Student Data Privacy and Parents' Bill of Rights

Effective November 7, 2026 · Last updated November 7, 2026 · All legal documents

How Goal100 handles student data for schools: New York Education Law § 2-d, Part 121 of the Commissioner's Regulations, and FERPA.

1. Today

No student personally identifiable information (PII) is collected. Progress is stored on the device; progress codes are shared only by the student.

2. Agreement first

Goal100 will not receive or store student data, or teacher or principal data, for a school until the school or district signs a data privacy agreement with us that includes its Parents' Bill of Rights for Data Privacy and Security, the supplemental information that 8 NYCRR § 121.3 requires, and our data security and privacy plan (8 NYCRR § 121.6). Our template is the School and District Data Privacy Agreement; we sign one standard New York data privacy agreement, based on NYSED's model, with every district (we don't negotiate separate custom agreements).

3. FERPA: Goal100 as a school official

When a school uses Goal100, we act as a “school official” under FERPA's school official exception (34 CFR § 99.31(a)(1)(i)(B)): we perform a service the school would otherwise use its own staff for, we are under the school's direct control for the use and maintenance of education records, and we use and re-disclose personal information only as 34 CFR § 99.33(a) allows. The school decides who may access records. Parents and eligible students keep their FERPA rights to inspect and review education records and to ask for corrections, through the school.

4. Our commitments as a New York third-party contractor

• Use PII only for the purposes in the school's contract (8 NYCRR § 121.9(a)(4)).
• Never sell PII, or use or disclose it for any marketing or commercial purpose, or let anyone else do so (§ 121.9(a)(8)). No advertising. No profiling. No AI training on student data.
• Collect the minimum: nickname, class, scores and settings.
• Limit internal access to people who need it, after training on the laws that protect student data (§ 121.9(a)(3) and § 121.6).
• Follow the NIST Cybersecurity Framework (version 2.0, which Part 121 now references); encrypt PII in motion and at rest (§ 121.9(a)(6)-(7)).
• Not disclose PII to anyone except authorized subcontractors bound by the same duties, or as a statute or court order requires, with notice to the school no later than the disclosure unless the order forbids notice (§ 121.9(a)(5), (b)).
• Notify the school of any breach or unauthorized release in the most expedient way possible and no more than 7 calendar days after discovery, cooperate with the school and law enforcement, and pay for or reimburse the full cost of required notifications when the breach is attributed to us (§ 121.10(a), (c), (f)).
• Store data in the United States.
• Return or delete data at the end of the contract, as the school chooses, and confirm deletion in writing.
• Accept the oversight and penalties that Education Law § 2-d and § 121.11 set for contractors.

5. Parents' Bill of Rights for Data Privacy and Security (summary)

New York requires every school to publish a Parents' Bill of Rights. Each school's own Bill of Rights controls for its students. NYSED's model (February 2025) says, in summary:

1. Your child's data cannot be sold, cannot be used for any commercial or marketing purpose and cannot be shared with an unauthorized person.
2. You may inspect and review your child's education records at the school, see them within 45 days, and dispute inaccuracies.
3. Your child's data must be protected with high standards and best practices, such as encryption, firewalls and passwords.
4. You may file a complaint about a breach and have it addressed within 60 days. First try the school; if it is not resolved, contact the Chief Privacy Officer, New York State Education Department, 89 Washington Avenue, Room 152EB, Albany, New York 12234, Privacy@nysed.gov, or use NYSED's online complaint form.
5. A list of all student data elements collected by the State is at nysed.gov student data inventory, or by writing to the Office of Information & Reporting Services, NYSED, Room 863 EBA, 89 Washington Avenue, Albany, New York 12234.
6. You must receive an annual notice from your district of your right to inspect and review your child's education record. Schools must publish the Bill of Rights and supplemental information about each contractor, and tell you within 60 calendar days if your child's data has been breached.

6. Supplemental information about Goal100 (8 NYCRR § 121.3(c))

7. Outside New York

We will sign the student privacy agreements other states require (for example through the Student Data Privacy Consortium) before collecting their students' data. We follow these commitments ourselves; the industry “Student Privacy Pledge” was retired by its sponsor in April 2025, so we do not claim it.

8. Requests and questions

Parents should contact their school first, because the school controls student records. Schools and parents can also reach us through the Contact page (mark it “Student data”).

Laws and official sources referenced

• New York Education Law § 2-d: https://www.nysenate.gov/legislation/laws/EDN/2-D (checked Nov 7, 2026)
• 8 NYCRR Part 121 (Commissioner's Regulations on student data privacy): https://govt.westlaw.com/nycrr/Browse/Home/NewYork/UnofficialNewYorkCodesRulesandRegulations?guid=Iabe7a6a080db11eab44fadfbb631c4ee (checked Nov 7, 2026)
• 8 NYCRR § 121.10 (breach notice by contractors within 7 calendar days): https://www.law.cornell.edu/regulations/new-york/8-NYCRR-121.10 (checked Nov 7, 2026)
• Part 121 amendment adopting NIST Cybersecurity Framework 2.0: https://www.counsel.nysed.gov/sites/counsel/files/rulesandregs/terms-part-121.pdf (checked Nov 7, 2026)
• NYSED Parents' Bill of Rights for Data Privacy and Security (Feb. 2025): https://www.nysed.gov/sites/default/files/programs/data-privacy-security/final-pbor-2.21.25.pdf (checked Nov 7, 2026)
• NYSED Bill of Rights for Data Privacy and Security page: https://www.nysed.gov/data-privacy-security/bill-rights-data-privacy-and-security-parents-bill-rights (checked Nov 7, 2026)
• NYSED: file a privacy complaint: https://www.nysed.gov/data-privacy-security/parents-and-students-file-privacy-complaint (checked Nov 7, 2026)
• NYSED student data inventory: https://www.nysed.gov/data-privacy-security/student-data-inventory (checked Nov 7, 2026)
• FERPA regulations, 34 CFR Part 99 (school official exception, § 99.31(a)(1)(i)(B)): https://www.law.cornell.edu/cfr/text/34/99.31 (checked Nov 7, 2026)
• NYSED model forms and policies (model data privacy agreement): https://www.nysed.gov/data-privacy-security/model-forms-and-policies (checked Nov 7, 2026)
• Future of Privacy Forum: Student Privacy Pledge retired April 25, 2025: https://fpf.org/student-privacy-pledge/ (checked Nov 7, 2026)

Questions about this document: use the Contact page; we answer in writing. We post every change on this page with a new date.