Student Privacy and FAA Remote Pilot Certification

Practical Guidance for Protecting Student PII in High School Drone Programs

Prepared for school districts, Career and Technical Education leaders, administrators, privacy officers, drone instructors, students, and families

Prepared by Blue Ridge Mountain Drones Education and DronePilotsForUS

September 2026

---

For DronePilotsForUS, schools can help students pursue FAA Remote Pilot certification without collecting or retaining unnecessary personal information.

Additionally, the preferred approach keeps FAA and testing accounts under student or parent control. It also lets applicants enter accurate information directly into authorized systems.

Finally, limits on school records ensure only the minimum information is kept for legitimate educational purposes.

Why Student Privacy Matters

The FAA certification process requires applicants to use accurate identity and contact information. Depending on the stage of the process, this can include the student’s legal name, date of birth, email address, residential and mailing address, FAA Tracking Number, government-issued identification, test information, and certification status.

These requirements do not mean that a school needs to collect or store every item. A well-designed program separates aviation instruction from identity processing: instructors teach the certification pathway, while students and families control their individual FAA and testing accounts.

What Schools and Families Should Know

Topic	Key information	Recommended school practice
Age requirements	A student may take the Unmanned Aircraft General knowledge test at age 14. A person must be at least 16 to qualify for an FAA Remote Pilot Certificate.	Clearly distinguish passing the knowledge test from receiving the actual certificate.
IACRA account	The applicant registers individually, receives an FAA Tracking Number, and submits accurate personal information.	Do not create shared accounts, retain passwords, or complete the application as the student.
Email address	A valid email is used for registration, communication, and account recovery.	Recommend a durable personal email controlled by the student or family. A school email is not categorically prohibited, but it may expire after graduation.
Address	FAA application and testing processes may require residential and mailing-address information. A post office box used for mailing does not replace a required residential address.	Do not substitute the school’s address for the student’s true residence. Avoid collecting or retaining the address unless specifically necessary and authorized.
Social Security number	Disclosure of a Social Security number in IACRA is optional.	Schools should not request, record, or direct students to disclose it for this activity.
Government ID	The testing process requires acceptable identification that supports identity and age verification.	Explain the current ID rules, but do not routinely copy, photograph, or retain student identification.
FAA public records	FAA Airmen Inquiry does not display Social Security numbers, certificate numbers, or dates of birth. A releasable address may appear unless the airman elects not to release it.	Tell students and families about address releasability and how certificated airmen can manage that preference.

FERPA and Direct Student Entry

However, it is too broad to state that information is automatically outside FERPA simply because a student types it personally.

Additionally, FERPA protects personally identifiable information in education records.

These records are maintained by a school or by a party acting for the school.

Moreover, the complete workflow matters.

It covers who requires the activity, who can view the data, and where it is transmitted.

It also specifies what the school or its provider retains and what information is returned.

A student using an FAA system independently differs from a school collecting the same information in a class spreadsheet.

Additionally, it also differs from preloading a third-party service, retaining screenshots, or receiving detailed student records.

Districts should review the complete data flow under FERPA and state student-privacy laws.

Also, they must consider board policy, cybersecurity requirements, vendor terms, and records-retention rules.

Recommended Privacy-by-Design Workflow

1. Verify current FAA and testing-provider requirements before each program year.
2. Have district privacy or legal staff review the planned data flow, family notice, school records, vendor arrangements, safeguards, and retention period.
3. Give students and families clear notice before FAA registration or knowledge testing.
4. Have the student or parent create and control the individual account, email, password, and recovery information.
5. Allow the applicant to enter identity and contact information directly on a private screen.
6. Permit instructors to explain the process without requesting passwords, Social Security numbers, full identification details, or residential-address lists.
7. Record only the minimum evidence needed for the educational program, such as “knowledge test passed—date verified” or “certificate viewed—date verified.”
8. Limit access to authorized personnel and follow the district’s approved retention and deletion schedule.
9. After certification, show students how to keep their FAA address current and manage address releasability through FAA Airmen Services.

Information Schools Should Generally Avoid Retaining

• Student FAA or testing-system passwords
• Optional Social Security numbers
• Routine copies or photographs of government-issued identification
• Class spreadsheets combining full date of birth, residential address, FAA Tracking Number, ID information, and test results
• Screenshots of IACRA or testing pages containing personal information
• Personal information collected merely “in case it is needed later”

What a Family Notice Should Explain

• The educational purpose of the certification activity and whether participation is required or optional
• The FAA and testing systems the student will use
• The personal information the student will submit
• The information the school will retain, why it is needed, who can access it, and when it will be deleted
• The difference between age 14 knowledge-test eligibility and age 16 certificate eligibility
• The potential public release of a releasable airman address and how to change that preference
• The district contact for questions about privacy, records, accessibility, or alternative arrangements

Recommended District Position

The district supports students pursuing FAA Remote Pilot certification while minimizing institutional collection of personal information. Students and parents control individual FAA and testing accounts and submit accurate information directly to authorized systems. Employees do not collect passwords, optional Social Security numbers, routine copies of government identification, or unnecessary residential and birth information. The district documents any education records it maintains, the legal basis for disclosures, authorized access, safeguards, retention, and deletion.

---

Download the Complete White Paper

The complete white paper provides FERPA analysis, FAA data requirements, operating procedures, and responsibility assignments.

Additionally, it covers risk scenarios, a district implementation checklist, and links to the supporting federal sources.

Document source: Student PII and FAA Remote Pilot Certification: Privacy and Operational Guidance for High School Drone Programs. Blue Ridge Mountain Drones Education and DronePilotsForUS. September 2026.

Selected Official Resources

FAA IACRA Privacy Act Statement: https://iacra.faa.gov/iacra/default.aspx

FAA Unmanned Aircraft Systems Airman Certification Standards: https://www.faa.gov/training_testing/testing/acs/uas_acs.pdf

FAA Airmen Services: https://www.faa.gov/licenses_certificates/airmen_certification/airmen_services

U.S. Department of Education Student Privacy: https://studentprivacy.ed.gov/

Regulatory currency statement: Federal sources were reviewed in September 2026. Schools should verify current FAA, testing-provider, federal, state, and local requirements before implementation.

This page and the accompanying white paper provide policy and program guidance and are not legal advice. They do not replace FAA requirements, FERPA, state law, local policy, insurance conditions, or advice from legal counsel.

---

Need Help Building a Privacy-Safe Drone Certification Program?

DronePilotsForUS supports schools and districts with FAA Part 107 preparation, teacher training, student certification planning, privacy-conscious operating procedures, outdoor flight programs, advanced drone instruction, and district UAS program implementation.