back to a student.

Only when the arrangement meets the test in 34 CFR 99.31. A school can treat an outside party as a school official when three things hold. The party performs an institutional service the school would otherwise use employees for. It stays under the school's direct control over education records. And it's bound by the redisclosure limit ².

The same 2014 guidance adds a fourth condition: the provider has to meet the criteria in the school's annual notification of FERPA rights for being a school official with a legitimate educational interest ³. If a notice's school-official criteria don't describe an outsourced service such as detection, that vendor sits outside the exception until someone revises the criteria ³.

The first condition deserves an argument rather than a checkbox. Is reading a paper for signs of machine writing a service an instructor would otherwise perform? Plausibly, and that's the case for putting detection inside the exception. The case gets weaker as a vendor's use of the paper drifts from the school's own purpose. Closing the drift is the contract's job, and the terms that close it belong in the solicitation, set out in the RFP requirements for a detector.

It should set a deletion period in days, bar training on student writing and name a deletion route; direct control is usually shown by a term in an agreement, never by a sales answer. FERPA regulations don't require a written agreement under the school official exception, the Department of Education notes, though districts outsourcing a service will usually be able to establish direct control through a contract ³.

Four items come first, and the last is a condition on the school's own notice rather than a contract term.

For K-12 schools, Illinois writes the federal test into the contract itself. At 105 ILCS 85/15 it requires a written agreement before covered information may be transferred to any operator whose service is designed and marketed for K-12 school purposes ⁷, and that agreement has to say the operator acts as a FERPA school official under the school's direct control ⁷. California's section 22584 puts duties on an operator, defined as a service designed and marketed for K-12 school purposes, so it reaches a detector only when the detector is such a service ⁶. Its covered information includes material a pupil provides to the operator and material a school employee provides to it ⁶, and the second is where a teacher's upload would fall. The operator must delete a pupil's covered information when the school or district asks, for data under the school's control ⁶.

A deletion clause a district can't exercise is decoration. Ask for the route, the role authorized to send the order, and the confirmation that comes back, then file the answer beside the signed agreement.

In a K-12 district a second federal question can arise, whether COPPA reaches the detection vendor when the writing is by pupils under 13. It turns on facts this page doesn't settle and is worked through in the COPPA analysis for a K-12 detector.

The paper stays a record directly related to a student and maintained by a party acting on the school's behalf ¹, whatever the teacher's account. What changes is that three of the four conditions usually go unchecked. Nobody has read the checker's terms for a direct control or redisclosure clause or held it against the notice criteria, and retention terms are often unpublished. The 2014 guidance allows a Terms of Service to carry those clauses ³, so price doesn't decide it.

Vanderbilt University states on its own generative AI page, as of September 2026, that it offers no institutionally supported AI detection tools ⁸. The same page says many third-party detection tools have unknown privacy and data usage policies ⁸. Unknown is the word to hold onto. A records analysis can't lean on a term nobody outside the vendor can read, and a missing retention period is not evidence that nothing is retained.

The fix for a department is small. Publish the list of detection tools instructors may use. Check each one against the school-official criteria in the annual notification before the term it's used in. Anything off the list is a disclosure that needs its own analysis. This is the general federal analysis; a district's own facts, state law and counsel decide how it applies.

By Human's own description, its free check at human.olive.is takes one paper a day of up to 1,200 words, needs no account and returns a verdict of Human, Mixed or AI. This is an estimate from our detector. A flag should be reason to look closer and not verified proof of cheating. Human's detector scores the text in memory and de-identifies any personal information for additional training. Pasting a paper into it is still a disclosure, the same analysis applies, and a vendor's description of how it handles text remains a vendor statement until it sits in a signed agreement.

A detection result filed against a named student becomes an education record in its own right ¹. Under 34 CFR 99.10 a parent or eligible student may inspect and review it. The school has to comply within a reasonable period, and no later than 45 days after the request ⁴, which makes 45 days an outer limit rather than a service target. Keeping the copy in a vendor console doesn't put it out of reach.

Amendment is what surprises integrity offices. When a school declines to amend a record a parent or eligible student calls inaccurate or misleading, 34 CFR 99.21 gives them a hearing to challenge its content ⁵. If the hearing leaves the record standing, they may place a written statement of disagreement in the file, and that statement goes out whenever the contested part of the record does ⁵. So a finding built on a detector percentage carries the rebuttal to anyone who is later shown that finding. Better to keep the percentage out of the finding from the start.

A score describes text. It doesn't describe a student's honesty, and any conclusion written on top of one inherits every limit of the measurement underneath. What a hearing panel can properly do with a reading sits in what a detector score alone cannot support.