A teachers’ union in the United States has won in a contract what Indian schoolchildren do not yet have in law. Microsoft has agreed with the American Federation of Teachers (AFT) that it will not use student or educator data to train AI systems. The only exception is narrow: data that could help protect students. The agreement is legally binding and requires third-party audits.

Why it matters: India is teaching artificial intelligence from Class 3 this academic year under the CT-AI curriculum. Section 9 of the Digital Personal Data Protection Act, 2023 governs children’s data and would restrict tracking and behavioural monitoring. It has not commenced. Until it does, what an edtech vendor may do with an Indian schoolchild’s data turns on the contract between that vendor and a school or a state education department. None of those contracts is public.

What Microsoft has agreed

Microsoft set out the commitment in a blog post published on September 16. It describes an agreement signed with the AFT the previous week and a new Privacy and Safety Standard for Schools covering Microsoft Education products.

According to the company, the standard limits how those products can use student and educator data. It requires human oversight for consequential decisions, provides transparency for families and holds Microsoft accountable when it falls short. It also affirms that schools retain ownership of the knowledge and ideas they create.

The reported terms go further than the blog post does. Microsoft will not use student or educator data to train AI systems, other than in narrow safety and security scenarios. The data collected cannot be sold, used for advertising or used for product development. The agreement bars tracking students. The AFT is the second-largest teachers’ union in the United States. It says the agreement is legally binding and subject to third-party audits.

“We have forged a hard-fought, iron-clad privacy agreement with real teeth that protects students and families, because no one else, including the federal government, has stepped up to do the real work,” AFT president Randi Weingarten said.

That last clause is the interesting one. The agreement exists because American federal law does not require any of it. A union negotiated what a legislature did not deliver.

OpenAI and Anthropic have said they are discussing similar agreements with the AFT. Google, the largest supplier of education technology to American schools, has not said whether it will offer comparable protections.

What the same child gets in India

Nothing equivalent, and the gap is structural rather than accidental.

Section 9 of the DPDP Act requires verifiable parental consent before a data fiduciary processes a child’s personal data. It also restricts tracking, behavioural monitoring and targeted advertising directed at children. Rule 10 of the DPDP Rules, 2025, supplies the mechanics. Neither has commenced. Both sit in the 18-month tranche running from the Gazette notifications of November 13, 2025.

So, for this academic year and the next, three things do not apply to an edtech company processing a nine-year-old’s data in India. There is no statutory parental-consent requirement, no statutory bar on behavioural monitoring and no prohibition on using that data to train a model. What applies instead is the IT Act’s reasonable security practices, along with the terms of the procurement contract.

There is also no Indian counterpart to the AFT here. India’s teachers are organised, but MediaNama could not find any instance of a union negotiating data terms with a technology vendor on students’ behalf. No state education department has published such terms either.

The tools arrive before the law does

The sequencing is the problem, and it is not new on this beat.

The CT-AI curriculum runs from Class 3 in the 2026-27 academic year. MediaNama has been unable to establish whether implementation is mandatory or phased, or which tools are approved for classroom use. An RTI application to CBSE on both questions is pending.

Separately, adaptive learning software works by monitoring how a child answers and where they hesitate. That is behavioural monitoring in the ordinary sense of the words. Section 9 will bar it for children once it commences. What happens to a tool deployed now and still running then has not been addressed by anyone.

Nor has anyone said whether a single AI tool used in an Indian classroom has been vetted against Section 9 or vetted at all.

What a contract could do that a pending law cannot

The Microsoft agreement matters in India less as a model to import than as a demonstration of where leverage sits. The terms were won by the party that controls access to the classroom, in exchange for that access.

In India, that party is the state. Education is on the Concurrent List, and classroom software is bought by state departments and central bodies alike. The CT-AI rollout gives both a point of leverage they will not have again. A procurement condition barring the use of student data for model training needs no new legislation and no commencement notification. It needs a clause.

Whether any Indian procurement contract contains one is a question MediaNama has put to the Ministry of Education and CBSE.

Questions MediaNama has sent

To the Department of School Education and Literacy and to CBSE:

  • Whether any contract with an edtech or AI provider restricts the use of student data to train AI models.
  • Whether any AI tool deployed for CT-AI has been assessed against Section 9 of the DPDP Act, 2023.
  • Which tools are approved for classroom use under CT-AI, and whether implementation is mandatory or phased.
  • Whether any model contract or procurement guidance for AI in schools has been issued to states.

To MeitY:

  • Whether any guidance has been issued on processing children’s data in educational settings before Section 9 commences.

To Microsoft India:

  • Whether the Privacy and Safety Standard for Schools applies to Microsoft Education products sold or deployed in India.

This copy will be updated with the responses.

Also Read: