No, not the consumer version by default. A student's name plus school context is personally identifiable information from an education record, and FERPA protects it. The consumer ChatGPT app may use your inputs to improve its models unless you turn that off, so typing a real student's name into it can put an education record into a tool your district never vetted. The fix is simple: draft with a placeholder, personalize in your district drive. In a 2024 community survey of 16 parents, school SLPs, OTs, and special educators, 94% reported spending 30 or more minutes on a single social story, so AI drafting is worth keeping, just not with real student data in it.
What does FERPA actually protect?
FERPA (the Family Educational Rights and Privacy Act) protects personally identifiable information from a student's education record. That includes the student's name, the names of family members, and any detail that would let someone identify the student. Schools and their staff fall under FERPA, so the rule that matters for a school SLP is the education-record rule, not a medical-privacy one. When you combine a real name with a scenario you are addressing in therapy, you have created exactly the kind of record FERPA covers. The U.S. Department of Education's Student Privacy Policy Office is the authority schools point to.
Does ChatGPT keep or train on what I type?
It depends on the product tier. By default, the consumer ChatGPT app may use your conversations to improve OpenAI's models unless you turn that off in data controls. OpenAI's enterprise, team, and API products state they do not use business inputs to train models by default, which is why districts that adopt AI sign a specific agreement and license a managed tier rather than letting staff use personal accounts. Policies change, so the safe assumption for your personal account is that what you type could be retained.
| What you put in | Consumer ChatGPT (default) | FERPA risk |
|---|---|---|
| Real student first and last name | May be retained or used to improve models | High, avoid |
| Real name plus diagnosis or scenario | May be retained or used to improve models | High, avoid |
| Placeholder like [STUDENT] and a generic scenario | No education record present | Low, safe |
| Real photo of the student | May be retained | High, needs consent |
What is the safe-by-default workflow for social stories?
You do not have to give up AI drafting to stay compliant. Keep the speed and remove the identifier.
- Draft with a placeholder. Prompt ChatGPT for a story about "[STUDENT], a kindergartner who gets anxious during fire drills." No real name, no other identifiers.
- Generalize the scenario. Describe the situation, not details that pin it to one child (no street name, no sibling names, no medical specifics).
- Personalize in your district drive. Paste the draft into your district-managed Google Slides or Word, then swap [STUDENT] for the real name there.
- Store the file as a record. Keep the finished story in the district system, the same as any other IEP-adjacent document.
- Use generic or consented photos. Treat a real student photo as part of the record. Use stock photos until you have written consent for the specific use.
The money quote from the same 2024 survey: "I wish I had a template I could easily customize to change the pictures of the child or parents quickly but keep the same story." A placeholder workflow is exactly that template: write the scaffold once, swap the identifying details safely on your own systems, and reuse it across your caseload.
What if my district licensed an AI tool?
A district-licensed tool with a signed data privacy agreement is a different risk profile than your personal ChatGPT account. Tools marketed to schools, such as MagicSchool, describe themselves as FERPA-aware and sign agreements that cover student data. If your district has that agreement, follow it. If you are using a personal account, assume it is not covered and use the placeholder habit. When you are unsure which bucket a tool falls into, ask your district's data privacy officer in writing and keep the answer.
Does keeping data out of the tool hurt the social story?
No. The identifying name is not what makes a social story work. A 2023 study using the SOFA digital social stories app, the largest social stories effectiveness dataset to date (N = 856), found outcomes were strongest for younger, more verbal children and depended on the story being specific and individualized, not on which platform held the name. You can personalize after drafting and lose nothing.
Frequently Asked Questions
Is a student's name protected under FERPA?
A student's name combined with school context is personally identifiable information from an education record, which FERPA protects. A first name alone with no other identifiers is lower risk, but the safest habit is to keep all direct identifiers out of any consumer AI tool unless your district has a signed agreement covering it.
Does ChatGPT train on what I type?
By default the consumer ChatGPT app may use your conversations to improve models unless you turn that off in data controls or use a no-training tier. Enterprise, Team, and API products do not use your inputs to train by default. Policies change, so confirm the current setting for the exact product your district licensed.
Can I use ChatGPT for social stories at all then?
Yes, for the text. Draft the story with a placeholder like [STUDENT] and a generic scenario, then paste the draft into your district drive and swap in the real name there. You get the speed of AI drafting without putting an education record into a consumer tool.
What about my district's MagicSchool or enterprise AI license?
A district-licensed tool with a data privacy agreement is a different risk profile than your personal ChatGPT account. If your district signed an agreement that covers student data, follow that agreement. The placeholder habit is still good practice for any tool you are unsure about.
Is a student photo also FERPA-protected?
Yes. A photo that identifies a student is treated as part of the education record. Do not upload a real student photo into a consumer AI tool without written consent for that specific use. Use generic or stock photos until consent is in place.
Who decides what is allowed at my school?
Your district's data privacy officer or technology director sets the policy, and it overrides general advice. When in doubt, ask them in writing which tools are approved for student data and keep that answer on file.
One approach for school SLPs short on time is to keep a 5-tool stack: a methodology checklist, a slide template you reuse, a folder of stock photos sorted by scenario, an AI text drafter used with placeholders (ChatGPT, Claude, MagicSchool, or Emoquest for one-sentence-in story output), and a delivery format your district already uses (Google Slides or PDF). The draft can be fast and AI-assisted. The student's name belongs on your district's systems, not in a consumer chatbot.