A New AI Standard Vets School Software for Privacy, Not Learning

What was announced

On Wednesday, September 9, 2026, the AFT, the UFT, and Microsoft announced what they are calling the National AI Safety and Privacy Standard for K-12 schools. Mechanically it is a 30-page memorandum of agreement between Microsoft and the National Academy for AI Instruction, a body the two unions created with Microsoft, OpenAI, and Anthropic in July 2025. The unions framed it as long-overdue protection, in the words of AFT president Randi Weingarten:

“We have forged a hard-fought, iron-clad privacy agreement with real teeth that protects students and families, because no one else, including the federal government, has stepped up to do the real work.”

The agreement groups its commitments into three priorities, privacy, safety, and transparency and control, which the trade press has described as ten enforceable protections. The concrete ones are specific. Microsoft is barred from using student and educator data to train its general-purpose AI models, with a narrow carve-out for safety and security. There is to be no behavioral tracking, long-term profiling, keystroke logging, or continuous attention monitoring of students. Software is not permitted to independently decide a student’s discipline, academic placement, or an employee’s evaluation without human review. Providers must notify districts within 72 hours of a confirmed or suspected breach, and generally have 180 days to delete data after a district asks. Microsoft echoed the framing, with vice chair and president Brad Smith pledging a national rollout:

“This standard sets a high bar for child privacy and AI safety, and we’ll extend this agreement to every school district across the country.”

Beginning November 1, 2026, districts fold these terms into their own Microsoft agreements, at which point a violation becomes a breach of contract rather than a broken law. The standard has edges its own coverage is candid about: de-identified data stays usable for debugging, security, and product improvement, and reporting on the deal notes that de-identified information is sometimes pieced back together when AI systems combine writing style and other clues. So far Microsoft is the only AI vendor to sign; the AFT says it is in talks with OpenAI and Anthropic. The announcement lands amid a broader unease, from New York City’s one-year pause on student-facing generative AI in its youngest grades to Los Angeles Unified’s own restrictions, both framed as questions of student privacy and age-appropriateness.

The frame the science supports

Here is where the coverage takes a wrong turn, and it is an easy one to take. A standard with the words ‘safety’ and ‘privacy’ on it reads like a seal of approval, and a tired parent hears ‘someone checked this, so it must be good for my kid.’ But protecting a child’s data and teaching a child to read are two different jobs, measured in two different ways. This agreement is a contract about who touches the data and who oversees the software. It does not test whether a single tool covered by it builds a reading, writing, or math skill, and it never claims to.

That second question has its own answer, and the educational-technology research is fairly clear about it. It draws a hard line between engagement and learning: time-in-app and lessons-completed are engagement measures, and treating them as evidence that a child learned something is the most common move in ed-tech marketing. What actually produces durable learning is a short, well-studied list: effortful retrieval, where a child has to recall and rebuild an idea (Roediger and Karpicke); practice spaced out over time (Cepeda and colleagues); step-by-step tutoring that responds to each move a child makes (VanLehn); and feedback that tells a child what to do next rather than only marking an answer right or wrong. That last ingredient is not even a sure bet, since some feedback backfires and the evidence on it is mixed. A privacy standard regulates none of these things. It was never built to.

None of this means classroom technology fails children. It means the bar for ‘this teaches’ sits higher than the bar for ‘this is safe,’ and this announcement clears only the second. Worth remembering, too, that buying technology for classrooms has a long history of not raising achievement on its own. When the OECD examined countries that had invested heavily in school computers (Students, Computers and Learning, 2015), it found no appreciable gains in reading, math, or science. That is a null on benefit, not proof of harm, and it belongs in the story as a caution rather than a verdict on any one tool. Still, it points at the same truth this standard sidesteps: a points system makes a child feel like they are learning, and real mastery makes them feel capable, and those are not the same thing.

What it means for your child

First, the good news, because it is real. Barring a vendor from training its general models on your child’s data, ruling out keystroke logging and always-on attention monitoring, and forcing a human to review before software decides a suspension or a placement are meaningful protections, and no federal law delivers them today. A parent should want this. The trap is only in what it gets mistaken for.

So carry a sharper question into your child’s school than whether the AI is ‘approved.’ Ask what the tool actually asks of your child. Does it make them recall and rebuild an idea, or does it hand them an answer and log the minutes? Does it space practice and respond to each attempt, or does it reward a streak? Approved-for-privacy tells you the data is handled well. It tells you nothing about which of those two things is happening on the screen. This is the same shape as the debate over mandatory dyslexia screening: a policy that sounds unambiguously good still turns on how it is used, and a parent deserves to understand the decision rather than take the headline for the answer.

And the part no standard reaches is the one that matters most at home. A child learns from effort they see through, and from having someone in their corner while they do it, which is where a parent has real leverage that a login never will. Supporting a child without taking the work over is a skill worth building, and it is the one lever this whole debate keeps leaving out. The data questions in this agreement will settle over the coming year of district contracts. The learning question will not settle itself, and it stays yours to ask.