[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$feeAQ0DvBYNzGO5M4dCm3roZAvkhPufkKlpO1l1nQowE":3},{"article":4,"iocs":47,"watch_terms":48,"solutions":49,"lesson":100},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"32a5cab9-1c1d-4edc-a296-a7aa24ecdc48","Microsoft Commits to Sweeping AI Privacy Rules for Students. Will Other Tech Giants Follow?","microsoft-commits-to-sweeping-ai-privacy-rules-for-students-will-other-tech-gian-761d0d","Microsoft agreed to adopt guardrails and privacy standards for its AI in schools, as negotiated with the American Federation of Teachers. The post Microsoft Commits to Sweeping AI Privacy Rules for Students. Will Other Tech Giants Follow? appeared first on SecurityWeek.","Microsoft has agreed to implement new privacy guardrails and standards for its AI tools used in schools, following negotiations with the American Federation of Teachers (AFT). The agreement prohibits using student data for AI training, sales, advertising, or product development, and bans AI features designed to foster emotional dependency. This pact, which includes third-party audits, aims to set an industry standard in the absence of federal AI legislation for education, though other tech giants like Google have yet to commit to similar measures.","Microsoft agrees to AI privacy rules for students with teachers union.","https:\u002F\u002Fwww.securityweek.com\u002Fmicrosoft-commits-to-sweeping-ai-privacy-rules-for-students-will-other-tech-giants-follow\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F01\u002FCybersecurity_News-SecurityWeek.jpg","2026-09-15T20:24:51+00:00","2026-09-15T22:00:20.610232+00:00",7,[17,20,22,24,26],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":19},"OpenAI",{"name":23,"type":19},"Anthropic",{"name":25,"type":19},"Google",{"name":27,"type":28},"AI chatbots","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":29,"icon":31,"name":32,"slug":33},null,"Policy","policy",[35,40,45],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":41},{"id":42,"icon":31,"name":43,"slug":44},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":46},{"id":29,"icon":31,"name":32,"slug":33},[],[18,25,21],{"controls":50,"vendors":96},[51,79],{"slug":52,"name":53,"problem":54,"products":55},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[56,64,72],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":73,"vendor_name":18,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"slug":80,"name":81,"problem":82,"products":83},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[84,90],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":85,"product_name":86,"url":88,"description":89},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":91,"product_name":92,"url":94,"description":95},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",[97],{"slug":73,"name":18,"logo_path":74,"roles":98},[99],"affected",{"slug":101,"title":102,"body":103,"framework_refs":104,"framework_notes":115},"microsoft-sets-ai-privacy-bar-for-student-data-will-the-industry-follow","Microsoft Sets AI Privacy Bar for Student Data — Will the Industry Follow?","Microsoft's agreement with the AFT highlights a critical gap in how edtech companies handle sensitive student data when deploying AI tools in schools. Without enforceable federal legislation, children's personal data has been vulnerable to use in AI training, targeted advertising, and product development — often without meaningful consent. This deal demonstrates that institutional pressure and third-party audits can drive accountability where regulation has not yet reached. The fact that other major tech providers like Google have not made similar commitments underscores the systemic risk still present across the edtech ecosystem. Schools and districts must not assume that AI tools deployed in classrooms meet adequate privacy standards by default.",[105,106,107,108,109,110,111,112,113,114],"NIST Privacy Framework PR.DS-1 (Data-at-rest protection)","NIST SP 800-53 PT-1 (Privacy Policies and Procedures)","CIS Control 3: Data Protection","CIS Control 15: Service Provider Management","FERPA (Family Educational Rights and Privacy Act)","COPPA (Children's Online Privacy Protection Act)","GDPR Article 8 (Conditions applicable to child's consent)","GDPR Article 25 (Data Protection by Design and by Default)","NIST AI RMF (AI Risk Management Framework) – GOVERN 1.1","ITIL Service Level Management – Third-party supplier auditing",{}]