This post contains affiliate links.
When the pandemic pushed millions of classrooms onto screens, the line between a teacher’s home network and a school’s data infrastructure blurred fast. Most of the conversation around student data privacy focuses on district-level policies or big EdTech vendors. But remote tutors and independent teachers — the ones running small practices, juggling multiple platforms, or working from a spare bedroom — face a different set of exposures. They often lack a dedicated IT department, a legal review team, or even a clear policy to follow. And the data flowing through their laptops is just as sensitive as anything stored on a school server.
The research that came out of the emergency remote teaching period paints a stark picture: during the initial COVID-19 school closures, 80% of teachers reported interacting with students online, and yet only 8 out of 50 state education agencies provided comprehensive guidance for safe EdTech adoption and student data protection, according to a 2023 study in the journal Educational Policy (source: PMC). That means most educators — especially those working independently — were left to figure out privacy on their own.
The Hidden Costs of “Free” Tools
It’s tempting to grab a free Zoom account, a Google Classroom link, or a WhatsApp group for quick communication. The research summary documents how widespread this was: teachers often utilized free for-profit technology during the crisis, and companies frequently adopted a “support now, sell later” strategy to lock schools into long-term subscriptions. For a remote tutor operating month-to-month, that lock-in can feel like a convenience. But the real cost is paid in student data.
Google, for example, faces ongoing litigation for violating state and federal children’s privacy regulations. Zoom’s privacy policy, as documented in the same research, states that it collects name, physical address, email, phone number, device type, and IP address, and shares personal data with third parties for “business purposes.” When you’re a solo tutor using a personal account, you have no institutional agreement in place — just a click-wrap consent that the student or parent probably accepted without reading. The Fordham University Center on Law and Information Policy has documented a commercial marketplace for student information and weaknesses in existing protections, noting that students pay the cost of “free” software with sensitive data and communications harvested for profit.
This isn’t just about K-12 schools. Independent tutors working with high school or college students often use the same tools. And because there’s no district contract governing data handling, the responsibility falls entirely on the tutor to read terms of service — an unrealistic expectation when you’re trying to set up a virtual lesson in 15 minutes.
When Your Home Office Becomes a Classroom
The physical space where you teach matters for data security. A remote tutor’s home Wi-Fi, personal laptop, and shared family devices are all potential entry points. The IBM Security and Ponemon Institute’s 2023 report on data breaches found that breaches tied to remote work cost roughly 10% more on average. For a small tutoring business, even a single breach — a student’s medical information leaked, a Social Security number exposed — could mean legal liability and loss of trust.
What makes the situation unique for remote tutors is the sheer variety of platforms they may use in a single week. One student might use Zoom, another Google Meet, a third a specialized language-learning app. Each platform collects different data: names, email addresses, sometimes location data, browsing history, or even biometric information from video feeds. The research summary notes that EdTech tools collect personal identifying information including browsing history, search terms, location data, contact lists, and behavioral information — often without the awareness or consent of parents and students.
And then there’s the issue of recording. Many tutors record sessions for review or for students who miss class. But recording without clear consent can violate both FERPA and GDPR, depending on where the student lives. A tutor working from the U.S. with a student in the EU must comply with GDPR’s strict rules on data minimization, purpose limitation, and the right to be forgotten. The Digital Samba article in the research summary emphasizes that recording without clear consent is a risk that can lead to trust issues and legal penalties.
Say you record a tutoring session to help a student review a tough math concept. That recording contains the student’s face, voice, full name, and possibly their home background. If you store it on your personal Google Drive or Dropbox without a clear data retention policy, you’ve created a liability. The student (or their parent) has the right to request deletion — and if you can’t prove you deleted it promptly, you could face consequences under FERPA or GDPR.
What the Law Says — and Doesn’t Say
The two main federal laws in the U.S. — FERPA (1974) and COPPA (1998) — were written long before cloud-based EdTech and AI-powered tutoring existed. FERPA applies to schools receiving federal funding and requires written parental permission to share education records. But a 2011 amendment redefined “school officials” to include contractors, consultants, and other parties, which significantly weakened privacy protections. That loophole is how many EdTech vendors get access to student data without direct parental consent.
COPPA prohibits collecting personal information from children under 13 without parental consent, but it only covers commercial usage. The FTC allows schools to consent on behalf of parents for classroom use of a service — but not for commercial purposes beyond the educational function. For a remote tutor working with a 12-year-old, that means you need to be very clear about what data the platform collects and how it’s used. The Electronic Frontier Foundation’s review of 152 EdTech services found that 77% published privacy policies, but just over half outlined data retention policies.
Enforcement is another weak spot. The U.S. Department of Education has never punished a school district for a FERPA violation. The FTC fined Google $170 million in 2019 for collecting children’s personal information via YouTube — but that fine was equivalent to less than three months of advertising revenue from children’s videos. As the research summary puts it, “the rapid growth of EdTech outpaces legislation to regulate the industry and protect student data privacy.”
If you’re a tutor working independently, you are effectively acting as both the “school official” and the “vendor” in FERPA’s framework. That means you’re responsible for ensuring that any third-party tool you use has a valid “school official” designation — or that you have explicit parental consent. Most tutors aren’t even aware this distinction exists.
The Breach That Should Worry Every Tutor
The PowerSchool breach in late 2024 exposed personal information of approximately 62 million individuals — including students, parents, and staff — across over 18,000 schools. The data ranged from names and birthdates to grades, medical information, and Social Security numbers. That’s a massive breach affecting a centralized system. But for a remote tutor, the threat is more diffuse: you might be using a small EdTech app that nobody has audited, or a free quiz tool that stores student responses in a cloud database with weak security.
K12 SIX’s 2022 report found that over 70% of school cybersecurity incidents came from compromised credentials. For a tutor using the same password for Zoom, Google Classroom, and a personal email account, the risk is high. The FBI warned in 2018 of “widespread collection of sensitive information by EdTech” presenting “unique exploitation opportunities.” And a national teacher survey revealed that 68% of teachers had not received training on safe EdTech adoption to protect student data, and the majority felt pressured to download applications without understanding data collection.
Small tutoring businesses rarely have the budget for dedicated cybersecurity tools. But there are low-cost, high-impact steps that can make a real difference.
- Audit your tools. List every platform you use for tutoring — video calls, messaging apps, assignment tools, cloud storage. For each one, find the privacy policy. If you can’t easily find it, that’s a red flag. Consider switching to tools that have clear, education-focused privacy commitments.
- Use a VPN on your home network. Encryption between your device and the outside world matters, especially if you’re sharing Wi-Fi with family members. A reliable VPN adds a layer of protection for data in transit. ExpressVPN is one option that’s easy to set up and works across devices.
- Enable multi-factor authentication (MFA) on every account. If a platform offers MFA, turn it on. It’s one of the most effective ways to block credential theft. For accounts that don’t support MFA, consider replacing them with ones that do.
Beyond these basics, consider using a dedicated device for tutoring — even an old laptop that you don’t use for personal browsing. That limits the attack surface and keeps student data separate from your own photos, banking, and social media.
How to Build a Privacy-Conscious Tutoring Practice
Most of what’s documented here comes from multiple research sources, but the consistent message is that individual educators need to be proactive. You can’t rely on a school district’s IT team because you are the IT team.
Start by developing a simple data policy for your tutoring business. Write down:
- What data you collect (names, emails, recordings, assessment results)
- Where it’s stored (which cloud service, device)
- How long you keep it (e.g., delete recordings 30 days after the course ends)
- How you handle deletion requests
Share this policy with parents and students in an initial welcome email. It builds trust and sets expectations. The research summary notes that transparency can improve student satisfaction — and it also protects you legally.
When choosing a video platform, look for one that offers role-based moderation, waiting rooms, and the ability to disable screen sharing for students. Avoid platforms that track behavior for advertising. The Digital Samba article points out that a GDPR-compliant virtual classroom should have EU hosting, no third-party tracking, clear consent mechanisms, and data deletion on request. Even if you’re not in the EU, choosing a privacy-first platform raises your baseline.
For file sharing, use encrypted services that give you control over access expiration. Our guide to sharing files securely from home covers practical options. And if you’re using any AI-powered tutoring tools, be especially cautious — the research summary notes that over 60% of U.S. K-12 school districts use at least three different EdTech platforms collecting PII, yet fewer than 30% have dedicated legal counsel reviewing data privacy agreements annually.
⚡
The future of remote tutoring likely involves even more data collection — AI-driven learning pathways, biometric feedback, real-time analytics. The EU AI Act, effective early 2026, will categorize many EdTech applications as “high-risk” and impose strict requirements on transparency and human oversight. For tutors based in the U.S., this means that if you serve students in the EU, you’ll need to comply. And even if you don’t, the standard is rising globally.
I’m not saying every tutor needs to become a privacy lawyer overnight. But the evidence is clear: the current safeguards are insufficient, and the burden falls on the person closest to the student. For remote tutors, that’s you. The good news is that small, consistent steps — auditing your tools, using a VPN, enabling MFA, writing a data policy — create a foundation that protects both your students and your livelihood.
There’s no single perfect solution, and the legal landscape is still catching up. But every time you choose a platform with a clear privacy policy over a free one with vague terms, every time you ask for consent before recording, you’re building a practice that respects the people you teach. And that’s the kind of teaching that lasts.