What federal and state laws apply to classroom robots?

As of July 2026, Salamanca City Central School District in western New York was preparing for what was reported as the first real-world U.S. test of a full-sized humanoid robot teacher assistant in a K-12 classroom, with a system designed to use persistent profiles linked to student IDs.[1][2][3] That last detail matters more than the robot’s shape. Once the device can identify a child, hear the child, image the child, log the child’s classroom interactions, and adapt future responses to that child’s profile, the procurement question stops being only “Can the robot help instruction?” and becomes “Which student privacy, child privacy, disability, civil-rights, procurement, and state AI laws are now in play?”

The cleaner vendor pitch is usually about hardware: a classroom assistant, a contained platform, a device that follows guardrails. The harder legal work begins with the data map. A humanoid classroom robot is not simply a tablet on wheels if it collects voice recordings, facial images, behavioral interaction logs, and personally identifiable profiles tied to student IDs. Those four data categories are enough to pull the deployment into overlapping federal statutes, and they make a single privacy policy a poor substitute for a verified account of data flows, subprocessors, retention rules, access controls, and classroom use cases.[4]

The robot is a fact pattern, not a legal category

There is no general federal “classroom robot law” that answers the question by itself. The law attaches to what the system does: whether it maintains education records, collects personal information from children, asks sensitive questions, supports or interferes with disability services, changes access to instruction, or treats protected groups differently. That is why the Salamanca deployment is useful as a live fact pattern but not yet as evidence of harm. As of July 20, 2026, the robot had not yet generated an operational classroom record of incidents, complaints, or enforcement findings.

For district counsel, the first pass is less glamorous than the demo. The questions are ordinary and exacting: Is the robot creating or receiving education records on the district’s behalf? Are voice or image files stored, transcribed, or analyzed in the cloud? Does the system use third-party SDKs? Can the vendor link interaction logs back to a named student or student ID? Are profiles deleted at the end of a pilot, or do they follow the student? Does the robot’s adaptive behavior affect accommodations, discipline, assessment, participation, or access to a program?

Eight federal statutes can be triggered by ordinary classroom use

The federal analysis should start with function, not branding. A humanoid robot that answers student questions without storing identifiable information presents a different profile from one that builds a persistent student record, detects faces, analyzes speech, and generates individualized recommendations. The Public Interest Privacy Center identifies federal education privacy and civil-rights laws that can apply to AI systems in schools, including FERPA, COPPA, PPRA, IDEA, Title VI, Title IX, the ADA, and Section 504.[4]

FERPA: student-linked profiles and robot logs

FERPA is the most immediate federal statute when a robot creates, receives, or maintains records that are directly related to a student and maintained by the school or by a party acting for the school. A persistent profile tied to a student ID is not just a convenience feature. If the profile stores interaction history, instructional responses, behavior observations, attendance-like signals, or progress indicators, the district should assume it may be handling education-record material unless counsel has a defensible reason to classify it otherwise.[4]

That changes the procurement file. The district needs more than a purchase order for the chassis. It needs a written account of who maintains the records, which vendor personnel can access them, whether the vendor may use them to improve products, how parent and eligible-student access requests will be handled, what happens when records are corrected or deleted, and whether any redisclosure occurs through cloud hosting, analytics, support tools, or model services.

COPPA: children under 13 and vendor-side collection

COPPA becomes central when the operator of an online service collects personal information from children under 13, including through voice, image, persistent identifiers, or other data streams. In a school setting, districts may be involved in consenting to limited educational uses, but that does not eliminate the need to know what the vendor and its service providers actually collect, retain, and use.[4]

The FTC’s COPPA Rule update, announced in June 2025, raised the civil penalty amount to $53,088 per violation per day.[5] The size of the penalty is not the main lesson for a classroom robot deal. The more practical lesson is that a district cannot verify COPPA posture by reading only the top-level privacy policy if the robot relies on embedded software, cloud processing, mobile apps, analytics tools, or third-party SDKs.

PPRA: sensitive questions do not become harmless because a robot asks them

PPRA is narrower, but it should not be skipped. If a humanoid robot is used to administer surveys, prompts, social-emotional check-ins, mental-health screeners, or other interactions that solicit protected categories of sensitive information, the legal analysis changes. A conversational interface can make a sensitive inquiry feel informal to a student while still functioning as a school-administered information collection.[4]

This is one reason classroom scripts and product configuration belong in the legal review. A district may approve a robot for logistics or tutoring and later discover that a plugin, lesson pack, or “wellness” mode asks questions that were never evaluated under PPRA or local parent-notice procedures.

IDEA, ADA, and Section 504: assistance can become a service-delivery issue

Humanoid classroom robots are often framed as assistive or supportive technology. That is not a problem; it may be the best educational justification for a pilot. But once the robot is used with students with disabilities, the district has to ask whether the system is part of an IEP service, an accommodation, an auxiliary aid, an accessibility feature, or a general classroom tool that still affects equal access.[4]

IDEA questions arise if the robot is used to deliver, supplement, document, or affect special education or related services. ADA and Section 504 questions arise if students with disabilities cannot use the robot, are tracked differently by it, are excluded from robot-assisted activities, or receive inferior access because the interface cannot accommodate speech, hearing, mobility, vision, cognitive, or behavioral needs. The legally relevant fact is not that the robot is advanced. It is whether the district’s program remains accessible and whether required services are actually delivered.

Title VI and Title IX: disparate treatment, access, and biased outputs

Title VI and Title IX do not apply because a device is humanoid. They apply when a federally funded education program discriminates on protected grounds. The classroom robot issues are therefore practical: whether the system works differently across race, color, national origin, sex, disability-adjacent traits, language background, voice characteristics, or appearance; whether certain students are more likely to be misrecognized, flagged, excluded, or denied a benefit; and whether the district has a process to detect and correct those patterns before they become program-access problems.[4]

No public record in the supplied materials identifies a Title VI or Title IX complaint arising from the Salamanca deployment. The point is not to imply one. The point is that civil-rights review cannot be bolted on after a pilot if the robot will mediate participation, recognition, behavioral feedback, or access to instructional support.

State AI-in-education laws make the answer jurisdiction-specific

The federal statutes supply the baseline, but they do not finish the analysis. In 2026, state AI-in-education legislation moved quickly enough that a district’s obligations may differ materially depending on where the robot is deployed. MultiState tracked 134 state AI bills across 31 states in 2026, and FutureEd separately maintained a 2026 tracker for state AI-in-education bills.[6][7]

That number should not be read as 134 enacted classroom-robot laws. Many bills in a tracker may be pending, amended, stalled, or limited to studies, task forces, procurement standards, disclosure rules, student-data restrictions, or teacher-use policies. For procurement review, status matters: enacted law can create immediate obligations; a bill in committee may signal policy direction but does not impose the same duty.

The highlighted 2026 frameworks include Idaho SB 1227, Oklahoma SB 1734, Maryland SB 720, and South Carolina HB 5253. The guardrails identified in the supplied tracking materials include human-in-the-loop requirements, limits on AI replacing teachers, parental opt-out rights, data-minimization rules, and, in some states, private rights of action for parents.[6][7] Those are not interchangeable provisions. A human-review mandate affects classroom workflow; a teacher-replacement limit affects instructional design and staffing representations; an opt-out right affects rostering and alternatives; data minimization affects product architecture; a private right of action changes litigation exposure.

Why a state bill can change the robot’s classroom design

A human-in-the-loop rule is not satisfied by saying a teacher is somewhere in the room. The district has to define what the human reviews, when review occurs, whether the robot can take an action before review, and which employee is accountable for override. If the robot recommends grouping, modifies a lesson path, flags disengagement, records behavior, or adapts special-education support, “human in the loop” becomes an operational control, not a slogan.

A ban or limit on AI replacing teachers also needs translation into contract language. Vendors may describe the robot as an assistant, aide, tutor, coach, or classroom companion. A district still has to ask whether the system is being represented to parents, staff, or the board as performing instructional duties that state law reserves to certified educators or requires educators to supervise.

Parental opt-out rights create a different kind of design problem. If a parent opts out of AI interaction, the school needs a non-punitive alternative. That alternative cannot be improvised after the first objection if the robot is embedded in attendance routines, small-group instruction, accessibility support, or classroom management.

Data minimization is likewise concrete. It asks whether the robot needs to store full audio, whether transcription can occur without retaining recordings, whether facial images are necessary, whether logs can be de-identified, whether student-linked profiles can expire, and whether product-improvement uses can be separated from school-authorized educational use.

The vendor’s “closed system” claim has to survive the data-flow review

The FTC’s September 2025 Apitor enforcement action is a useful warning for classroom robotics procurement because it involved alleged third-party SDK geolocation collection and a $500,000 suspended penalty.[8] The point is not that every classroom robot has the same architecture or the same violation. The point is that vendor-facing statements about what a product collects can be incomplete if no one has verified embedded third-party code, analytics tools, cloud services, crash logs, support channels, and downstream data access.

A “closed system” can mean many things. It may mean the robot does not browse the open web. It may mean the vendor does not train a public model on student data. It may mean the district can restrict content sources. None of those meanings proves that voice files, image data, logs, device identifiers, or diagnostic data never leave the classroom. In a student-data context, the representation has to be pinned to architecture: what is captured, where it is processed, who receives it, how long it is retained, and whether any third party can use it for its own purposes.

That is also where corporate history and subcontractor diligence belong. If a vendor has adjacent businesses, affiliated entities, pending separations, or disputed operational overlap with other product lines, the procurement question is not whether the company biography is flattering. It is which legal entity signs the contract, which entity controls student data, which affiliates or subprocessors can access the system, and whether representations about separation are reflected in enforceable terms. The supplied materials note that Realbotix disputes the degree of operational overlap with RealDoll/Simulcra and states that a separation transaction is pending; that context matters only to the extent it affects diligence over entity structure, data access, and contractual accountability.[2][3]

Product liability and breach history add a second risk layer

Privacy and civil-rights laws are not the only bodies of law around classroom humanoid robots. They are simply the first ones a school district is likely to confront. Product liability, cybersecurity, negligence, consumer-protection, and procurement-law theories become more important if the robot physically interacts with students, gives unsafe instructions, exposes recordings, or fails in a way that the district or vendor should reasonably have anticipated.

The CloudPets breach remains a blunt reminder that children’s connected devices can turn intimate recordings into breach material. The incident involved 2.2 million voice recordings and 820,000 accounts.[9] A classroom robot would raise a different institutional fact pattern because the school, not only a parent purchaser, may have selected and deployed the system. That difference makes record classification, breach notice, contractual indemnity, and incident-response responsibilities more important, not less.

Fairplay’s November 2025 advisory, backed by more than 150 experts, treated AI and children as a policy-risk area requiring stronger safeguards.[10] That type of advisory is not binding law, and it should not be cited as though it creates a district obligation by itself. It is relevant because agencies, legislators, boards, and parent groups often use such materials to frame what counts as reasonable care when a technology collects data from children.

The KU Leuven CiTiP analysis of a “link-in-the-chain” liability model is also best treated as scholarship, not U.S. law.[11] Its value is conceptual: humanoid classroom systems can distribute responsibility across hardware manufacturers, AI model providers, app developers, cloud hosts, school districts, integrators, and staff users. That distribution is exactly why a hardware-only contract is thin protection. The failure point may sit in a model update, a sensor, a classroom configuration, a third-party SDK, a retention setting, or a staff workflow.

What the law asks before the robot enters the room

The legal issue is not whether schools should be curious about humanoid robots. They should be allowed to test tools that may help students and teachers, including students who need communication support, individualized practice, or assistive interfaces. The mistake is treating physical novelty as the main risk and data governance as paperwork to be cleaned up later.

For districts asking what legal issues a classroom humanoid robot raises, the answer is deliberately unsatisfying if one expects a single statute. A classroom humanoid robot can implicate FERPA when it maintains student-linked records, COPPA when it collects personal information from children under 13, PPRA when it solicits sensitive information, IDEA when it affects special education services, ADA and Section 504 when accessibility and accommodations are at stake, and Title VI or Title IX when protected-class access or treatment is affected. State AI-in-education laws then add jurisdiction-specific rules on human oversight, teacher replacement, parental choice, data minimization, and remedies.

That is the practical conclusion for districts and vendors before deployment: classroom humanoid robots are governed less by one new “robot law” than by overlapping student privacy, child privacy, civil-rights, disability, procurement, cybersecurity, and state AI rules. The inventory has to happen before the pilot becomes a practice, because the hardest problems begin when the robot’s profile of a child is already live.

References

1. New York Focus coverage of the Salamanca humanoid robot deployment, New York Focus, July 14, 2026.
2. Governing coverage of the Salamanca humanoid robot deployment, Governing.
3. Mashable coverage of the Salamanca humanoid robot deployment, Mashable.
4. AI Laws, Public Interest Privacy Center.
5. FTC announces final changes to children’s privacy rule, Federal Trade Commission, June 2025.
6. 2026 State AI Legislation, MultiState, April 9, 2026.
7. Legislative Tracker: 2026 State AI in Education Bills, FutureEd.
8. FTC takes action against Apitor for allowing third-party SDK to collect children’s geolocation data, Federal Trade Commission, September 2025.
9. CloudPets data breach coverage, Humanoid Liability.
10. Fairplay advisory on AI and children, Fairplay, November 2025.
11. KU Leuven CiTiP legal analysis on link-in-the-chain liability, KU Leuven Centre for IT & IP Law.