6 min read · Updated 2026-10-18
In short
Keep children's names and personal details out of public AI tools: the OAIC recommends against entering personal information, especially sensitive information, into them. If your centre is covered by the Privacy Act, APP 6 limits using family information in an AI tool for a purpose families would not expect. Check every AI output before a child or parent sees it, and tell families how you use AI.
General information, not legal advice. Laws and the regulators' rules change: check the sources below, and talk to your own adviser about your centre.
You find out the way most owners do: a tutor proudly shows you the progress report an AI chat tool wrote for them, and it opens with the student's full name, school and the note about their anxiety you only gave that tutor. AI tools can draft a lesson plan, a worksheet or a parent update in seconds, and tutors are already using them, often on personal accounts. The risk is not the drafting. It is what gets pasted in: a student's name, their results, a note about their anxiety, a parent's email. This article sets out a simple policy a tutoring centre can adopt, based on the Office of the Australian Information Commissioner's (OAIC) guidance on commercially available AI products.
What privacy law says about AI
The OAIC is clear that the Privacy Act applies to any personal information put into an AI system, and to anything the system produces that is about an identifiable person. That includes made-up or wrong statements about a real student. If your centre is covered by the Act (see privacy for tutoring centres for who is), several principles come into play:
- APP 6: you may use or disclose information for the purpose you collected it. Feeding it into an AI tool for another purpose needs consent, or must be something the family would reasonably expect and related to the original purpose. For sensitive information, such as health details, the bar is higher.
- APP 3: if an AI tool generates or infers information about a student, such as a predicted grade or a description of their needs, that counts as collecting personal information.
- APP 10: you must take reasonable steps to keep information accurate, and AI is known to produce confident errors.
- Transparency: the OAIC says businesses should update their privacy policies to explain their use of AI, and make any public-facing AI, such as a chatbot, clearly identified as AI.
As best practice, the OAIC recommends that organisations do not enter personal information, and particularly sensitive information, into publicly available AI tools at all. For a centre that works with children, that is the rule to start from, whether or not the Act technically covers you.
A one-page AI policy for your centre
- No names, dates of birth, schools, contact details, photos or health or learning information go into a public AI tool. Use "the student" or "Student A".
- Never paste a parent's email or a student's work with their name on it. Remove identifying details first.
- Only approved tools are used for centre work, with company accounts, not personal ones.
- Before approving a tool, check who can see what is typed in, whether it is used to train the model, and where it is processed. The OAIC calls this due diligence and says it is not a one-off.
- A person reads every AI output before it reaches a child or a family, and checks every fact, mark and maths step.
- AI never makes a decision that matters about a student on its own, such as placement, a report comment or a concern about wellbeing.
- Your privacy policy says how you use AI, and families can ask questions.
- Anything worrying a child writes, typed into an AI tool or anywhere else, goes to your safety lead, not just the tutor.
Keep out
- Names and dates of birth
- Schools and contact details
- Photos
- Health or learning needs
Fine to use
- A topic, a year level and a skill
- A worksheet you wrote, with names removed
- A question you want explained another way
- Your own lesson plan, with no student in it
Checking what AI produces
AI drafts are fluent, which makes errors easy to miss. Worked solutions can contain a wrong step that looks right, and summaries can invent details. Treat every output as a draft written by a capable but careless assistant:
- Work maths answers yourself, or check them against a trusted solution.
- Read report comments and parent updates aloud. If you would not sign it, do not send it.
- Look for anything the tool could not have known. Invented detail about a student is a privacy problem as well as an accuracy problem.
Students using AI
When students use AI, the questions change: is it right for their age, does it do the work for them, and can parents see and control it? Choose tools that screen what a child types and what is shown back, that let parents switch AI off, and that never sell an upgrade on a child's screen. Agree a rule with families about AI and homework, and tell students plainly what is allowed.
Telling families
Families should not find out from a news story that their child's details went into an AI tool. Say what you use AI for, what you never put into it, and who checks the results, in your privacy policy and in a short note at enrolment. If you plan a new use of family information with AI, the OAIC suggests that, where you cannot show families would reasonably expect it, you ask for consent or offer a clear way to opt out.
Staff training matters as much as the policy. Make the AI rules part of every new tutor's induction; our article on onboarding a new tutor covers the first two weeks.
How XTutio helps
The safest policy is one your tutors do not have to remember. In XTutio the AI is built into the work, so there is no reason to paste anything into a public tool. Before anything reaches an AI model, a child's name becomes Student A, a parent becomes Parent of Student A and contact details are scrubbed; the real name comes back only for the staff member entitled to see it. A family's home notes never reach a model at all.
- Staff drafts stay drafts: an email drafted from a conversation lands in the composer with 'fill in' markers for anything the AI was not told, and the lesson wrap-up drops any sentence with a number that is not in the lesson's record.
- Homework marking is a first pass for the tutor: any quote from the student's work that is not really there is cleared, each line of maths is checked by the platform's own maths checker, and the draft never reaches the student or family.
- For children, every AI tool checks the parent's switch and the child's age first, screens what the child types, and checks every reply before it is shown. If the check cannot give an answer, the reply is held back and a neutral line takes its place.
- A parent turns AI study tools off for their family in their Safety centre.
Be clear with families about one thing: AI requests may be processed outside Australia, including in the United States, so say so in your privacy policy. Our safety page and security page set out the details.
Questions centres ask
- Can tutors put student names into public AI chat tools?
- They should not. The OAIC recommends that organisations do not enter personal information, especially sensitive information, into publicly available AI tools, and for a centre that works with children that should be a firm rule.
- Do we need to tell parents we use AI?
- The OAIC says businesses should update their privacy policies and notices to explain how they use AI. Telling families plainly also builds trust.
- Is AI-generated feedback about a student personal information?
- Yes, if it is about an identifiable student. The OAIC says information an AI tool generates or infers about a person, including incorrect information, is personal information and must be handled under the privacy principles.
Sources
- Guidance on privacy and the use of commercially available AI products, Office of the Australian Information Commissioner. Read 2026-10-17.
- Small business, Office of the Australian Information Commissioner. Read 2026-10-17.
- Children and young people, Office of the Australian Information Commissioner. Read 2026-10-17.
