Homeschooling Families Run a School Network With No IT Department

A homeschool day often ends the way an office day does, with data entry. A parent logs attendance in one app, uploads a scanned writing sample to a second, and reviews a progress dashboard on a third. The laptop is shared. The router came from the internet provider years ago and has not been touched since.

Little of that data is trivial. Most US states require families who teach at home to keep formal records: attendance logs, immunization documents, portfolios of student work, annual assessments or evaluator letters. Resources such as Numa School's guide to homeschool record-keeping exist because these archives are frequently mandated by statute and sometimes reviewed by districts or evaluators. Far less attention goes to where the files actually live, who can reach them, and what happens if they are lost.

The honest answer, in most households, is a free email account, a consumer cloud drive, and whatever password habits the family already had. Functionally, the family is operating a very small school system. It just has no IT department.

The Security Work a District Does Invisibly

When a child attends an institutional school, a stack of security work happens out of sight. Districts run mobile device management on student laptops, so a lost Chromebook can be locked remotely. They filter web traffic, in part because the Children's Internet Protection Act ties federal E-Rate funding to content filtering. They vet software vendors, sign data privacy agreements, maintain backups, and keep some form of incident response plan.

None of this is theoretical caution. The K-12 Security Information Exchange, known as K12 SIX, logged 85 cyber incidents against US public school systems between late 2022 and late 2024, and it cautions that the true number may be 10 to 20 times higher because schools face few disclosure requirements. Attackers go after schools because student records are dense, accurate, and slow to change.

When schooling moves home, every one of those functions still needs an owner. The threat model shrinks, since one family is a smaller target than a district of 40,000 students. But it does not shrink to zero, and the defender is now a parent who also carries a full teaching load.

Consumer Edtech and the COPPA Baseline

The apps that fill a home education day are mostly consumer products: math practice sites, reading platforms, typing tutors, video services. For children under 13, the Children's Online Privacy Protection Act applies, and it has teeth. The FTC enforces it, and amendments that took effect in June 2025 tightened it further, requiring separate verifiable parental consent before a child's data is disclosed to third parties for targeted advertising, and expanding the definition of personal information to cover biometric identifiers.

In an institutional setting, schools often stand in for parents when authorizing classroom software. At home there is no intermediary. The parent is both the consent authority and the reviewer of record, which argues for reading an app's data practices before creating a child's account, not after.

A few questions do most of the work. Does the app need an account for the child at all, or can it run under the parent's? What does the privacy policy say about sharing with third parties? Is there a documented way to export and delete a child's data when the family moves on?

The Records Privacy Law That Stays Behind

One gap is genuinely counterintuitive. FERPA, the federal law governing education records, applies to educational agencies and institutions that receive federal education funding. An independent homeschool receives none, so FERPA generally does not follow a child out of an institutional school. The same transcript that carries federal privacy protections in a district office carries none of them in a kitchen drawer or a cloud folder.

This is less a loophole than a transfer of responsibility. No statute stands behind the home archive. Its confidentiality and integrity depend entirely on the family's own practices. FERPA re-enters the picture only at the edges, when a homeschooled student dual-enrolls at a community college or uses services from a local district, and then it covers only the records those institutions hold.

An Unmanaged Archive of a Child's Identity

Consider what a compliant homeschool archive actually contains. Full legal names and birth dates. Immunization or exemption paperwork. Evaluations that may reference learning disabilities. Home addresses on filed notices. Years of dated work samples in a child's handwriting. Aggregated, this is a rich identity file on a minor, the same data class that makes school districts attractive targets in the first place.

Retention deepens the exposure. States differ on what must be kept and for how long, which is why state-by-state summaries for homeschooling families, like the resources at numaschool.com, exist at all, and many families sensibly keep core records through graduation for college admissions and diploma verification. A decade-long archive accumulates risk the way it accumulates paper.

Email is the weakest common home for it. An inbox holding years of attachments is an unencrypted, searchable archive protected by a single password. It is usually also the recovery address for every other account the family owns.

District Practice at Household Scale

The fix is not enterprise tooling. It is enterprise habits, scaled down.

• Separate accounts. Give each child a standard, non-administrator profile on shared devices, and use the child account features built into the major platforms. This is the household version of role-based access.
• One strong anchor. The parent's primary email is the root of trust for everything else. Protect it with a password manager and multifactor authentication before worrying about anything downstream.
• Patch the perimeter. Update router firmware, retire default admin credentials, and keep school devices on the main network with visitors on a guest network. This is a fifteen-minute version of network management.
• Back up the archive. Keep the records archive in one organized location with a second copy elsewhere, ideally including one offline copy on an external drive. Districts survive ransomware on their backups; families recover from a failed laptop the same way.
• Vet before enrolling. Treat each new app the way a district treats a vendor: check the privacy policy, minimize what the child's account exposes, and delete accounts when a curriculum is retired.

None of this requires a security background. It requires noticing that the role exists. A school district pays people to manage devices, filter traffic, vet vendors, and protect records. A family teaching at home has quietly absorbed all four jobs, and once that is stated plainly, an afternoon of unglamorous setup covers most of the ground. The subject of the file, after all, is a child's earliest data trail.