It is legal. What's protected under FERPA is data generated by the school that is given to a technology provider, not data generated by an app user. So yes, a school app can legally use Google Analytics or Facebook like buttons.
So for as long as you're not sending PII, you're in the clear.
...However, it's actually allowable to send PII if the sending meets the following criterion:
- Provides a service or function that the school would otherwise use its own staff
- Be under the direct control of the school with regard to the use and maintenance of the PII from education records
- Collection and use of the PII must be consistent with the school or district’s annual notification of rights under FERPA
- Not re-disclose or use the education data for unauthorized purposes.
COPPA permits a school to obtain parental consent on the operator’s behalf, as long as the operator
uses the information only on behalf of the school pursuant to the agreement between the school and
the operator.
So for as long as you're not sending PII, you're in the clear.
...However, it's actually allowable to send PII if the sending meets the following criterion:
- Provides a service or function that the school would otherwise use its own staff
- Be under the direct control of the school with regard to the use and maintenance of the PII from education records
- Collection and use of the PII must be consistent with the school or district’s annual notification of rights under FERPA
- Not re-disclose or use the education data for unauthorized purposes.