The full curriculum
Ten modules, from privacy law to leakage testing
For people who build, buy or run AI tools that touch personal data. Modules 1 to 5 are written out in full; modules 6 to 10 are first drafts that set out the scope and will be expanded next.
Track 01
Privacy law, starting with education
FERPA, COPPA, PPRA, state student privacy laws and the contracts districts sign. What a vendor may do with student records, and why.
- M1
FERPA fundamentals
What the Family Educational Rights and Privacy Act protects, who it binds, the rights it gives families, and the exceptions that let records move without consent.
Full moduleWeek 1 - M2
FERPA for vendors
How an edtech company receives student records lawfully under the school official exception, what it may and may not do with them, and how AI features change the questions.
Full moduleWeek 2 - M3
COPPA and PPRA
The federal rules on collecting data from children under 13 and on surveys that ask students about sensitive topics, including family income.
Full moduleWeek 3 - M4
State student privacy laws
California's SOPIPA and the wave of state laws that followed it: what they prohibit, how they differ, and how to build a state-law matrix for the places you work.
Full moduleWeek 4 - M5
Data privacy agreements and the Pledge
The National Data Privacy Agreement districts sign with vendors, how its exhibits work, what it does not cover for AI, and what happened to the Student Privacy Pledge.
Full moduleWeek 5
Track 02
Nonprofit and family data
Working with community partners: sensitive household data, consent, data sharing agreements and program rules.
Track 03
AI security
How AI features fail, how to keep personal data out of prompts, and how to test that one customer's data never reaches another.
- M7
How AI features fail
The OWASP Top 10 for LLM Applications, the risk frameworks above it, and a threat model for an AI feature that touches student data.
Draft outlineWeeks 7 and 8 - M8
Keeping PII out of prompts
Redacting personal information before it reaches a model, what automated redaction catches and misses, and an AI and student data policy to back it up.
Draft outlineWeek 9 - M9
Testing for data leaks
Red teaming an AI feature for cross-tenant leakage, so one school's data never shows up for another, and a vetting checklist districts can use on any AI tool.
Draft outlineWeek 10
Track 04
Certification prep
Turning the coursework into a recognized credential, and choosing which one is worth the time.