Microsoft Signed a School AI Privacy Deal. Google Turned Gemini On

The school year started with two of the largest U.S. districts telling students not to use the chatbots for a year. Microsoft answered with a contract. Google had already flipped a switch.

Jocelyn Gecker’s AP piece, dated 15 September, is the source to keep. Microsoft agreed with the American Federation of Teachers, the country’s second-largest teachers union, and with New York’s UFT, on a National AI Safety and Privacy Standard. AFT is calling it a first. They say the protections are legally enforceable for students, families, and educators. Brad Smith, Microsoft’s vice chair and president, put the expansion in one sentence. The standard sets a high bar, and the company will extend the agreement to every school district it contracts with. That start date is 1 November.

Read that as procurement language, not as a bedtime story about children.

What the paper actually forbids

TechXplore’s version of the same AP reporting lists the operational bans, which are the only part that will matter when a district counsel reads it.

Student and educator data will not be used to train AI systems, except for a narrow exception around data that could help protect students. The data cannot be sold. It cannot be used for advertising. It cannot be used for product development. The agreement bars AI companions or features “designed to foster emotional attachment or dependency,” and it bars designs that keep students engaged longer than the learning task requires. There are audit and transparency clauses. Families are supposed to get a plain-language explanation of how the tools work.

I believe the training ban more than I believe the companion ban. Training is a pipeline you can write into a data processing addendum. “Emotional attachment” is a product manager’s adjective. Someone will still ship a friendly voice. The test is whether a district can point at the clause and make them turn it off.

Smith’s “every school district across the country” means Microsoft’s customers, not the country. If your district is Chromebooks and a pile of smaller apps, this PDF does not follow you home.

The districts that already said no

NYC and Los Angeles announced a one-year brake on student AI use as the year started. They want time to study how to put the tools in classrooms. That is not a philosophy. That is two procurement offices looking at a market that moved faster than their board calendar.

AP’s frame is the one parents actually live in. Millions of students already use chatbots for homework, for comfort, for advice they would not give a counselor. They do not know where the log goes. The Microsoft deal is a response to that, and to a broader fight about screens. It is also a response to unions that can still stall a rollout.

A year-long pause in the two biggest districts will leak. Kids have phones. The question is whether the official classroom copy is a Microsoft tool with a November contract, a Google tool that is already on, or a tab the teacher never assigned.

Google already moved

In August, Google turned Gemini on for many K-12 students who use Google Classroom. The company says Classroom reaches 150 million teachers and students worldwide. That number is theirs. Treat it as marketing with a usage dashboard behind it.

An online-safety nonprofit lead, Golin, asked the only follow-up that matters. Is Google going to embrace this framework? He also pointed at the long tail: schools run thousands of AI-tagged edtech products from vendors who will never sit with AFT.

I do not have Google’s answer in this AP package. Absence is the news. Microsoft got a union signature and a date. Google got a default.

Last week’s Anthropic note was about tempo in cyber operations. This is slower and closer to a child. Same class of problem, though. The model is in the room before the policy is.

What a district should do before November 1

If you already pay Microsoft, ask for the standard in the contract pack, not in a blog screenshot. Ask where student prompts are stored, who can export them, and whether the “protect students” training exception is logged. Ask how a parent actually receives the plain-language notice. If the answer is a link in a portal nobody opens, that is not notice.

If you are a Google district, ask whether Gemini in Classroom can be off for under-18 without breaking assignments. Ask whether prompts are training data. Do not accept “we take privacy seriously.” Accept a yes or no on the same four bans Microsoft just put on paper.

If you are neither, you are the long tail Golin mentioned. Inventory the AI features inside the homework apps you already licensed. Most of them will not have a union in the room. Some of them will have a companion tone because that is how they keep session time up. Session time is the thing the Microsoft text tries to kill.

Local models are a different conversation. We already walked through running an agent on your own box. A teacher laptop is not a district. A district still has to log, retain, and answer FOIA. Local does not mean unsupervised.

What this is not

It is not a federal law. It is not a ban on homework helpers. It is not Google. It is not the smaller companies. It does not stop a student from opening a consumer chatbot on a phone after last period.

Anthropic and Google have been losing safety people in public. Microsoft chose a union negotiation instead of another researcher letter. That is a different theory of how you get constraints to stick. Unions can sue on a contract. Researchers can quit.

Computerworld had a separate Microsoft story on 16 September: DeepSeek on Azure, tests for Copilot Cowork, open weights as a sales pitch. That is the adult product line. Keep it off the children’s contract. If the same company is arguing openness for enterprises and a training ban for schools, that is not hypocrisy by default. It is two SKUs. Watch whether the school SKU actually stays off the training corpus.

The date that matters

1 November is when Microsoft says the standard applies to contracted schools. Between now and then, the two largest districts are on a pause, Classroom still has Gemini for a lot of kids, and parents are being told a plain-language notice is coming.

I would like the notice to be a page a tired adult can read. I would like Google to answer Golin in a sentence. I would like the companion clause to be tested on the first product that looks like a friend.

Until then, treat the AFT deal as real for Microsoft shops and incomplete for everyone else. The students did not wait for November. The logs are already somewhere.

How to read “legally enforceable” without getting dizzy

AFT’s language is doing a lot of work. Legally enforceable sounds like a statute. Read it as a contract annex. A district that already buys Microsoft education software can point at the annex when a feature ships that looks like a companion. A district that does not buy Microsoft cannot. A parent in a Google Classroom school cannot. A kid with a consumer chatbot on a phone cannot.

That is not a reason to sneer at the union. It is a reason to stop treating a vendor PDF as a children’s privacy law. FERPA still sits where it sat. State attorney generals still sit where they sat. This deal fills a hole because the hole was real. It does not pave the hole.

November 1 is useful because it is a date. It is also a window. Between the AP story and that Monday, the same models are in the same tenants. If your data processing addendum already said “no training,” you should see whether the November text is stricter or just louder. If it never said that, November is when the sentence should appear. Ask for a redline. Do not accept a slide.

The exception will do the dirty work

“Will not use student or educator data to train AI systems, apart from a narrow exception for data that could help protect students.” The first clause is the headline. The second is the product.

Protect from what. Self-harm classifiers. Grooming detection. A kid trying to jailbreak a tutor into a boyfriend. Those can be real. They can also become a bucket labeled safety that happens to contain quality samples for the next model. The standard, as reported, does not publish that bucket. Families will not get a ticket that says “your child’s transcript was reviewed for a protective purpose.”

If you run a district, write the exception as a list. Which events. Which humans. How long the copy lives. Whether it leaves the education tenant. Whether a subprocessor sees it. “Narrow” is not a control. A named list is.

The advertising and product-development bans are cleaner until someone reclassifies a feature as safety telemetry. Product development is how a chatbot becomes a friend. The companion ban is trying to kill that path by name. Remember the name when a vendor demos a “learning coach” that remembers last week’s panic attack.

Teachers are in the clause for a reason

Educator data is listed next to student data. Teachers type lesson plans, IEP notes, discipline write-ups, and late-night complaints about a class. If that goes into a model that later drafts a letter to a parent, you have a records problem and a labor problem. The training ban on educator data is as important as the student one. It will be ignored the same way if nobody audits it.

Smaller tools will keep selling “AI tutors” with a COPPA checkbox and a privacy policy last updated when the company had twelve people. Microsoft’s national standard does not bind them. District procurement can. Ban companion tone. Ban retention past the assignment. Require a data processing agreement that names subprocessors. If the vendor cannot sign it, do not roster the app.

Local models on a lab PC are a different failure mode. The data never leaves the building, which sounds like privacy until a student pastes a classmate’s address into a chat with no access log. Local is not a policy. Local is a location. You still need the companion ban and a retention clock. You still need someone who can say the box was wiped. The Microsoft deal will not help you there. That is fine. Do not pretend it did.

What I want by November 1 that I probably will not get

I want Google to answer Golin in a sentence that is not a blog about “helping teachers.” I want NYC and LA to publish the questions their year of study is supposed to answer, not a vendor-written toolkit. I want the first Microsoft product that looks like a friend to get a union letter in the same week, not after a Times story.

I will settle for districts that can show a parent the four bans in the contract they actually signed. That is a lower bar. It is still higher than a press conference.

The AP story started from a gap: millions of students, homework and heartbreak, no map of the logs. Microsoft put a map on its own buildings, dated 1 November 2026. New York and Los Angeles closed the door for a year. Google opened Classroom in August and cited 150 million users. Those three facts do not agree with each other. They describe a market. The chatbots will keep arriving in childhood for as long as the rules are still a vendor’s annex.