FERPA & COPPA: 24 Questions to Ask Student Phone Enforcement Vendors — LockedIn Checklist
Legal and technology committees: vet vendors with this LockedIn-aligned questionnaire covering data minimization, subprocessors, parental consent, directory information, and audit rights for K-12 phone lock platforms.
GuidesBy Brian Ohebshalom and Noah Fakheri, LockedIn’s co-founders
20 min read
Phone enforcement touches some of the most sensitive data categories in K-12: minor identities, location-adjacent metadata, disciplinary correlates, and communications metadata. Generic edtech DPAs copy-pasted from math tutoring apps fail instantly under school board scrutiny. This guide gives general counsel a practical interrogation list — including how LockedIn, which we make, answers them.
Disclaimer: This article is informational, not legal advice. Work with qualified school counsel for your state.
Section A — Data Minimization & Purpose Limitation
- What student PII is strictly necessary to perform instructional lock enforcement?
- Does the vendor sell or monetize student data to advertisers?
- Can the district purge historical telemetry on demand?
- How are de-identified analytics separated from identifiable logs?
- Does LockedIn-style OS enforcement avoid content inspection of SMS/email? (LockedIn is architected for compliance visibility without social surveillance.)
Section B — Subprocessors, Hosting, and Transfers
- List all subprocessors with function + data touched.
- Where is data physically stored? Can districts restrict to US regions?
- What SOC 2 / ISO evidence exists?
- How are keys rotated and who holds root access?
Section C — Parental Rights & Transparency
- How does the vendor document consent or opt-in flows for BYOD?
- What parent-facing materials explain emergency unlock?
- How quickly can parents request data exports or deletions?
- How does the product avoid collecting content that should remain in family iCloud accounts?
Section D — Directory Information, IEPs, and 504 Plans
- How are exemptions cryptographically tied to authorized staff approvals?
- Can counselors audit who modified a medical exemption?
- Does the vendor train schools on FERPA’s “legitimate educational interest” standard?
Section E — Security Testing & Incident Response
- Provide latest penetration test executive summary.
- What is SLA for incident notification?
- How does the vendor handle student-generated bug bounty reports responsibly?
How App-Based Enforcement Differs From MDM Retrofits
MDM stacks were built for district-owned fleets — not for nuanced parent politics around personal phones. LockedIn’s documentation package is tuned for instructional lock without becoming a student surveillance product. Compare stacks in MDM vs app-based phone solutions and BYOD enforcement hub.
Section F — Additional Questions for RFP Scoring
- • Provide sample DPIA language for state regulators.
- • Describe model clauses for charter management organizations.
- • How does pricing scale for economically disadvantaged student populations?
- • Attach reference customers willing to speak to peer districts.
- • Demonstrate how the vendor’s roadmap prioritizes student privacy over growth hacking.
When your committee scores responses, weight vendors that prove minimization with architecture, not marketing. Ask LockedIn the same questions you ask everyone else; our comparison of phone-free school solutions (we make one of the options) lays out how the categories differ.
Request LockedIn’s Security & Privacy Packet
General counsel: contact LockedIn for our security overview, subprocessor list, and DPA. Our SOC 2 Type II attestation is in progress and not yet complete.
More LockedIn vs competitor comparisons
Searching for a phone-free school, school phone management, or K-12 phone ban alternative? Each guide below targets the competitor by name so you can compare LockedIn to the product families administrators evaluate alongside district policy.
- → LockedIn vs Bark for Schools — content monitoring vs OS phone lock
- → LockedIn vs Brick — Brick phone / Brick Mode vs district enforcement
- → LockedIn vs CLocked — classroom launcher vs OS phone lock
- → LockedIn vs GoGuardian — Chromebook filters vs student phone lock
- → LockedIn vs LanSchool — classroom management vs campus phone lock
- → LockedIn vs Mobile Guardian — MDM vs BYOD student phones
- → LockedIn vs NutKase Phone Pouches — Velcro pouch vs OS lock
- → LockedIn vs Off The Device — airplane mode nudges vs OS lock
- → LockedIn vs Phone-Free School App — manual School Mode vs geofenced lock
- → LockedIn vs Pinwheel — kid-safe phones vs lock any student phone
- → LockedIn vs Pocket Points — rewards app vs mandatory enforcement
- → LockedIn vs Securly — web filter vs OS-level student phone lock
- → LockedIn vs Taplock — geofenced app limits vs OS phone lock
- → LockedIn vs The Commons App — distraction-free app vs OS phone lock
- → LockedIn vs TRUCE Family — MDM app block vs OS lock (no MDM)
Topics: FERPA student phone monitoring, COPPA school apps, vendor questionnaire student data, K-12 phone enforcement privacy, LockedIn FERPA compliance