FERPA compliance guide for AI mock interviews. Digital DPA signing, 30-day auto-deletion, student consent for free access, advisor-only coaching notes. School Official designation.
The Family Educational Rights and Privacy Act (FERPA) protects the privacy of student education records. When career centers adopt AI mock interview platforms, they must ensure compliance with FERPA's requirements for third-party access to student data.
FERPA allows institutions to share student records with contractors who qualify as "School Officials"—third parties performing services the institution would otherwise use employees to perform. AI interview platforms qualify when properly contracted with a Data Processing Agreement (DPA) that defines purpose limitation, security safeguards, and data retention.
The key compliance elements are: formal DPA with School Official designation, purpose limitation to educational use only, defined data retention periods with automatic deletion, and student consent for career center visibility. InterviewGuru supports digital DPA signing during onboarding and automatically deletes all student data after 30 days. Career centers see aggregate progress metrics and NACE competency scores only when students consent — they never see interview recordings. Advisor coaching notes are private to advisors and not visible to students.
Use this checklist when evaluating AI mock interview vendors.
Contract & Legal (Critical): DPA signed by vendor (InterviewGuru supports digital signing), School Official designation language, purpose limitation clause, prohibition on data sale.
Data Handling (Critical): Clear data inventory, defined retention period (InterviewGuru: 30 days automatic), automatic deletion process documented, branded export reports contain only aggregate data.
Security (Critical): Encryption at rest and in transit, access controls (role-based permissions with advisor-only coaching notes), security incident response plan, SOC 2 Type II or equivalent certification.
Transparency (Recommended): Student-facing privacy notice, consent mechanism for career center visibility (InterviewGuru: consent = free access), clear explanation of what career centers can see (aggregate metrics, NACE scores, readiness distribution — never recordings).
Are AI mock interview platforms FERPA compliant?
AI mock interview platforms can be FERPA compliant when they qualify as School Officials under the FERPA exception. This requires a formal Data Processing Agreement (DPA), defined data access and retention policies, and use of data solely for educational purposes. InterviewGuru supports digital DPA signing and 30-day automatic data deletion.
What is the School Official exception under FERPA?
FERPA allows educational institutions to share student records with third parties who qualify as School Officials—contractors performing services that the institution would otherwise use employees to perform. AI interview platforms qualify when properly contracted with a DPA.
Do students need to consent to share data with career centers?
Best practice is yes. InterviewGuru requires student consent for career center visibility — students opt-in to share progress in exchange for free access. Career centers see aggregate metrics, NACE competency scores, and readiness distribution but never interview recordings. Advisor coaching notes are private and not visible to students.