A school district plans classroom agents that process student work samples. Which privacy control best fits that use?

Requiring parental notices when classroom agents process student work samples is the privacy control that fits education AI: student content is sensitive educational data, and parents or eligible students need visibility into what is collected, why it is processed, who can access it, and how long it is kept. The correct control works because notice is a precondition for meaningful consent or opt-out where law or district policy requires it, and it creates an auditable trail that the district disclosed the AI use rather than burying it in routine classroom practice. Processing samples silently so parents are not burdened with notices fails conceptually by treating notice as optional friction instead of a privacy duty; burden reduction is not a lawful basis to hide processing of minors' work. Storing unlimited student work in the agent without retention limits fails because retention minimization and purpose limitation are related controls—notice alone does not cure indefinite storage of educational records in an AI system. Sharing work samples with vendors for marketing the AI product fails as secondary-use and commercialization abuse that exceeds instructional purpose and typically violates education privacy expectations and contracts. Exam caveat: notice requirements vary by jurisdiction and age; some settings also need verifiable parental consent, not notice alone, especially for novel AI processing beyond traditional gradebooks. Operational check: publish a plain-language parental notice describing the classroom agent, data categories, retention, and vendor roles; obtain required consents; configure retention limits; and prohibit marketing reuse in the data-processing agreement before any student samples are ingested.