A parent opens the chat box on the district website at 10:00 PM. She doesn't type "What is the 504 policy?" She types: "My son is in 3rd grade at Lincoln and was just diagnosed with ADHD. Who do I talk to about a 504 plan?"
That's how families ask. They give context, because context is what you'd give a person.
When districts evaluate an AI chatbot, the student privacy conversation usually centers on what the bot can see. Does it connect to the student information system? Can it pull grades or attendance? Those are the right first questions, and for a website assistant the answer should be no. It should read what the district has already published and nothing else.
That covers half of it. The other half is what families will tell it.
A child's name. A diagnosis. A custody arrangement. An IEP meeting that went badly. None of it is on your website, and none of it is needed to answer the question. It arrives anyway, typed by a parent who assumes the district is on the other end.
FERPA gives families rights over their children's education records, including some control over how personally identifiable information from those records is shared. Whether a parent's chat message counts as an education record is a question for your attorney. Whether families expect it to be handled with care is not.
So before signing with any AI chatbot vendor, ask five questions:
- What sources does the assistant answer from: published district content only, or connected systems?
- Where are conversations stored, and for how long?
- Are conversations used to train AI models?
- Who can see the conversation log, at the district and at the vendor?
- What does the assistant say when someone shares personal details it doesn't need?
A vendor who answers all five quickly and in writing has thought about this. A vendor who needs to check with the team on every one has not.
Then tell families what the box is for. One sentence above the chat box does a lot of work: "This assistant answers questions about district policies and programs. Please don't include your child's name or personal details."
Families will still overshare sometimes. But the district will have told them what the box is for, and that is the honest place to start.