What not to paste into AI tools: student data in seven rules
Before you paste anything into an AI tool, take out whatever points to a particular student: name, marks, health, family, photo. Describe the situation, not the child, then add the name yourself in your own copy once you are out of the tool.
Seven rules before you paste anything into an AI tool
A free printable PDF, no sign-up.
- Definition
- Student personal data: Any information that identifies a particular student or can be linked to one: name, ID number, photo, marks, your notes about them, and what you know about their health and family.
The seven rules, each with a before-and-after prompt
Most of what a teacher asks an AI tool for needs no student data at all: a lesson plan, a worksheet, a short quiz. The trouble starts with requests about one student — a note home, a report card comment, an analysis of marks. The table gives seven rules for those requests. The middle column is what people usually type; the last is what they type after applying the rule, and it still gives the tool everything it needs to write the draft. The examples were written for this post, and the names in them are made up.
| Rule | Before | After |
|---|---|---|
| 1. A name becomes a role | “Write a note to the parents of Yousef Khaled in 7B about his absences.” | “Write a note to the parents of a Grade 7 student about frequent absences.” |
| 2. No mark tied to a name | “Here are my class's marks: Layla 12/20, Mazen 18/20… analyse them.” | “On a 20-question test, half the class got questions 4 and 7 wrong, both on [topic]. Suggest a review activity for them.” |
| 3. The need, not the diagnosis | “My student Sara has diabetes and ADHD — how should I handle her?” | “Suggest ways to split a 20-minute writing task into short parts for a student who needs breaks.” |
| 4. No family details | “The student's parents are separated and struggling financially. Write to them about his decline.” | “Write a calm note inviting a parent to a meeting about their son's slipping homework, without assuming a reason.” |
| 5. No photos or scans | A photo of a test paper showing the student's name and handwriting. | “A Grade 6 student wrote . What is wrong with the thinking, and how do I explain it?” |
| 6. No full records | The whole class file, with names, national ID numbers and parents' phone numbers. | Only the column you need, with sequence numbers instead of names. |
| 7. The name goes in outside the tool | “Write Omar's report card comment: hard-working but hands work in late.” | “Write a report card comment for a hard-working student who hands work in late, and leave [name] where the name goes.” Then type the name in your copy. |
In every row the request stays the same and the student leaves it. Rule 7 sums up the rest: ask the tool for a good general text, then make it about your student in your own file.
Why each rule
Rules 1, 2 and 6: what you type leaves your classroom. Whatever you paste into an online AI tool usually reaches a company's servers, where it may be stored, reviewed or used to improve the tool, depending on its terms and your account settings. The name, the mark and the ID number are what make that text about one particular child.
Rules 3 and 4: some data is more sensitive than the rest. In Jordan, for example, the Personal Data Protection Law No. 24 of 2023 was published in the Official Gazette on 17 September 2023 and took effect on 17 March 2024, according to an analysis by the law firm Clyde & Co. It requires the prior consent of the person the data is about, with listed exceptions; it treats health, physical and mental condition and financial standing as sensitive data; and it restricts transfers outside Jordan when the recipient's protection is weaker. Every Arab country has its own law. This is not legal advice — ask your school what applies to you.
Rule 5: a photo carries more than you see. A photo of a paper has the name and the handwriting, sometimes a face and a class section. Type what the student wrote and you get the same explanation without the photo.
Above all the rules: the decision is the school's, not yours alone. UNESCO's guidance on generative AI in education and research (September 2023) notes that the absence of national regulation in most countries leaves users' data privacy unprotected, and it calls for mandating data privacy protection and considering an age limit of 13 for classroom use. In the US, the Federal Trade Commission's COPPA FAQ says a school may consent on parents' behalf only in the educational context, and recommends that schools or districts decide which services are appropriate rather than leaving it to individual teachers. The lesson is the same in every country: if a tool will hold student data, that is the school's decision.
Eight questions for any tool's privacy terms
Read the tool's privacy page with these questions. The first six are adapted from the questions the FTC suggests US schools ask service providers; we added the last two.
Before you adopt a tool
- What data does the tool collect about students?
- How does it use that data?
- Does it use or share the data for commercial purposes unrelated to the service?
- Can the school review the data and have it deleted?
- How does it protect the data's security and confidentiality?
- How long does it keep the data, and when does it delete it?
- Are models trained on what you type, and can you turn that off?
- Where is the data stored, and in which country?
If you cannot find a clear answer to one of them, assume the worst answer and apply the seven rules without exception. String publishes its practices on its Trust Center page; read it with the same questions.
When removing the name is not enough
Removing the name is not always enough. In a small class, or with a rare detail, a description identifies a student as surely as a name: “the only Grade 7 student who uses a wheelchair” is someone everyone at the school knows. Remove the rare detail too, or write that draft without the tool. And if your school has adopted a specific tool and has an agreement with its provider, the school's policy comes first; these rules add to it and do not replace it.
For the other side of this — what to hand to the tool when you prepare a lesson, and what to check yourself — read lesson prep with AI. For your students' own rules on these tools, read a one-page AI policy for your classroom.
Frequently asked questions
- Can I put students' names into ChatGPT?
- Not unless your school has approved the tool for student data. Describe the student by role or situation, and add the name in your own copy once you are out of the tool.
- Is removing the name enough to protect student data?
- Not always: a rare detail identifies a student as surely as a name. Remove it too, or write the draft yourself.
- Do AI tools train on what I type?
- It differs from tool to tool, and can differ by account type and settings. Look for the answer in the privacy terms (question 7 above), and if you cannot find it, assume they do.
- What is Jordan's personal data protection law?
- Law No. 24 of 2023, in force since 17 March 2024; it treats health data as sensitive, according to Clyde & Co's analysis. Ask your school how it applies to you.
Sources
Every fact in this post that we did not produce ourselves comes from one of these sources.
- Jordan issues first personal data protection law (Lamisse Bajunaid) — Clyde & Co, 2023-10-17
- Guidance for generative AI in education and research — UNESCO, 2023-09-07 (last updated 2026-01-16)
- UNESCO calls for regulations on AI use in schools — UN News, 2023-09-07
- Complying with COPPA: Frequently Asked Questions (section N, COPPA and schools) — US Federal Trade Commission, Undated page; reflects the COPPA Rule as amended on 2025-04-22
Written with String's editorial team: we use AI for research and first drafts, and a person checks every fact and every source before anything is published. How we write
Founder and CEO, String
“I grew up in a house of teachers.” I spent a year designing the STEM program for one of the largest school groups in Saudi Arabia, have written curriculum by hand, trained robotics coaches and sold software into schools, then left that job to build String in Amman.
