The Short Answer
COPPA-compliant AI for schools means student data — especially under-13 student data — stays inside the district's network during the AI inference call. ibl.ai's runtime executes inside the district's VPC (same VPC as PowerSchool / Infinite Campus + Canvas / Schoology). No third-party AI vendor in the data path. The district controls data collection, retention, deletion, and parental notice.
What COPPA Actually Requires of K-12 AI
COPPA — the Children's Online Privacy Protection Act — restricts the collection of personal information from children under 13. Three structural questions every district counsel asks of any AI vendor:
- What personal information does the AI vendor collect? (Direct: identifiers, content, behavior; indirect: device, location, behavioral inference.)
- Does parental consent cover the vendor's collection? (Schools can sometimes act as agents for parents under FERPA/COPPA's school-official exception, but the scope is narrow.)
- What happens to collected data — retention, sub-processors, deletion, training, evaluation?
A managed AI vendor can address (3) with a strong DPA. They can address (2) by limiting school-acting-as-agent to specifically-authorized uses. They can't address (1) without the data physically transiting their cloud. Self-hosted on the district's infrastructure resolves question 1 by ensuring the vendor never receives the data in the first place.
How ibl.ai Ships COPPA-by-Deployment
The runtime executes inside the district's VPC. Same network as the SIS (PowerSchool, Infinite Campus, Skyward), LMS (Canvas, Schoology, Google Classroom via LTI 1.3), and any other student data systems the district already runs.
Student data never leaves the district's network during the inference call. Tutoring transcripts, lesson-plan inputs (when student context is included), writing-feedback content, parent-communication drafts — all processed inside the district's perimeter.
The control plane sees orchestration metadata, not student data. The secure Ed25519-signed WebSocket between the district-hosted runtime and the ibl.ai control plane carries which-mentor-which-skill-which-model-class metadata. Student data never crosses that boundary.
No vendor sub-processors in the data path. The district controls who has access to logs, who can review transcripts, and what retention policy applies — because the data lives in the district's environment, not the vendor's.
Model choice is the district's. Open-weight models (Llama 4, Qwen 3 for multilingual) run on the district's GPU; no data leaves the district. For frontier models accessed via cloud API, the district controls the proxy + data-residency policy.
Workloads Where COPPA Matters Most
- Tutoring sessions — every interaction reveals what the student struggled with, what accommodations were used, what the agent observed. Self-hosted means the transcripts stay on the district's SIS-adjacent infrastructure.
- Writing feedback — student essays contain personal context (about family, identity, experiences). The content is COPPA-sensitive for under-13 students; self-hosted keeps the content inside the district.
- IEP drafting — IEP-relevant student data is among the most-protected K-12 data classes. Self-hosted means the drafts stay in the district's existing IEP-data perimeter.
- Parent communication — message drafts contain student name + context; the message-generation logs stay on district infrastructure.
- Student-safety monitoring — concerning-language detection. The monitoring logs are sensitive on multiple compliance dimensions; self-hosted means the district controls the audit chain.
For the related FERPA architecture: FERPA-Compliant AI Platform for Higher Education (the arguments map to K-12).
The Cost Math
A 50,000-student district running tutoring + lesson planning + IEP drafting + writing feedback:
| Approach | Monthly cost | Student-data location |
|---|---|---|
| MagicSchool / Khanmigo (per-student $4–10 × 50K) | $200K–500K | Vendor cloud |
| ChatGPT Edu (~$25 × 3K teachers) | $75,000 | OpenAI cloud |
| Microsoft 365 Copilot Edu ($30 × 3K) | $90,000 | Microsoft cloud |
| Direct Claude Sonnet API | ~$2,931 | Anthropic cloud |
| ibl.ai self-hosted (Llama 4 / Qwen 3) | ~$3,000–6,000 | Inside the district's VPC |
ibl.ai self-hosted is dramatically cheaper than the per-student vendor alternatives — with COPPA-protected student data inside the district's existing perimeter rather than a third party's cloud.
For segment cost math: AI Cost Math for K-12 Districts: Per-Seat vs Usage-Based in 2026.
Multilingual Districts: An Underrated Compliance Argument
Districts serving multilingual learners (Spanish, Mandarin, Arabic, Haitian-Creole, Vietnamese, others) face a unique COPPA challenge: managed AI vendors often process the original-language input and the translation in their cloud. Each translation cycle is another data-handling event.
Self-hosted Qwen 3 (multilingual) on the district's GPU handles native-language interactions end-to-end inside the district. No translation traversal. No vendor seeing the original-language content.
For deeper multilingual context: Qwen 3 for Education: Multilingual AI Tutoring.
COPPA Posture Differences That Matter
| Managed K-12 AI vendor | ibl.ai self-hosted | |
|---|---|---|
| Student-data location during inference | Vendor cloud | Inside district's VPC |
| Parental-consent scope | Vendor's terms govern | District's policy governs |
| Sub-processors | Vendor's list | None |
| Retention + deletion | Vendor's controls | District's existing data-retention policy |
| Audit log location | Vendor SIEM | District SIEM |
| Model swap | Vendor approval | District config change |
| Air-gapped option | Rarely | Fully supported |
Run the Numbers
- MagicSchool Alternative — direct alternative deep-dive
- AI Cost Math for K-12 Districts — segment cost math
- What AI Tutoring Actually Costs in 2026 — per-session math + vendor comparison
- District-Controlled AI for K-12 Schools — broader district-control argument
- Claw Agents K-12: 12 AI Agents for Schools — open-source agent catalog
- Self-Hosted AI vs ChatGPT Enterprise for K-12 — deployment comparison
- Qwen 3 for Education: Multilingual AI Tutoring — multilingual self-hosted
- The Student Data Problem in AI Vendors for K-12 — broader student-data argument
Why Family-Owned and New York Matters Here
A school district's AI vendor relationship is a multi-year commitment that touches under-13 student data. ibl.ai is family-owned and operated from New York, NY — a long-term partner with a perpetual platform license and no investor exit pressure. The runtime is open source. The COPPA-protected student data stays inside the district's network. The math works at a 2,000-student elementary district or a 200,000-student urban system.
COPPA-compliant AI isn't a vendor certification. It's the architecture.