Cybersecurity for Homeschool Families: The Risks That Are Different From School

When a school district signs a student up for an ed-tech platform, FERPA (the Family Educational Rights and Privacy Act) constrains how that school can share student data, and many states’ student privacy laws add additional protections. The school’s IT department filters internet traffic, monitors for malware, and maintains security across thousands of devices. When a homeschool parent signs their child up for the same ed-tech platform directly — as an individual consumer rather than through a school — the legal protections are different. FERPA doesn’t apply. The platform’s commercial terms govern. The IT department is the parent. This gap is not widely understood, and it creates specific cybersecurity and privacy responsibilities for homeschool families that their school-using peers don’t face.

Key Takeaways

• Homeschool families are “consumers” on ed-tech platforms, not “school users” — platforms have weaker legal obligations to consumer accounts than to school-contracted accounts under FERPA and many state student privacy laws.
• No institutional IT department means malware, phishing, and network threats that school systems catch automatically require active parent management at home.
• Homeschooled children typically spend more time online than school peers — the National Center for Education Statistics reports homeschooled students average 4+ hours of screen-based learning daily [1].
• Popular homeschool ed-tech platforms have widely varying privacy practices — some are exemplary, others have poor data practices documented by the Electronic Frontier Foundation.
• COPPA applies differently when parents sign up children directly vs. through a school — understanding this is essential for families using online learning tools.

The Institutional IT Gap: What You’re Replacing

When a child attends school, the school’s infrastructure provides:

• DNS filtering: Blocks known malware domains and adult content at the network level.
• Firewall monitoring: Detects unusual outbound traffic that might indicate malware.
• Device management (MDM): School-managed devices have security policies enforced by IT.
• Threat intelligence: School IT departments receive alerts about new phishing campaigns targeting education.
• Incident response: When something goes wrong, IT has procedures and tools.

Homeschool families need to replicate these protections at the household level. The good news: many of these are achievable without technical expertise. The bad news: they require intentional setup rather than inheriting institutional defaults.

Establishing Home Network Security for Homeschooling

DNS Filtering: Your Network-Level IT Department

A family-safe DNS resolver provides DNS filtering for every device on your home network without software installation on individual devices.

Recommended setup:

• Go to your router admin interface (typically 192.168.1.1 or 192.168.0.1).
• Find DNS Server settings under Internet/WAN settings.
• Set Primary DNS: 1.1.1.3 (Cloudflare for Families — blocks malware and adult content).
• Set Secondary DNS: 1.0.0.3.

This filters every device on the network — tablets, laptops, gaming consoles — without per-device configuration. Alternative: OpenDNS FamilyShield (208.67.222.123) provides similar protection with an optional free account for activity reports.

Malware Protection on Learning Devices

School-managed Chromebooks run Chrome OS with automatic updates and Google’s enterprise security. Family-owned Windows laptops doing homework require active management.

Minimum protection for a Windows homeschool device:

• Windows Defender (built-in) is good enough for most families when kept updated.
• Malwarebytes Free (scan on demand, monthly) adds a second detection layer.
• Automatic Windows Updates must be enabled — Settings → Update & Security → Windows Update → turn on automatic updates.
• Browser: Firefox or Brave with uBlock Origin installed, rather than older/less secure browsers.

For macOS:

• XProtect (Apple’s built-in malware detection) runs automatically.
• Gatekeeper blocks unapproved apps by default — don’t disable it.
• Enable FileVault (disk encryption): System Settings → Privacy & Security → FileVault → turn on.

For iPad/tablet:

• Keep iOS/iPadOS updated.
• Only install apps from the official App Store.
• Enable Guided Access for young children: Settings → Accessibility → Guided Access — this locks the device to a single app, preventing the child from leaving a learning app.

Browser Security for Homeschool Learning

Establish a dedicated browser profile for each child’s learning. In Firefox or Chrome:

• Click the profile icon → Add a new profile → name it after the child.
• Install uBlock Origin and Privacy Badger in that profile.
• Enable SafeSearch: for Google, go to google.com/safesearch and select “Filter.”
• Set the homepage to a specific curriculum hub rather than a general search engine.

COPPA and Ed-Tech: The Critical Difference for Homeschoolers

This is the most legally important section for homeschool families.

What COPPA Does

COPPA requires operators of online services directed to children under 13 (or that know they’re serving children under 13) to:

• Get verifiable parental consent before collecting personal information.
• Have a clear privacy policy.
• Give parents access to delete their child’s data.

The School Exception

COPPA has a “school exception” — schools can consent on behalf of parents for ed-tech services used for educational purposes within the school context. This is how Khan Academy, Quizlet, Newsela, and other ed-tech platforms can operate within schools without getting explicit parental consent for every student.

The homeschool gap: When a homeschool parent signs their child up for an ed-tech platform directly — not through a school contract — the school exception doesn’t apply. The platform must either:

1. Get verifiable parental consent (which most platforms don’t actively do for individual consumer sign-ups).
2. Require users to be 13+ (common — which means homeschool parents are technically violating terms by signing up children under 13 without a proper school-account relationship).

What this means in practice:

• When you sign your 10-year-old up for a consumer-facing education platform, you’re the consenting party. Read the privacy policy.
• The platform may collect your child’s data under its consumer privacy policy, which may be less restrictive than a school’s contract terms.
• Under COPPA, as the parent, you should be able to request deletion of your child’s data. How well platforms handle this varies.

Privacy Report Cards: Homeschool Ed-Tech Platforms

The Electronic Frontier Foundation’s “Privacy Not Included” project and Common Sense Media’s Privacy Ratings evaluate how educational platforms handle data. Here’s an assessment of platforms commonly used in homeschooling:

Platform	Common Sense Privacy Rating	Key Data Practices	COPPA Compliance
Khan Academy	Pass (high score)	Non-profit; minimal data collection; no ads	Yes — designed for school and family use
Duolingo	Pass	Collects usage data; some personalization	Yes for Duolingo for Schools; consumer version less clear for under-13
IXL Learning	Caution	Collects detailed learning data; shares with third parties	School version COPPA-compliant; consumer version varies
Prodigy Math	Caution	Freemium model; premium upsell to kids	Marketed to schools; parental control features
ABCmouse / Age of Learning	Pass	Subscription-based; minimal third-party data sharing	Yes — specifically designed for young children
Outschool	Pass	Video tutoring; data shared with teachers	Yes — designed for families
Varsity Tutors	Caution	Marketing communications; broader data collection	Review terms for under-13
Quizlet	Caution	User-generated content; ad-supported free tier	School version safer; consumer free tier has broader tracking
YouTube (learning)	Fail for under-13	Extensive data collection; algorithm-driven	YouTube Kids is COPPA-compliant; regular YouTube is not appropriate for under-13

Sources: Common Sense Media Privacy Ratings [2], EFF “Privacy Not Included” [3].

Recommendation: For children under 13, prefer platforms with explicit COPPA compliance, designed specifically for family or school use (Khan Academy, ABCmouse, Outschool). Avoid using consumer versions of adult-oriented platforms (regular YouTube, general Quizlet without a teacher account) for homeschool-age children.

How to Evaluate an Ed-Tech Platform Before Sign-Up

Before creating an account for your child on any new platform, spend 10 minutes on these checks:

Step 1: Find the Privacy Policy and look for:

• Whether it’s COPPA-compliant (should say explicitly).
• What data is collected (name, email, usage data, learning performance data, device info).
• Whether data is shared with third parties and who (ad networks are a red flag for children’s platforms).
• Data retention policy — how long is data kept after account deletion.

Step 2: Check Common Sense Media’s Privacy Ratings. Visit commonsensemedia.org/privacy → search the platform name. Common Sense Media evaluates platforms on a standardized rubric and provides letter grades.

Step 3: Look for a “School” or “Family” account type. Many platforms have a separate account type for school/family use with different data practices. If available, use this rather than the consumer account.

Step 4: Create an account with a dedicated email address. Consider creating a dedicated email address for ed-tech signups (e.g., yourname+edu@gmail.com). This makes it easy to track which platforms have your child’s data and to manage deletion requests later.

Time Online: The Homeschool Volume Difference

The National Center for Education Statistics reports that homeschooled students use screens for learning significantly more than schooled peers — more of their curriculum is delivered via screen-based platforms, video lectures, and online tools. This is not inherently a problem, but it does mean:

• More time online = more exposure to ad-supported platforms, recommendation algorithms, and potentially inappropriate content.
• The “natural breaks” of school transitions (classroom to cafeteria, recess, physical activities) that interrupt screen time aren’t built into the homeschool day automatically.

The American Academy of Pediatrics recommends that for school-age children, educational screen time be distinguished from recreational screen time — educational use is not subject to the same hour limits [4]. However, the AAP also recommends that parents of all school types review what platforms children are spending time on and whether those platforms are age-appropriate.

Practical structure for homeschool screen management:

• Designate “learning devices” vs. “entertainment devices” — or use time-based rules (learning apps in the morning, entertainment allowed after the curriculum day).
• Use the router’s content filtering (DNS settings above) consistently.
• Build in non-screen learning and physical activity as intentional breaks — these serve the same function as school transitions.

Unique Risks: Less Peer Monitoring and More Solo Online Time

School children’s online behavior is partially monitored by peer social dynamics — a classmate who sees something inappropriate is likely to react, adult staff are physically present. Homeschooled children may spend more time online without peer or adult co-presence.

This creates specific risks:

• Recruitment by predatory adults via online learning platforms: Tutoring platforms and online class forums provide routes for adults to contact children. Outschool and similar platforms vet their instructors, but general-purpose platforms (Discord, group chats for curriculum programs) may not.
• Unmoderated community platforms: Homeschool co-ops often organize via Facebook groups or Discord servers — these are not moderated spaces with child safety protocols.
• Independent problem-solving with less oversight: When a homeschool student encounters a confusing website or download prompt, there may be no teacher to ask — they may make independent decisions that introduce risk.

Recommendations:

• Review the specific platforms your child uses for tutoring or group learning.
• Know who is in the online communities your child participates in.
• Teach the “ask before downloading” rule explicitly — no software installation without parent approval.
• Create a standing invitation for your child to bring anything confusing or concerning online to you without fear of punishment.

Setting Up a Secure Homeschool Learning Environment: Summary Checklist

Network Level

• DNS filtering enabled on router (Cloudflare for Families 1.1.1.3 or OpenDNS FamilyShield).
• Guest network for learning devices, isolated from primary network.
• Router admin password changed from default.

Device Level

• OS and apps kept up to date (automatic updates enabled).
• Malwarebytes Free installed for periodic scans (Windows).
• FileVault/disk encryption enabled (Mac), or verify full-disk encryption enabled (iPad, Android).
• Browser set up with uBlock Origin; SafeSearch enabled.
• Guided Access or Screen Time restrictions configured for younger children.

Platform Level

• Ed-tech platforms evaluated for COPPA compliance before signup.
• Dedicated email address used for ed-tech accounts (tracks what’s been signed up for).
• Privacy policies reviewed for data sharing with third parties and ad networks.
• Account deletion process known for all platforms used.

Communication Level

• Kids know to “ask before downloading” — no exceptions.
• Open conversation about online safety established as a regular topic, not one-time talk.
• Kids know who to tell if they see something upsetting or confusing online.

What to Watch For Over 3 Months

Month 1: Audit your ed-tech platform footprint. List every online platform your child uses for learning. Check Common Sense Media’s privacy ratings for each. For any with poor ratings, evaluate whether there’s a better alternative (Khan Academy is often an excellent free substitute for commercial math and science platforms). Delete accounts for platforms you’re no longer using — this removes the data.

Month 2: Set up DNS filtering and browser security. Implement the Cloudflare for Families DNS setup on your router. Configure a dedicated browser profile for each child with uBlock Origin installed. Test the setup by navigating to an adult content site from a learning device — it should be blocked.

Month 3: Review the online communities your child participates in. List Discord servers, Facebook groups, forums, and online class communities your child is part of. For each: who moderates it? What are the membership criteria? Does your child interact with adults you haven’t vetted? Homeschool community platforms are often less monitored than they appear.

Frequently Asked Questions

Can I use a school’s Google Workspace or Microsoft 365 account for my homeschooled child? Homeschool charter schools and umbrella schools sometimes provide institutional accounts — these would carry the same COPPA protections as regular school accounts. Independent homeschoolers typically cannot access institutional accounts. Creating a consumer Google account for a child under 13 falls under Google’s Family Link terms, not school terms.

My child does online tutoring with independent tutors on platforms like Wyzant or TutorMe. What should I know? Online tutoring platforms vet tutors to varying degrees. Review the platform’s background check policy for tutors. Require that tutoring sessions happen in a shared family space or with the session recordable/observable — just as you would with an in-person tutor. Review session recordings periodically if the platform offers this.

Is it safer to buy packaged curriculum on physical materials rather than online platforms? Physical materials carry no digital privacy risk. However, supplementing with selective, privacy-respecting online platforms (Khan Academy, ABCmouse, Outschool) provides valuable interactive learning that physical materials can’t replicate. A hybrid approach — physical core curriculum + carefully evaluated online supplements — balances privacy and educational value.

How do I talk to my homeschooled child about online risks when they’re learning online most of the day? Frame it as a skill, not a warning — the same way you’d teach them to recognize a fire alarm or a stranger approaching. “You spend a lot of your learning time online, which means knowing how the internet works is part of your education.” Cover one concept per week rather than overwhelming them: this week, what a phishing email looks like. Next week, why we don’t download software without asking. Build the vocabulary over time rather than as a one-time safety lecture.

---

About the author

Ricky Flores is the founder of HiWave Makers and an electrical engineer with 15+ years of experience building consumer technology at Apple, Samsung, and Texas Instruments. He writes about how kids learn to build, think, and create in a tech-saturated world. Read more at hiwavemakers.com.

Sources

1. National Center for Education Statistics. (2023). “Homeschooling in the United States: Results From the 2019 National Household Education Surveys Program.” NCES. https://nces.ed.gov/pubs2020/2020001.pdf

2. Common Sense Media. (2024). “Privacy Ratings for Educational Apps.” Common Sense Media. https://www.commonsensemedia.org/privacy/ratings

3. Electronic Frontier Foundation. (2024). “Privacy Not Included — Education.” EFF. https://foundation.mozilla.org/en/privacynotincluded/

4. American Academy of Pediatrics. (2023). “Children and Media Tips from the American Academy of Pediatrics.” AAP. https://www.aap.org/en/patient-care/media-and-children/

5. Federal Trade Commission. (2023). “Complying with COPPA: Frequently Asked Questions.” FTC. https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions

6. Student Data Privacy Consortium. (2023). “FERPA Primer for Homeschool Families.” SDPC. https://studentdataprivacy.org/