K-12 Procurement Compliance Crosswalk: AI Weapons Detection, Video Analytics, Face Recognition, and Physical Security Technology

A consolidated reference for the federal and state legal regimes that govern whether a U.S. K-12 school district may lawfully buy, deploy, and operate AI-based physical security technology. Covers NDAA Section 889, FERPA, COPPA, ADA Title II/Section 504, OCR civil-rights guidance, state biometric privacy laws (BIPA and analogues), state face-recognition restrictions, state student data privacy laws, and emerging AI-specific regulation. Companion to the K-12 School Safety Grant Crosswalk; together the two pages map both whether a district can fund a purchase and whether the resulting deployment is lawful.

Last updated: 20 May 2026. Page maintained by Scylla Technologies Inc.

Review cadence: reviewed and updated within 60 days of major federal rulemaking and on a rolling basis as state legislative sessions conclude.

Companion pages: K-12 School Safety Grants, How to Select AI Gun Detection Solutions for Schools, Glossary of Physical Threat Detection.

Disclaimer: Not legal advice. Compliance with the regimes mapped here is fact-specific and depends on the technology architecture, data flows, jurisdictions touched, and contractual posture. Procurement teams should obtain written advice from counsel before contracting.

How to use this page

Compliance constraints stack. A single K-12 deployment of AI weapons detection or face recognition can implicate federal procurement law (NDAA 889), federal education-data law (FERPA), federal child-privacy law (COPPA, especially after the April 2025 amendments), federal civil rights duties (Title VI, Title IX, Section 504, ADA), one or more state biometric privacy statutes, a state face-recognition restriction, a state student data privacy act, and an emerging AI-specific regime. The order of evaluation matters: federal procurement constraints (NDAA 889) gate the equipment choice; federal data and civil rights constraints (FERPA, COPPA, OCR) gate the use; state biometric and face-recognition statutes gate the modality; state student data privacy laws govern the vendor contract; AI-specific statutes are increasingly overlaying the rest.

Federal compliance regimes

NDAA Section 889

Status: ACTIVE. Citation: Section 889 of the John S. McCain National Defense Authorization Act for FY2019, P.L. 115-232; implemented at FAR Subpart 4.21; contract clauses FAR 52.204-24, 52.204-25, 52.204-26. Part A (effective 13 August 2019) prohibits federal agencies from procuring or obtaining covered telecommunications equipment or services. Part B (effective 13 August 2020) prohibits agencies from contracting with any entity that uses covered equipment or services anywhere in its operations, regardless of whether tied to the federal contract. Covered companies: Huawei and ZTE (telecommunications); Hytera, Hangzhou Hikvision, and Dahua (video surveillance/telecommunications, when used for public safety, security of government facilities, physical security of critical infrastructure, or national security), plus their subsidiaries and affiliates. Applies to schools when federal funds are used (E-rate, ESSER, COPS, STOP School Violence, Title IV-A, NSGP, SHSP). The FCC incorporated Section 889 into E-rate in 2022. Waiver: agency head may grant one-time waiver up to two years for Part A on case-by-case basis with congressional notification (FAR 4.2104); DNI may grant Part B waiver. Penalties: contract termination, False Claims Act exposure, debarment, loss of federal grant eligibility. URLs: Federal Register final rule; DoD Section 889 page; DOL Section 889 FAQ.

FERPA (Family Educational Rights and Privacy Act)

Status: ACTIVE. Citation: 20 U.S.C. 1232g; 34 CFR Part 99. Education records cannot be disclosed without parental written consent except under enumerated exceptions. Video or photo of a student is an education record when directly related to that student and maintained by the school (USDOE PTAC guidance). Law enforcement records exception at 34 CFR 99.8 covers records created and maintained by a "law enforcement unit" of the school for a law enforcement purpose. The 34 CFR 99.3 definition of "biometric record" includes face geometry, fingerprints, iris/retina, voiceprints; AI-generated face recognition templates and identifications tied to an identifiable student are likely education records unless held by a law enforcement unit for a law enforcement purpose. Vendors can act as "school officials" under 34 CFR 99.31(a)(1)(i)(B) only if under direct school control and limited to use the data was disclosed for. Penalties: loss of all USDOE funding; SPPO investigations; no private right of action (Gonzaga v. Doe). URLs: PTAC FAQ on photos and videos; When a photo/video is an education record; Video disclosure to police.

COPPA (Children's Online Privacy Protection Act)

Status: ACTIVE. 2025 amendments effective 23 June 2025; compliance required by 22 April 2026. Citation: 15 U.S.C. 6501-6506; 16 CFR Part 312; 2025 amendments at 90 FR 16936 (22 April 2025). Applies to operators of websites or online services directed to children under 13, or operators with actual knowledge they are collecting personal information from children under 13. Requires verifiable parental consent, data minimization, security, retention limits. 2025 amendments added biometric identifiers (fingerprints, voiceprints, faceprints/facial templates, iris/retina, gait, genetic data) and government-issued identifiers to the definition of personal information; require written information security program and written data retention policy; require separate verifiable parental consent for disclosures to third parties for non-integral purposes; and bar indefinite retention. Cloud-hosted AI security platforms collecting or processing biometric identifiers from K-8 students likely implicate COPPA; pure on-premises CCTV and edge AI analytics that do not transmit personal information to a third-party online service are generally outside scope. Schools can give consent in lieu of parents only for educational, school-authorized purposes per FTC COPPA School Guidance; vendor must rely on school authorization or obtain parental consent. Penalties: up to $53,088 per violation (2025-adjusted civil penalty under FTC Act 5(m)); injunctive relief. URLs: 2025 COPPA final rule; FTC press release.

CIPA (Children's Internet Protection Act)

Status: ACTIVE. Citation: P.L. 106-554; 47 U.S.C. 254(h)(5)-(6); 47 CFR 54.520. Requires internet safety policy and technology protection measures (filters) blocking obscene material, child pornography, and material harmful to minors. Not security-tech specific. Mentioned for completeness: if a district is using E-rate Category Two for the network supporting an AI security platform, the CIPA certification must still be in place. URLs: FCC CIPA page; 47 CFR 54.520.

ADA Title II and Section 504

Status: ACTIVE. ADA Title II web/mobile accessibility rule effective 24 June 2024; compliance dates 24 April 2026 (LEAs over 50,000 population) and 26 April 2027 (under 50,000). Citation: ADA Title II, 42 U.S.C. 12131-12165, 28 CFR Part 35; Section 504, 29 U.S.C. 794, 34 CFR Part 104; April 2024 DOJ Title II web/mobile rule at 28 CFR 35.200-35.207. Public school districts must ensure programs, services, and activities are accessible to persons with disabilities; "effective communication" requirement (28 CFR 35.160) and auxiliary aids/services. For physical security technology this means: mass notification must provide both audible and visible alerts for deaf/HOH and blind/low-vision users; panic buttons and two-way communications under Alyssa's Law systems must be operable by persons with mobility or dexterity limitations; visual strobes (NFPA 72) and tactile or SMS alternatives must coordinate with IEPs and 504 plans. Any web or mobile dashboard or notification app that the security vendor surfaces to staff or parents must conform to WCAG 2.1 AA. Penalties: DOJ enforcement; loss of federal funds (Section 504); private right of action under both statutes; OCR investigation. URLs: ADA Title II regulations; USDOE Section 504.

Title VI and OCR AI guidance

Status: ACTIVE guidance (not statute). Citation: Title VI of the Civil Rights Act, 42 U.S.C. 2000d; Title IX, 20 U.S.C. 1681; Section 504, 29 U.S.C. 794. Guidance: OCR "Avoiding the Discriminatory Use of Artificial Intelligence" (November 2024) includes an explicit hypothetical of AI facial recognition misidentifying students of color as known criminals. OCR February 2025 FAQ on Title VI and civil rights compliance. Operational implication: no statutory ban, but OCR can investigate complaints where AI security tools produce racially or ethnically disparate impacts (false positive rates, disparate weapons or threat flagging, disparate referral to law enforcement). Districts are expected to evaluate tools for bias before deployment, train staff, and maintain human oversight. Penalties: loss of federal funds; consent decrees; resolution agreements. OCR enforcement posture under the current administration has shifted in 2025; the 2024 AI guidance has not been formally rescinded as of May 2026. URL: USDOE AI guidance press release.

State biometric privacy laws

State biometric privacy statutes operate independently of FERPA and apply to vendors processing biometric identifiers in the state, regardless of whether the school district itself is exempt. The Illinois BIPA framework is the most consequential because it carries a private right of action with statutory damages; the Texas CUBI, Washington 19.375, NYC Biometric Identifier Law, and Portland face-recognition ban round out the dedicated single-issue regimes. State comprehensive privacy acts add a second overlay, often treating biometric data as "sensitive data" subject to opt-in consent.

Illinois Biometric Information Privacy Act (BIPA)

Status: ACTIVE; amended August 2024. Citation: 740 ILCS 14, amended by SB 2979 (P.A. 103-769), signed 2 August 2024. Private entities collecting biometric identifiers (retina/iris scans, fingerprints, voiceprints, scans of hand/face geometry) or biometric information must maintain a written, publicly available retention/destruction policy; provide written notice of purpose and term; obtain a written release; prohibit sale; restrict disclosure; and use reasonable care in storage. SB 2979 (2024): a repeated collection of the same biometric identifier from the same person using the same method is a single violation. Seventh Circuit (April 2026) held amendment retroactive to pending cases. Penalties: private right of action with statutory damages of $1,000 per negligent violation and $5,000 per intentional or reckless violation, plus attorneys' fees and injunctive relief (740 ILCS 14/20). Public school districts may fall within the "state agency" carve-out, but private schools and private vendors operating in Illinois public schools must comply; vendor liability persists even when the school district is exempt. URL: 740 ILCS 14.

Texas Capture or Use of Biometric Identifier Act (CUBI)

Status: ACTIVE since 1 April 2009. Citation: Tex. Bus. & Com. Code Section 503.001. A person may not capture a biometric identifier (retina/iris scan, fingerprint, voiceprint, record of hand or face geometry) for a commercial purpose unless informing the individual and receiving consent; restrictions on sale, lease, and disclosure; reasonable destruction within one year of purpose completion. Government use excluded. Schools as public bodies generally outside scope; third-party vendor conduct in capturing biometrics may be challenged as commercial. Texas AG-exclusive enforcement; civil penalty up to $25,000 per violation; no private right of action. February 2024 Meta settlement for $1.4 billion shows scale potential. URLs: Section 503.001; Texas AG page.

Washington RCW 19.375 (HB 1493 of 2017)

Status: ACTIVE since 23 July 2017. Citation: RCW Chapter 19.375. A person may not "enroll" a biometric identifier in a database for a commercial purpose without notice, consent, or a mechanism to prevent subsequent commercial use. Definition notably excludes physical or digital photographs, video or audio recordings, or data generated from them - which is the key ambiguity for face-template generation. Restrictions on sale, lease, and disclosure. Commercial-purpose definition excludes security or law enforcement. Schools likely outside scope; private vendor commercial use may be in scope. Penalties: Washington AG-exclusive enforcement under the Consumer Protection Act; no private right of action. URL: RCW 19.375.

NYC Biometric Identifier Information Law (Local Law 3 of 2021)

Status: ACTIVE since 9 July 2021. Citation: NYC Admin. Code Section 22-1201 et seq. Applies to "commercial establishments" defined as places of entertainment, retail stores, or food and drink establishments. Requires conspicuous signage where biometric identifier information is collected; prohibits any sale of biometric identifier information. K-12 schools (public, charter, private religious, or independent) do not fall within the statutory categories and are generally outside scope. School cafeterias operated commercially could conceivably touch it. Penalties: private right of action; 30-day cure period for signage violations; $500 first violation, $500 each negligent sale violation, $5,000 each intentional or reckless sale violation; attorneys' fees and costs. URL: NYC Admin. Code 22-1201.

Portland (OR) face recognition ban

Status: ACTIVE since 1 January 2021. Citation: Portland City Code Chapter 34.10 (private entities); Chapters 3.130 and 3.135 (city use). A "private entity" shall not use face recognition technologies in places of public accommodation within Portland. ORS 659A.400 defines "place of public accommodation" broadly to include educational institutions; private schools and certain religious schools in Portland likely within scope. Public schools sit under separate restrictions on government use; K-12 districts in Portland are separate units of government from city bureaus and should consult local counsel. Penalties: private right of action against private entities; damages or $1,000 per day of violation, whichever is greater. URL: Portland City Code 34.10.

State comprehensive privacy laws touching biometric data

Most state comprehensive privacy laws treat biometric data as "sensitive data" requiring opt-in consent (or, for Utah, notice and opt-out). They generally include a FERPA carve-out and nonprofit or government-entity carve-outs that effectively exempt public K-12 schools - but commercial vendors processing non-student consumer data (visitors, staff outside the student context) face full obligations, and processor obligations may flow through. The Colorado HB 24-1130 biometric amendment (effective 1 July 2025) is notable for reaching school employees and potentially students even where the general Colorado Privacy Act would not.

State face-recognition restrictions in or affecting schools

Only two U.S. jurisdictions have imposed a binding statewide K-12-specific restriction on face recognition technology as of May 2026: New York (a Commissioner's Determination prohibiting purchase or use) and Colorado (a procurement-and-public-hearing prerequisite under HB 22-1224). Several other states restrict government or law-enforcement face recognition more broadly, with implications that flow through to schools

New York: NYSED Commissioner's Determination (2023)

Status: ACTIVE prohibition since 27 September 2023. Citation: NY Education Law 2-d; 2020 NY Laws Ch. 122 (A6787-D) moratorium; 27 September 2023 Determination by NYSED Commissioner Betty Rosa following the August 7, 2023 NY Office of Information Technology Services biometric study. Schools (public, nonpublic, charter, BOCES) are prohibited from purchasing or using facial recognition technology. Schools may use other biometric identifying technology (e.g., fingerprint for cafeteria) at the local level after weighing privacy, civil rights, effectiveness, and parental input. No statutory sunset on the ban; conditional on future Commissioner reauthorization. Penalties: NYSED enforcement; potential funding consequences; Education Law 2-d penalties for student-data breaches apply separately. URL: NYSED Determination.

Colorado HB 22-1224 (school-specific face recognition restriction)

Status: ACTIVE since 10 August 2022. Citation: C.R.S. 22-32-156 (added by HB 22-1224). Local Education Providers (school districts and charters) may not procure or use face recognition technology unless the governing board approves following a public hearing and the system meets state requirements. URL: HB 22-1224.

Vermont 20 V.S.A. 4622 (Act 166 of 2020)

Status: ACTIVE since 7 October 2020. Citation: 20 V.S.A. 4622. Moratorium on Vermont law enforcement officer use of face recognition technology, except as permitted under the state's drone statute. Does not directly reach K-12 schools by its terms; school-employed sworn law enforcement officers (SROs) operating in a law enforcement capacity would be covered. Penalties: evidence obtained in violation inadmissible. URL: Act 166 summary.

Maine 25 M.R.S. 6001 (LD 1585 of 2021)

Status: ACTIVE since 18 October 2021. Citation: 25 M.R.S. Section 6001 (Facial Surveillance chapter). Prohibits Maine state, county, and municipal departments and public employees from possessing, obtaining, accessing, or using a facial surveillance system or information from one. Narrow exceptions: BMV fraud; iris-only systems in jails; law enforcement requests with specific predicate. Per ACLU of Maine, the law expressly applies to public schools and reaches public school employees and officials. Private schools not directly covered. Penalties: data collected in violation must be deleted and is inadmissible; private right of action for injunctive or declaratory relief; no statutory damages. URL: 25 M.R.S. 6001.

Massachusetts Chapter 253 of the Acts of 2020 / MGL c.6 Section 220

Status: ACTIVE since 31 December 2020. Citation: Chapter 253, Acts of 2020 ("An Act Relative to Justice, Equity, and Accountability in Law Enforcement"); codified at MGL c.6 Section 220. Massachusetts and political subdivisions, including police departments and public employees, may not acquire or use a face recognition system. Narrow exceptions for RMV, State Police, and FBI under court order or warrant (or emergency). Logging and reporting required. By definition includes public school districts and SROs. Penalties: evidence suppression; documentation and reporting duties. URLs: Chapter 253 of 2020; MGL c.6 Section 220.

Other proposed and local restrictions

Illinois SB 3735 (104th General Assembly, "Student Educational Technologies Rights Act"): Would prohibit school districts from purchasing or acquiring biometric systems for use on students. Status as of May 2026: PROPOSED / pending; not enacted. URL: IL SB 3735. New Hampshire HB 1230 (2020) prohibits use of face recognition in conjunction with body-worn cameras (law enforcement, not school-specific). Local government face-recognition bans in San Francisco (2019), Oakland (2019), Berkeley (2019), Somerville MA (2019), Brookline MA (2019), Cambridge MA (2020), Boston (2020), Minneapolis (2021), Pittsburgh, and others may reach school districts within those jurisdictions depending on each ordinance; municipal codes vary

Other proposed and local restrictions

Illinois SB 3735 (104th General Assembly, "Student Educational Technologies Rights Act"): Would prohibit school districts from purchasing or acquiring biometric systems for use on students. Status as of May 2026: PROPOSED / pending; not enacted. URL: IL SB 3735. New Hampshire HB 1230 (2020) prohibits use of face recognition in conjunction with body-worn cameras (law enforcement, not school-specific). Local government face-recognition bans in San Francisco (2019), Oakland (2019), Berkeley (2019), Somerville MA (2019), Brookline MA (2019), Cambridge MA (2020), Boston (2020), Minneapolis (2021), Pittsburgh, and others may reach school districts within those jurisdictions depending on each ordinance; municipal codes vary

State student data privacy laws

More than 40 states have enacted student data privacy statutes since 2015, many modeled on California's SOPIPA. These laws apply to vendors regardless of whether the school district has a contract with them, and many define "covered information" broadly enough to capture biometric data, video, behavioral data, and AI analytics output. Vendors of AI physical security technology to K-12 schools should expect to execute the relevant state Data Privacy Agreement (the National Data Privacy Agreement v2 from the SDPC is the most common template).

California Student Online Personal Information Protection Act (SOPIPA)

Status: ACTIVE since 1 January 2016. Citation: SB 1177 (2014); Cal. Bus. & Prof. Code Sections 22584-22585. An operator of an Internet website, online service, or mobile application that is used primarily and designed and marketed for K-12 school purposes may not target ads, profile a student, sell/rent student info, or disclose covered info except as permitted. Must maintain reasonable security and delete on district request. "Covered information" includes any personally identifiable information or material descriptive of the K-12 student created or provided in the K-12 context, including biometric, behavioral, photos, and video. AI security cameras with cloud analytics processing identifiable student imagery in a K-12 marketing context fall within SOPIPA when the service is designed and marketed for K-12 school purposes. Schools must additionally contract under Cal. Educ. Code 49073.1 (AB 1584). Penalties: California AG enforcement; per-violation penalties up to $2,500 (negligent) and $7,500 (intentional) under Bus. & Prof. Code 17206; no private right of action under SOPIPA. URLs: SB 1177; codified at Bus. & Prof. Code 22.2.

Other state student data privacy laws

Florida F.S. 1002.222 deserves separate attention: it prohibits Florida K-12 agencies and institutions from collecting biometric information from students, parents, or siblings (defined to include fingerprint, hand geometry, voiceprint, retinal or iris pattern, and face geometry), with narrow exceptions. This is the only state statute that outright bars collection of student biometric data at the school-system level. Penalties: Florida AG action; civil penalties.

AI-specific regulation

Colorado AI Act (SB 24-205)

Status: ACTIVE-PENDING; effective 30 June 2026 (originally 1 February 2026, postponed by SB 25B-004 signed 28 August 2025). Citation: C.R.S. 6-1-1701 et seq. Imposes duties on developers and deployers of "high-risk AI systems" to use reasonable care to protect Coloradans from algorithmic discrimination. Requires pre-deployment impact assessments, notice to consumers, right to appeal adverse consequential decisions. High-risk AI system is defined as one that makes or is a substantial factor in making a "consequential decision," including education enrollment/opportunity and employment. Pure threat detection or weapons identification in a hallway is arguably not a consequential decision for the subject being scanned; face recognition tied to discipline referral, exclusion from school, or hiring/promoting employees IS likely a substantial factor in a consequential decision. Anti-fraud technology is exempt unless face recognition is involved. Penalties: Colorado AG-exclusive enforcement; up to $20,000 per violation under the Colorado Consumer Protection Act. URLs: SB 24-205; SB 25B-004 postponement.

California AI laws

AB 2013 Generative AI Training Data Transparency: effective 1 January 2026; requires developers of generative AI to publish a training-data summary. Pure discriminative models (object detection, face match) likely outside scope. SB 1047 (Frontier AI): VETOED 29 September 2024; not in effect. SB 942 AI Transparency Act: watermarking and disclosure obligation for large generative AI providers; effective date delayed by AB 853 to 2 August 2026; not directly applicable to most physical security AI. AB 2655 Defending Democracy from Deepfake Deception Act of 2024: effective 1 January 2025; election deepfakes; not applicable to K-12 security. CCPA Automated Decisionmaking Technology regulations finalized in 2025 may apply to AI vendors handling consumer data. URLs: AB 2013; SB 1047 (vetoed); SB 942.

Illinois HB 3773

Status: ACTIVE-PENDING; effective 1 January 2026. Citation: P.A. 103-804. Amends Illinois Human Rights Act to bar AI-driven employment discrimination and require notice. Applies to school districts as employers when using AI in hiring, promotion, and discipline of staff. Does not directly govern student-facing security AI. URL: HB 3773.

NYC Local Law 144 (Automated Employment Decision Tools)

Status: ACTIVE; enforcement began 5 July 2023. Citation: NYC Admin. Code Section 20-870 et seq.; DCWP final rules. Employers may not use an automated employment decision tool to substantially assist or replace discretionary employment decisions for candidates or employees residing in NYC unless a bias audit was conducted within the prior year by an independent auditor, summary results were publicly posted, and notice was provided at least 10 business days before use. NYC public schools (NYC DOE) and charter schools are covered when using AEDT for hiring or promotion of staff. Penalties: $500 first violation; up to $1,500 subsequent; each day is a separate violation; NYC DCWP enforcement. URL: nyc.gov AEDT.

State K-12 AI guidance (non-binding)

As of May 2026, more than 33 state education departments have issued AI guidance documents. These do not carry the force of law but inform district procurement standards and Data Privacy Agreement terms. Notable: USDOE OET 2023 "Artificial Intelligence and the Future of Teaching and Learning" report and 2024 "Designing for Education with Artificial Intelligence" developer guide; NYSED 2023 OITS biometric report and Commissioner's Determination (the only state with a binding school-specific face-recognition restriction); California CDE "Learning with AI, Learning About AI"; Tennessee SBE required districts to adopt AI policies for instructional use by school year 2024-25.

Cross-cutting notes

The stack typically applies in this order for an AI weapons detection or AI video analytics deployment in a U.S. K-12 school: (1) NDAA 889 gates the equipment if any federal funds touch the purchase; (2) state-specific face-recognition restrictions (binding in New York and Colorado) and state biometric privacy statutes (statutory damages in Illinois) gate the modality; (3) Florida F.S. 1002.222 outright bars collection of student biometrics in Florida K-12 schools; (4) FERPA governs whether the system's outputs are education records subject to disclosure rules; (5) COPPA (especially after the 2025 amendments) gates cloud processing of biometric data for children under 13; (6) ADA Title II and Section 504 require accessible mass notification and panic alert; (7) the state student data privacy statute governs the vendor contract; (8) Title VI and OCR civil rights guidance require evaluation for disparate impact; (9) Colorado AI Act (effective 30 June 2026) overlays high-risk AI deployments; (10) NYC Local Law 144 reaches school district hiring uses of AI.

Jurisdictions where AI weapons detection or face recognition is currently most constrained: New York (face recognition prohibited in schools), Florida (student biometric collection barred), Colorado (procurement-and-public-hearing prerequisite plus the impending AI Act), Illinois (BIPA private right of action for vendors), Maine (face surveillance ban applies to schools), Massachusetts (face recognition acquisition by state and municipal agencies banned), Portland OR (face recognition in places of public accommodation banned), New Jersey and Washington and Oregon and Tennessee (Alyssa's Law mandate requires panic-alarm path that is compatible with the rest of the stack)

Jurisdictions with the fewest direct constraints on K-12 AI security deployments as of May 2026: most states without comprehensive privacy laws or biometric statutes, although all schools remain subject to federal FERPA, COPPA, ADA, and Title VI.

Methodology

This page consolidates published federal and state legal sources current as of the update date. Citations were drawn from primary government sources (statutes, regulations, agency guidance) wherever possible. Secondary sources used for context are flagged inline. No new legal analysis has been performed beyond consolidation; this page is not legal advice.

Fields flagged for verification with counsel: the boundary between FERPA "law enforcement records" and education records for AI outputs; whether a particular state biometric statute reaches a specific vendor architecture; whether a deployment in a NYC public school is "substantial assistance" to an employment decision under Local Law 144; the operational definition of "high-risk AI system" under the Colorado AI Act for security deployments. Procurement teams should obtain written advice from counsel before contracting.

Updates: this page is reviewed and updated within 60 days of major federal rulemaking and on a rolling basis as state legislative sessions conclude. Errata: corrections welcome via the Scylla contact form.

Frequently asked questions

Does NDAA Section 889 apply to a public K-12 district?

Yes, when the district uses federal funds (E-rate, ESSER, COPS, STOP School Violence, Title IV-A, NSGP, SHSP) to purchase or operate the equipment. Part A (since 13 August 2019) prohibits agencies from procuring or obtaining covered equipment. Part B (since 13 August 2020) prohibits agencies from contracting with any entity that uses covered equipment anywhere in its operations. Covered companies include Huawei, ZTE, Hytera, Hangzhou Hikvision, Dahua, and their subsidiaries and affiliates. Districts using only state and local funds for a discrete purchase may be outside Section 889 for that purchase, but the FCC has incorporated Section 889 into E-rate since 2022, so any district touching E-rate is subject to it for the relevant infrastructure.

Can a public school use face recognition in the United States?

In New York state, no - the NYSED Commissioner's Determination of 27 September 2023 prohibits the purchase or use of facial recognition technology by NY public and nonpublic schools. In Colorado, only after the local governing board approves following a public hearing and the system meets state requirements (C.R.S. 22-32-156). In Maine, public school employees and officials are barred by 25 M.R.S. Section 6001. In Massachusetts, state and municipal agencies including public school districts are barred by MGL c.6 Section 220 (face recognition acquisition). In Florida, K-12 agencies cannot collect face geometry from students per F.S. 1002.222. In Illinois, public school districts may operate under the BIPA "state agency" carve-out, but private schools and private vendors operating in Illinois public schools must comply with BIPA, which carries a private right of action with statutory damages. In other states, face recognition in schools is generally allowable subject to FERPA, COPPA, state student data privacy laws, ADA accessibility duties, and OCR civil rights obligations.

Does Illinois BIPA apply to a vendor selling AI security to Illinois public schools?

Yes for the vendor as a private entity, even if the public school district itself qualifies for the state-agency carve-out. Statutory damages are $1,000 per negligent violation and $5,000 per intentional or reckless violation, plus attorneys' fees, under 740 ILCS 14/20. The 2024 SB 2979 amendment (held retroactive by the Seventh Circuit in April 2026) caps the per-occurrence theory: a repeated collection of the same biometric identifier from the same person using the same method is a single violation. Private schools in Illinois remain directly subject to BIPA.

Does COPPA apply to AI security cameras in elementary schools?

Pure on-premises CCTV or edge AI analytics that do not transmit personal information to a third-party online service are generally outside COPPA. Cloud-hosted AI security platforms collecting or processing biometric identifiers from children under 13 likely implicate COPPA, especially after the 2025 amendments to 16 CFR Part 312 that added biometric identifiers to the definition of personal information and required a written information security program and retention policy. Compliance with the 2025 amendments is required by 22 April 2026. Schools can give consent in lieu of parents only for educational, school-authorized purposes per FTC COPPA School Guidance.

Is AI-generated video of a student an education record under FERPA?

Yes when the video is directly related to that student and maintained by the school, per USDOE PTAC guidance. The law enforcement records exception at 34 CFR 99.8 covers records created and maintained by a "law enforcement unit" of the school for a law enforcement purpose. AI-generated face recognition templates and identifications tied to an identifiable student are likely education records unless held by a law enforcement unit for a law enforcement purpose. Vendors can act as "school officials" under 34 CFR 99.31(a)(1)(i)(B) only if under direct school control and limited to use the data was disclosed for.

Does the Colorado AI Act apply to AI weapons detection deployed in a school?

Possibly, depending on use. The Act takes effect 30 June 2026 and applies to "high-risk AI systems" - those that make or are a substantial factor in making a "consequential decision" (including education enrollment/opportunity and employment). Pure threat detection or weapons identification in a hallway is arguably not a consequential decision for the subject being scanned. Face recognition tied to discipline referral, exclusion from school, or hiring/promoting employees IS likely a substantial factor in a consequential decision. Anti-fraud technology is exempt unless face recognition is involved.

What does ADA Title II require for a security mass-notification system?

Effective communication that is equally effective for deaf or hard-of-hearing users (visual alerts, strobes per NFPA 72) and blind or low-vision users (audible alerts, tactile or SMS alternatives), plus operability of panic buttons by users with mobility or dexterity limitations. Any web or mobile dashboard or notification app surfaced to staff or parents must conform to WCAG 2.1 AA under the April 2024 DOJ Title II web/mobile rule; compliance dates 24 April 2026 (LEAs over 50,000 population) and 26 April 2027 (under 50,000).

What's the right contracting framework for an AI security vendor selling to U.S. K-12 schools?

Most U.S. K-12 districts now use the Student Data Privacy Consortium's National Data Privacy Agreement v2 with a state-specific exhibit. The vendor should attest to FERPA "school official" status with direct school control, commit to deletion on termination, agree to breach-notification timelines (typically 30 to 60 days, varies by state), and align with the relevant state student data privacy statute. In Texas, TX-RAMP cloud certification is increasingly required for cloud-hosted analytics. In New York, the Education Law 2-d Part 121 Data Privacy and Security Plan is required.