Data Privacy for Music Studios: A Practical Guide for Teachers
If you teach privately, you hold more personal information than you probably realize: children’s names, parents’ phone numbers, home addresses, lesson recordings, payment details and notes about how a kid is doing. Protecting it comes down to four things: collect less, keep it in as few places as possible, tell families plainly what you do with it, and delete it when a student leaves. This guide shows how to do each, and which U.S. rules may apply to you.
TL;DR
- Most studios collect names, contact details, photos, video and audio of minors, billing records and progress notes. That is enough to take seriously.
- COPPA can apply if your website, app or form is aimed at children under 13. FERPA mostly covers schools, so an independent studio is not automatically covered.
- Use separate accounts for business, limit who can see what, encrypt and back up, and write down a deletion routine.
- “Free” templates and tools still need a look at their terms before you put a student’s name into them.
- Tell families in plain language what you collect, why, who sees it and when it is deleted.
Table of Contents
- What a private studio actually collects
- Which U.S. rules may apply
- Secure habits that fit a one-person studio
- Collect less: a 30-minute studio audit
- Free templates and tools: use them, but read the terms
- What to tell families
- Perspective: privacy is a workflow, not a document
- Keeping the admin in one place
- FAQ
- Sources
What a private studio actually collects
Start with an inventory. Most teachers are surprised by the length of the list. A typical studio holds:
- Student and parent names, email addresses and phone numbers
- Home addresses for billing or for in-home lessons
- Birthdates and school grades from intake forms
- Photos, and video or audio recordings from lessons and recitals
- Lesson notes, including comments on behavior, attention or learning differences
- Invoices, payment history and payment links
- Messages with parents
For children, the FTC’s definition of personal information under COPPA is a useful checklist. It includes a child’s name, physical address, online contact information, telephone number, a persistent identifier, a photo, video or audio file with the child’s image or voice, and certain geolocation data. It also covers information collected from a child online and combined with an identifier, according to the FTC’s COPPA FAQ. A phone video of a ten-year-old playing a recital piece counts as one of those categories.
The point is not that every studio is regulated like a tech company. The point is that this information identifies minors and their households, and a lost laptop or a misdirected group email can do real harm.
Which U.S. rules may apply
There is no single U.S. privacy law for music studios. Two federal rules come up most often, and they work differently.
COPPA: online services aimed at kids under 13
The Children’s Online Privacy Protection Rule may apply when a website, app, form or other online service is directed to children under 13. It can also apply when a general-audience service has actual knowledge that it collects information from children under 13, per the FTC’s FAQ.
If it applies, the operator must post a clear online privacy policy and give parents direct notice. It must obtain verifiable parental consent, with limited exceptions, and offer parents access and deletion. It must also keep the information secure, limit retention, and avoid collecting more than is reasonably necessary. The Federal Register publication of the COPPA Rule from April 22, 2025 restates these duties, including retention and deletion protocols.
Whether your studio is a covered operator depends on how you operate. A teacher who runs a student portal or collects data from kids through an online sign-up is in a different position from one who only emails parents. If you are unsure, ask a lawyer who handles privacy or small business matters.
FERPA: mostly a school rule
FERPA protects education records that are directly related to a student and maintained by a school or by a party acting for the school. It generally applies to schools that receive Department of Education funding, as the Department’s parent guide explains. A private studio operating independently is not automatically covered.
It matters in one situation: if you teach through a school, for example an after-school program or a contracted lesson arrangement. Then student information that came from school records is generally subject to written consent before it goes to a community organization outside an exception, according to the Department’s 2021 guidance on partnership organizations. Ask the school what its rules are before you take a roster or copy it into your own tools. The Department also says applicability must be assessed case by case, as its guidance on online educational services notes.
State laws may add more, and they vary. Check your own state’s rules, particularly if you teach students in more than one state.
Secure habits that fit a one-person studio
You do not need an IT department. Federal small-business guidance keeps returning to the same basics, and they suit a home studio well.
Separate business from personal. NIST’s small business security fundamentals recommend separate computers, mobile devices and accounts for business and personal use. If the family laptop doubles as your studio computer, your child’s friends and your students’ parents share a login. Create a dedicated studio email address and a separate user account on the computer.
Limit access. Only you, and any assistant who truly needs it, should see student records. Use strong, unique passwords and a password manager, and turn on two-step verification for email and your studio software. NIST’s Privacy Framework guide lists access control, security software and regular updates among its basics.
Encrypt and back up. The same guide recommends encrypting sensitive data at rest and in transit, and backing up data. In practice: turn on full-disk encryption on your laptop and phone, and keep a backup that is itself protected.
Dispose of old devices properly. NIST says to safely dispose of old computers and media. Before you sell or recycle a laptop, wipe it. Don’t just drag files to the trash.
Know what privacy adds beyond security. NIST’s guide makes a point worth remembering: securing information is necessary, but it does not cover every privacy risk. You also need to decide what you collect, why, who receives it and when it is deleted. A perfectly encrypted spreadsheet of birthdates you never needed is still more than you should hold.
Write it down
For covered operators, the COPPA security rule, 16 C.F.R. §312.8, calls for a written security program, annual risk assessments and safeguards, with testing, monitoring and an annual evaluation. Even if you are not covered, a one-page version is smart. NIST’s Small Enterprise quick start guide suggests identifying your systems and information, choosing safeguards, documenting them and checking that they work. The guide is built for small, under-resourced organizations, which describes most studios.
Collect less: a 30-minute studio audit
Set a timer and work through this once, then repeat once a year.
- List where student data lives. Email, phone contacts, a spreadsheet, a paper binder, a scheduling tool, a cloud drive, text threads. Every one is a place to protect.
- Cross out what you don’t need. If you never use birthdates, school names or home addresses, stop asking for them. The FTC’s COPPA guidance also warns against collecting more than is reasonably necessary.
- Avoid sensitive notes. A privacy toolkit for educators from Student Privacy Matters advises sharing only the least personal information a vendor needs and avoiding unnecessary disability or accommodation details. Write the practice plan, not a diagnosis.
- Move conversations into one channel. Scattered texts, DMs and emails are the hardest to secure and to delete.
- Set a deletion date. Decide how long you keep records after a student leaves, and put a reminder in your calendar. The toolkit above suggests closing accounts and requesting deletion at the end of the school year. Keep what you must for tax or business reasons, and delete the rest.
- Handle recordings deliberately. Get a parent’s permission before you record or share a lesson video, say where it will be stored, and delete it when its purpose ends.
Our post on communication boundaries with parents covers the related habit of setting when and how you reply, which also reduces the number of places student details end up.
Free templates and tools: use them, but read the terms
Many teachers start with free printable assignment sheets, practice logs, studio-policy templates and parent-message forms, and they are a good start. A printable practice chart on paper holds no cloud data at all. The privacy question starts when a template becomes an online account, form or app where you enter names and contact details.
The Department of Education’s online services guidance is clear that free services should go through the same or a similar approval process as paid ones, and not be adopted informally by clicking through terms. It also recommends written agreements that cover collection, permitted uses, retention, disclosure, destruction, security responsibilities, access and breach response. You are not a school district, but the checklist works for a studio. Before you load students into any tool, find answers to these:
- What does it collect, and does it use student data for anything besides serving you?
- Can you delete a student’s data, and your whole account, when you choose?
- Who else gets the data, such as advertisers or other vendors?
- What happens in a breach, and will you be told?
When a template is a policy document, edit it to match what you actually do. Free studio-policy templates typically cover payment schedules, late payments, missed and canceled lessons and safety. Few say anything about data. Add a short data paragraph of your own, and don’t lean on a generic privacy policy copied from another business. A policy that promises practices you don’t follow is worse than none.
Templates we publish for studio policies, onboarding and progress tracking are free to copy. Start with the new student questionnaire and the student progress checklist. Both are designed so that you can ask for only what you will use. Our onboarding templates include copy-paste wording for families.
What to tell families
Parents don’t want a legal essay. They want to know who sees their child’s information. A short notice, handed over at enrollment and posted on your studio page, builds trust.
If COPPA applies to you, the FTC’s six-step compliance plan says the notice must describe what is collected, how it is used and disclosed, how long it is kept, how it is deleted, and how parents can review or delete it and refuse further collection. Direct notice to parents must come before collection, and covers the purposes, the disclosures, a link to the privacy policy and how consent is given. Even if you are not covered, those are the right headings. A workable studio version has six parts:
- What we collect. Names, contact details, lesson notes, payment records, and any photos or recordings.
- Why. To schedule lessons, plan practice, send updates and bill.
- Who sees it. You, and the named tools you use. Say plainly that you don’t sell it.
- How long we keep it. For example, until a set period after the student leaves.
- Your choices. Parents can ask to see, correct or delete their child’s information, and can decline photos or recordings.
- Who to contact. Your studio email address.
The plan also says covered businesses should use written assurances for service providers that handle children’s information. That means checking the vendor’s terms before you hand over a roster. Then tell families which tools you use.
Perspective: privacy is a workflow, not a document
We build for independent teachers, and what we see is that privacy problems rarely start with hackers. They start with scatter. A progress note in a text thread, a recital video in a personal photo library, an invoice in one app and a roster in another. Each is a place a child’s information sits with no one deciding when it leaves.
Our view is that the best protection for a small studio is fewer places and a clear rhythm. Keep lesson notes, assignments, family updates and tuition in one workspace, share with parents only what helps them support practice, and keep sensitive commentary out of the written record. That is why our parent-ready summaries, which we call Encores, focus on what happened and what to practice next. They are not a running diary about a child.
No software makes a studio compliant on its own, ours included. You still choose what you collect and how long you keep it, and you should ask any vendor, us too, what it does with student data and how you can delete it. Do that, and the paperwork gets much easier.
— Dave
Keeping the admin in one place
Allegro is a workspace for independent music teachers that keeps students, lessons, digital lesson notes, practice assignments, Encores, tuition tracking and family communication together, so there are fewer scattered threads to protect. Parents and students use it free. Teachers start with a 30-day trial, and the Studio plan is $39 per month. See the Solo and Studio plans and test the workflow with a few students before you decide.
If you handle payments, our guide to secure payment links in invoices shows how to keep billing details out of casual messages.
FAQ
Does an independent music teacher have to follow COPPA?
It depends on how you operate. COPPA may apply when your website, app or form is directed to children under 13, or when a general-audience service you run actually knows it collects information from children under 13, according to the FTC. If you only communicate with parents, your exposure is different, so ask a privacy or small business attorney about your setup.
Is my studio covered by FERPA?
Not automatically. FERPA generally applies to schools that receive Department of Education funds and to parties acting for them. A private studio operating independently is usually outside it. If you teach through a school program and receive its student records, follow the school’s consent and data rules.
Can I post student recital videos or photos?
Get written permission from a parent first, and say where the video will be posted and who can see it. A child’s image or voice in a photo, video or audio file is personal information under COPPA’s definition. Offer a no-photo option, and delete files when their purpose ends.
How long should I keep student records?
There is no single rule for every studio. Keep what your tax and business needs require, delete the rest soon after a student leaves, and tell families your timeline in your notice. Put the annual cleanup in your calendar so it happens.
Are free templates and apps safe for student information?
A paper template holds no online data. For any app, form or cloud tool, read the terms and check what it collects, who it shares with and whether you can delete data. The Department of Education advises treating free services with the same care as paid ones.
Sources
- FTC: Complying with COPPA, Frequently Asked Questions
- Federal Register: Children’s Online Privacy Protection Rule, April 22, 2025
- U.S. Department of Education: A Parent Guide to FERPA
- U.S. Department of Education: FERPA and Volunteer and Partnership Organizations
- U.S. Department of Education: Protecting Student Privacy While Using Online Educational Services
- NIST: Small Business Information Security, the Fundamentals
- NIST: Getting Started with the NIST Privacy Framework
- NIST: RMF Small Enterprise Quick Start Guide
- FTC: COPPA Six-Step Compliance Plan
- 16 C.F.R. §312.8, Confidentiality, security, and integrity
- Student Privacy Matters: Educator Toolkit