AI and GDPR in Schools: What European Parents Should Know

Your child comes home talking about a new “AI tutor” at school. Or you spot a consent form about “personalised learning software” buried in the term-time paperwork. As a parent in Europe, it’s natural to wonder: what exactly is the school doing with AI — and what does it mean for your child’s data?

This guide explains AI and GDPR in schools in plain language: how schools use AI tools, what data gets collected, and which GDPR rights you have as a parent. No alarmism, no legal jargon — just what you need to know, and the questions worth asking.

How schools actually use AI today

AI in schools is rarely a robot teacher. It’s usually quiet software running in the background of everyday school life:

Learning platforms: adaptive apps that adjust exercises to your child’s level, language-learning tools, maths practice tutors.
Administration: timetabling, attendance tracking, automatic marking of quizzes and homework.
Communication: chatbots answering parents’ routine questions, translation tools for multilingual families.
Teacher support: lesson-planning assistants and tools that summarise pupil progress data for parent evenings.
Supervision and exams: some schools use AI-based proctoring for online exams or monitoring software on school devices — the most privacy-sensitive uses of all.

Most of these applications are genuinely useful, and many teachers welcome them. The question isn’t “is AI in school bad?” — it’s “is my child’s data handled properly?” That’s exactly what European data protection law is designed to answer.

What data gets collected

Depending on the tools in use, a school’s AI systems may process several kinds of data about your child:

Account and identity data: name, class, date of birth, school email address.
Learning data: answers given, scores, time spent on tasks, progress over months and years — the raw material of “personalised learning”.
Behavioural data: login times, device usage patterns, pages visited on school platforms.
Sometimes sensitive data: voice recordings from language apps, photos or video from exam proctoring, or information about learning difficulties used to adapt teaching.

Children’s data enjoys extra protection under the GDPR. The law specifically says that children merit specific protection when their data is collected (Recital 38), and that privacy information must be written in clear language a child can understand. A school can’t treat your eight-year-old’s data the same way a company treats an adult customer’s.

What the EU AI Act adds

Alongside the GDPR, the EU’s Artificial Intelligence Act — the world’s first comprehensive AI law — classifies certain educational uses of AI as high-risk. That includes AI systems that determine access to education (like admissions software) or evaluate learning outcomes and steer children’s educational paths. High-risk systems must meet strict requirements: proper testing, human oversight, transparency, and documentation. In practice, this means schools should be especially careful — and especially transparent — when AI influences assessments or decisions about pupils.

Your GDPR rights as a parent

Under the GDPR, the school is the “data controller” for your child’s school data, which gives you concrete, enforceable rights. Here’s what matters most in practice:

1. The right to be informed

The school must tell you clearly which AI tools it uses, what data each one processes, why, and how long data is kept — normally in a privacy notice. Vague statements like “we use modern educational software” aren’t good enough. You can ask for specifics: which providers, which data, which purposes.

2. Consent — and its limits

Schools often ask for consent for optional tools, but for core teaching they may instead rely on their public task or legal obligations. Two things to know: genuine consent must be freely given and as easy to withdraw as it was to give — and the “digital age of consent” for online services varies across the EU (16 in Germany and the Netherlands, 15 in France, for example). Below that age, a parent’s consent is needed. If a “consent form” covers something your child can’t realistically opt out of, it may not be valid consent at all.

3. The right of access

You can request a copy of the personal data the school holds about your child — including data processed through AI tools. This is called a subject access request, and the school must respond within one month. It’s the single most useful tool for finding out what’s actually happening with your child’s data.

4. Rectification and erasure

Incorrect data must be corrected. And you can request deletion — the “right to be forgotten” — when data is no longer needed, when you withdraw consent, or when processing was unlawful. Schools may be legally required to keep some records (exam results, for instance), but AI-tool profiles, analytics data and old app accounts are often deletable. Our guide to the right to be forgotten and AI tools explains how deletion requests work in practice.

5. Objection and restriction

Where the school relies on legitimate interests or its public task, you can object to the processing — the school must then demonstrate compelling reasons to continue. You can also ask for processing to be restricted (frozen) while a complaint or dispute is being resolved.

6. Protection against purely automated decisions

The GDPR limits decisions based solely on automated processing that significantly affect a person — for example, an AI system deciding grades or school placements with no meaningful human involvement. If a school uses AI anywhere near assessment, a teacher must remain genuinely in the loop, not just rubber-stamping the software’s output.

Ten questions worth asking your school

You don’t need to be confrontational — most schools appreciate engaged parents. Consider asking, in writing:

Which AI tools and platforms does the school use, and for what purposes?
What personal data does each tool collect about my child?
What is the legal basis for each — consent, legal obligation, or public task?
Where is the data stored, and is it transferred outside the EU?
How long is the data kept, and when is it deleted?
Is my child’s data used to train AI models? (The answer should be no.)
Has the school signed data processing agreements with each provider?
Was a Data Protection Impact Assessment carried out for higher-risk tools such as proctoring or biometrics?
Who is the school’s Data Protection Officer, and how do I contact them?
Can my child opt out of optional AI tools without any disadvantage?

A well-prepared school will answer these calmly and specifically. Evasive or vague answers are worth following up — politely, and in writing so there’s a record.

Red flags to watch for

“Consent” that isn’t really optional — if opting out means your child can’t participate in normal lessons, the consent probably isn’t valid.
Tools the school can’t name — if nobody can tell you which AI providers process your child’s data, oversight is missing.
Biometric data collection — facial recognition or “emotion detection” in classrooms needs an exceptionally strong legal basis and a documented impact assessment.
Data used for advertising or model training — educational data should never feed ad targeting or train commercial AI models.
No privacy notice, or one written in pure legalese — the GDPR requires information in clear, accessible language.
Disadvantage for opting out — children should never be penalised for exercising privacy rights.

AI tools your child uses at home

Schools aren’t the only place children meet AI. Many use chatbots and homework helpers at home, which raises a separate set of questions. Most AI services set a minimum age (often 13, sometimes higher, or parental consent below 18) — check the terms of whatever your child uses. More importantly, have a calm conversation about what not to share: full name, photos, school name, location, or anything personal. AI chats can feel private, but anything typed in may be stored and reviewed. Review the app’s privacy settings together — it’s a good habit, and children usually appreciate being included rather than simply restricted.

What to do if you’re concerned

Start with the school itself: raise your questions with the teacher or administration first, then with the Data Protection Officer if the answers aren’t satisfactory. Put formal requests — access, erasure, objection — in writing (email is fine) and keep copies with dates. Schools must respond to rights requests within a month.

If the school doesn’t resolve the issue, you can complain to your national data protection authority — every EU member state has one, and complaints from parents about children’s data are squarely within their remit. You don’t need a lawyer to file a complaint, and authorities can investigate and order the school to change its practices. For broader background on how data protection applies to AI, our GDPR and AI tools explained guide covers the key principles in plain language.

The bottom line

AI in schools isn’t going away — and much of it genuinely helps children learn. As a European parent, you don’t need to become a privacy expert or a campaigner. You just need to know that the GDPR gives you real, practical rights: to be informed, to see your child’s data, to object, and to have data deleted when it shouldn’t be kept. Ask the questions, expect clear answers, and remember that a school handling data well will welcome the conversation, not fear it.