Many online tools collect contextual data about how they are used, often called metadata. The U.S. Department of Education says metadata stripped of all direct and indirect identifiers is not protected under FERPA, and a provider may reuse it unless the agreement forbids it. So ask what a tool collects and whether the contract limits reuse. Not legal advice.
What metadata means
PTAC describes metadata as information that gives meaning and context to other data collected. Its example is a student task: the time taken means more when you also know the date, the attempts and what the user did on screen.
For a developer security tool the equivalent is things like scan time, repository names, which findings were opened, feature clicks and error traces. None of that is source code, yet some of it can identify a person or a system.
The two rules PTAC states
- Metadata with all direct and indirect identifiers removed is not PII, so it falls outside FERPA's protections.
- A provider with access under the school official exception may use metadata not linked to protected information for other purposes, unless the agreement says otherwise.
PTAC gives an example where a tutoring provider de-identifies activity data and uses it to develop new products, unless the district's agreement precludes that. The takeaway is simple: silence in the contract can leave the door open.
Five questions for any security vendor
- What usage and telemetry data does the product collect, field by field?
- Is any of it linked to a person, a repository name or an organization?
- How is it de-identified, and who checks?
- Is it used for anything beyond running and improving the service you bought?
- Can you switch the collection off, and does the product still work?
Where to record the answers
| Data class | Collected? | Linked to identity? | Reuse allowed? | Switch off? |
|---|---|---|---|---|
| Account and sign in | ||||
| Scan results | ||||
| Product usage events | ||||
| Error and crash reports |
Fill this with the vendor's written answers, not sales calls. Attach it to the purchase record.
What good answers sound like
- Specific field names rather than "anonymous analytics".
- A clear line between data needed to run the service and data used to improve it.
- A contract clause that limits reuse to named purposes.
- A deletion promise at contract end.
What should worry you
- "We only collect anonymous data" with no explanation of how.
- No written statement on reuse.
- Telemetry that cannot be switched off for sensitive environments.
Also check the product's own documentation, since defaults may differ from what a sales deck says.
For the provisions to put in the agreement, see contract provisions districts should require.
Quick check
Is de-identified metadata protected by FERPA?
PTAC says metadata stripped of all direct and indirect identifiers is not PII and not protected information under FERPA.
How do I stop a vendor reusing usage data?
Say so in the written agreement. PTAC notes reuse is allowed unless the agreement prohibits it.
Sources
Last reviewed: 19 October 2026.
