Plain definitions of the terms schools and libraries meet when they buy, set up and document a web filter. Sixty terms, from the forms USAC asks for to the settings in a filter dashboard.
Buying a web filter brings two vocabularies together. One comes from federal law and the E-Rate program: certifications, form numbers and funding years. The other comes from networks and devices: DNS, encryption, device management and the tools people use to get around a filter. This glossary puts both in one place, in alphabetical order.
Each entry gives a short definition and, where we have one, a link to a guide that goes into more depth. Use the letters above to jump to a section, or link straight to a term to share it with a colleague or your board.
Where the CIPA and E-Rate entries come from. They follow the rules and orders of the FCC and the E-Rate guidance on usac.org, as checked in November 2026. Forms, budgets and deadlines can change from one funding year to the next, so confirm the details with USAC before you file. This glossary is general information, not legal advice.
An acceptable use policy sets the everyday rules for using school or library computers, networks and accounts. It is not the same document as the internet safety policy that CIPA requires, although many districts combine the two. If you combine them, check that every CIPA topic is still covered. USAC lists acceptable use policies among the records E-Rate applicants should keep.
Read more: Acceptable use policy for schools
The body responsible for running a school or library, and the one that must certify its CIPA status. For a school it may be the school, the school board, the district or the local educational agency. For a library it may be the library, the library board or another authority that runs it. If the Administrative Authority is not also the Billed Entity, it certifies on FCC Form 479.
Read more: FCC Form 479 for consortium members
CIPA allows an administrator, supervisor or other authorized person to disable the filter during use by an adult, so the adult can do bona fide research or pursue another lawful purpose. USAC gives the example of a library sign-in page where an adult affirms that purpose. The protection stays in place for minors. A written procedure that says who may unblock, for whom and for how long makes the practice easy to show in an audit.
Read more: CIPA adult unblocking in libraries
Rules that decide which AI tools, such as chatbots, image generators, writing tools and tutors, students or patrons can open. CIPA does not name AI tools, so these rules are a local policy choice. A filter that knows the type of each tool lets you keep study tools open while closing others. Tools made for explicit images or deepfakes belong in a group that stays blocked for everyone.
Read more: AI Controls in the hosted filter · AI tools blocklist for schools
An allow list holds websites that are never blocked, whatever their category. A block list holds websites that are always blocked. Together they handle the exceptions that category rules miss, such as a teaching site caught by mistake or a site your policy rules out. Keep both lists short and review them each term, because each entry overrides the category data.
Read more: How schools block websites
The Billed Entity is the organization that receives the bill and pays for E-Rate supported services. It may be separate from the buildings that receive the service. USAC gives it a Billed Entity Number, or BEN. A district or library system usually files as the parent entity, with its schools or branches listed as child entities. The Billed Entity certifies CIPA on FCC Form 486.
Read more: FCC Form 486 and CIPA certification
The page a person sees when the filter stops a website. A good block page names the site, gives the reason and says how to ask for access. On encrypted (https) websites a DNS filter cannot show its own page unless the computer trusts the filter's certificate, so the browser shows a security warning instead. That is normal and not a fault.
Students, staff or patrons using their own phones, tablets and laptops on your network. You cannot install software on these devices or manage them, so filtering at the network level is the usual way to cover them. DNS filtering covers every device that joins a filtered network, with nothing to install. A separate network for personal devices lets you give them their own rules.
Read more: BYOD filtering in schools
Blocking websites by the category they belong to, such as adult content, gambling or proxy sites, instead of one by one. The filter looks up each domain in categorized data and applies your rule for that category. New sites in a blocked category are caught without anyone adding them, which is why most schools and libraries meet CIPA this way. The quality of the category data decides how well it works.
Read more: Web filtering categories · Category filtering on managed Chromebooks
The E-Rate category for connections to schools and libraries: data transmission services and internet access. Basic firewall protection, DNS and DHCP can be part of eligible internet access when the provider includes them as a standard part of the service. Content, applications, email and end-user devices such as laptops and tablets are not eligible. There is no budget cap for Category One.
Read more: E-Rate and CIPA funding
The E-Rate category for equipment and services inside buildings: internal connections, managed internal broadband services and basic maintenance of internal connections. Examples are routers, switches, wireless access points and cabling. Category Two has a five-year, pre-discount budget. For FY2026 to FY2030 it is $201.57 per student for schools and $5.43 per square foot for libraries, with a floor of $30,175 ($66,385 for Tribal libraries).
Read more: E-Rate and CIPA funding
One of the three kinds of visual depictions CIPA requires the filter to protect against, for adults and minors alike. CIPA uses the federal criminal definition. Today the material is usually called child sexual abuse material, or CSAM. In a filter it should sit in a category that no staff or patron unblock can open.
Read more: Blocking adult content on school networks
A separate network or filter profile for the children's section of a library, with stricter rules than the adult computers. It lets a library offer adult unblocking to adults while children's computers stay locked to the CIPA categories and any extra ones the board chooses. A children's profile often also forces safe search and YouTube Restricted Mode.
A federal law enacted in December 2000. Schools and libraries that receive E-Rate discounts for internet access or for Category Two services must certify that they enforce an internet safety policy that includes a technology protection measure, adopted after public notice and a hearing or meeting. Schools must also monitor the online activities of minors and educate them about appropriate online behavior. CIPA does not apply to an applicant that receives discounts for telecommunications services only.
Read more: What is CIPA? · CIPA compliance checklist
A review of whether a school or library met CIPA in a funding year. USAC lists the documents it asks for: the internet safety policy, proof of public notice and of the hearing or meeting, proof that the policy was adopted, a description of the filter, reports or logs showing it worked during the year, and copies of Forms 479 or 486. Minor errors, such as a topic missing from a written policy, can often be corrected.
Read more: What USAC asks for in a CIPA audit
Software that lets a teacher see and guide student screens during a lesson, for example by sending a page to the class or closing tabs. It is not a web filter and does not meet CIPA on its own. Many schools use both: a filter for the whole network and a classroom tool for teaching time.
Read more: Filtering, monitoring and classroom management compared
A group of E-Rate eligible schools and libraries that seeks bids or funding together. The consortium's discount is the simple average of its members' discounts. A member whose Administrative Authority is not the Billed Entity certifies CIPA to the Billed Entity on FCC Form 479. Private sector entities cannot be members.
Read more: FCC Form 479 for consortium members
The USAC table that sets each applicant's E-Rate discount. It uses the share of students eligible for the National School Lunch Program and whether the district or library system is urban or rural. Discounts run from 20 percent to 90 percent for Category One, and up to 85 percent for Category Two (90 percent for Tribal libraries from FY2024). A library uses the figures of the school district where its main branch or main office is.
Read more: E-Rate and CIPA funding
Filtering at the moment a device asks for the address of a website, the DNS lookup. The filter does not answer for domains in blocked categories, so the page never loads. One setting on the router covers every device on the network, with nothing to install. It decides by domain, so it cannot block one page or one video on a site that is otherwise allowed.
Read more: Web filtering vs DNS filtering · CIPA DNS filtering for education
A way for a browser or device to send its DNS lookups encrypted inside HTTPS, often to a public service. If it is left open, a browser can skip the network's DNS filter without the user doing anything. Filters handle it by blocking known public encrypted DNS services. Used on purpose, the same technology gives a device its own encrypted link to the school's filter, so it stays filtered away from the network.
Read more: Stopping proxy and VPN bypass
E-Rate participants must keep their records for at least 10 years after the later of the last day of the funding year or the service delivery deadline. For CIPA that includes the internet safety policy, proof of public notice and the hearing or meeting, proof of adoption, documents on the purchase, installation and use of the filter, and Forms 479 or 486. One folder per funding year keeps an audit simple.
Read more: CIPA compliance checklist
The Schools and Libraries universal service program. The FCC sets its rules and USAC runs it. It gives eligible schools and libraries discounts on internet access, data transmission and internal connections. Discounts depend on poverty levels and on urban or rural status. Taking E-Rate discounts for internet access or Category Two services is what brings CIPA into play.
Read more: E-Rate and CIPA funding · E-Rate for public libraries
The FCC's yearly list of the products and services that can receive E-Rate discounts, split into Category One and Category Two. The filter itself is not covered: the FCC has said E-Rate discounts cannot be used to buy a technology protection measure. Basic firewall protection is eligible. For funding year 2026 the FCC declined to make advanced or next-generation firewalls eligible.
Read more: Funding web filtering beyond E-Rate
The federal agency that writes the E-Rate rules, including the CIPA certification rules, and releases the Eligible Services List each year. USAC runs the program under the FCC's direction. If USAC denies an appeal, the applicant can then appeal to the FCC.
The Description of Services Requested and Certification Form. Certifying it in USAC's online system posts it publicly and opens the competitive bidding process for E-Rate services. You must then wait at least 28 days before choosing a provider, signing a contract or certifying Form 471. The 29th day, counting the day you certify as day one, is the Allowable Contract Date. If you issue a request for proposals, it must be uploaded with the Form 470.
Read more: School web filter RFP checklist
The Description of Services Ordered and Certification Form. Applicants file it during USAC's yearly filing window to request discounts for the next funding year. It lists the services, costs, recipients and providers, and certifies compliance with program rules. USAC reviews it and answers with a Funding Commitment Decision Letter.
Read more: E-Rate and CIPA funding
The Certification of Administrative Authority to Billed Entity of Compliance with the Children's Internet Protection Act. When the authority that runs a school or library is not the Billed Entity, as with many consortium members, it certifies CIPA to the Billed Entity on this form. The Billed Entity then certifies on Form 486 that it has collected the Forms 479. It is not needed when the request covers telecommunications services only.
Read more: FCC Form 479 for consortium members
The Receipt of Service Confirmation and Children's Internet Protection Act Certification Form. It tells USAC that services have started and states the CIPA status of each school or library on the funding requests. It can only be filed after a positive Funding Commitment Decision Letter. The deadline is 120 days after the service start date or 120 days after the date of that letter, whichever is later.
Read more: FCC Form 486 and CIPA certification
FERPA, the Family Educational Rights and Privacy Act, is the federal law that protects student education records. Filter logs and monitoring reports can hold information about students, so privacy belongs in any filter purchase. Ask a provider where logs are stored, who can see them, how long they are kept and whether they are used for anything else.
Read more: Student data privacy, FERPA and filtering
USAC's decision on the funding requests in a Form 471, sent to the applicant and its service providers. A positive FCDL is the green light to file Form 486. Later changes to a commitment, such as a cancelled or reduced request filed on FCC Form 500, lead to a revised letter.
Read more: FCC Form 486 and CIPA certification
The E-Rate program year. It starts on July 1 and ends on June 30 of the following year, and is written as FY2026 and so on. CIPA certifications, Category Two budgets, filing windows and deadlines are all tied to a funding year.
Read more: E-Rate and CIPA funding
A separate wireless network for visitors, patrons and personal devices. Giving it its own filter profile keeps the rules for staff, students and guests apart. In a public library it is often the network most people use, so decide in your policy how it is filtered and say so on the sign-in page.
Read more: School guest Wi-Fi filtering · Library Wi-Fi and patron devices
The third kind of visual depiction in CIPA, and the only one limited to use by minors. It means an image that, taken as a whole, appeals to a prurient interest in nudity, sex or excretion; shows sexual acts or a lewd exhibition of the genitals in a way that is patently offensive for minors; and lacks serious literary, artistic, political or scientific value for minors. The FCC has said social networking sites are not harmful to minors per se.
Read more: CIPA content filtering
A filter that runs on a provider's servers instead of on hardware in your building. You point your network or devices at the service and manage the rules from a web dashboard. There is no appliance to buy, patch or replace, and the provider keeps the category data up to date.
Read more: Our hosted CIPA filter · Cloud-based web filtering for schools
Mobile hotspots and Wi-Fi on school buses take internet access beyond school buildings. In 2025 the FCC rescinded its hotspot rules and ruled that school bus Wi-Fi is ineligible from funding year 2025, so neither is now eligible for E-Rate support. School devices used on them can still be filtered with a per-device link to the filter or with device management.
Read more: School bus Wi-Fi and hotspot filtering
The written policy CIPA requires. It must include a technology protection measure and address five topics: access by minors to inappropriate matter online; the safety and security of minors in email, chat rooms and other direct electronic communication; unauthorized access, including hacking, and other unlawful activities by minors; unauthorized disclosure of personal information about minors; and measures to restrict minors' access to harmful material. Schools must also cover monitoring and online safety education.
Read more: Writing a CIPA internet safety policy · Public library internet filtering policy
Statutory safeguarding guidance from the Department for Education for schools and colleges in England. It expects schools to have appropriate filtering and monitoring and points them to the DfE filtering and monitoring standards, which cover roles, regular review, blocking harmful content and monitoring. Unlike CIPA, it is not tied to a funding program. Our UK section covers it in detail.
Read more: UK schools section · KCSIE filtering and monitoring
The federal library grant program under the Museum and Library Services Act. E-Rate uses its definition of a library: to qualify, a library must meet that definition and be eligible for help from its state library administrative agency under the Act. CIPA also amended the library grant law, but that part is outside the FCC's jurisdiction. Ask your state library agency how it applies to grant-funded purchases.
Read more: E-Rate for public libraries
Software that manages the devices a school or library owns: settings, apps, updates and restrictions. Examples include Jamf, Microsoft Intune and Google Admin for Chromebooks. Device management can lock a filter setting so users cannot remove it, and on supervised iPads it can hide and block apps. It only works on managed devices, not on personal phones.
Read more: App management on school devices · App Control for iPads and phones · Blocking websites in Google Admin
Under CIPA, a minor is anyone under the age of 17. The harmful to minors category applies to computer use by minors, and the filter may be disabled only during use by an adult. Computers set aside for children and teens under 17 therefore keep the filter on.
Read more: What is CIPA?
Schools must certify that their internet safety policy includes monitoring the online activities of minors. CIPA does not require tracking the internet use of any identifiable minor or adult. Supervision in the room and filter reports by network and category are common ways schools do it. Student monitoring software goes further and raises its own privacy questions.
Read more: Student online monitoring: what schools can see · Filtering, monitoring and classroom management compared
The name for sections 1731 to 1733 of CIPA. NCIPA added subsection (l) to section 254 of the Communications Act. That is where the internet safety policy rules sit, including the rule that local authorities decide what matter is inappropriate for minors.
Read more: What is CIPA?
One of the three kinds of visual depictions CIPA requires the filter to protect against, for adults and minors alike. CIPA uses the federal criminal definition of obscenity. What else is inappropriate for minors is decided locally, by the school board, local educational agency, library or other responsible authority.
Read more: Blocking adult content on school networks
Filtering for school or library devices used away from your network, such as take-home laptops and loaned tablets. A network filter stops at the door of the building, so these devices need their own link to the filter, a filtering agent, or device management that sends their traffic to it. State the off-campus rules in your policy so families know what applies at home.
Read more: Enforcing CIPA on off-campus student devices
A program where every student has a school device, often a Chromebook or iPad, that may go home. Filtering has to follow the device, through device management, a browser policy or a per-device link to the filter. Decide the at-home rules, the support process and the message to parents before the devices go home.
Read more: Chromebook and 1:1 device filtering
Since July 1, 2012, schools certify that their internet safety policy provides for educating minors about appropriate online behavior. That includes interacting with other people on social networking websites and in chat rooms, and cyberbullying awareness and response. The requirement comes from the Protecting Children in the 21st Century Act of 2008.
Read more: Writing a CIPA internet safety policy
Blocking lawful, useful content by mistake, such as health, history or research sites. It gets in the way of teaching and, in libraries, can limit adults' access to information. A short review of blocked requests and the allow list each term helps you find it early.
Read more: Free CIPA over-blocking audit
A library setting that lets an adult open a blocked website at the computer, without asking staff, after confirming age and purpose on screen. It follows the example USAC gives of a sign-in page where an adult affirms bona fide research or another lawful purpose. Computers for children and teens keep adult content blocked.
Read more: Patron self-unblock: four ways to set it up
Blocking websites that steal passwords or spread harmful software. It is not a CIPA requirement, but many schools and libraries switch it on because it protects staff and student accounts. Many filters can also block newly registered domains, which scams often use before any list has caught up.
Read more: Malware and phishing protection for schools
Ways people try to get around a filter: web proxies, VPN apps and browser extensions, and anonymizers that hide where traffic goes. Blocking the VPN and proxy category, and known public encrypted DNS services, closes most of them on the network. On managed devices, blocking VPN apps and extensions in device management helps further.
Read more: Stopping proxy and VPN bypass · Blocking VPN extensions on Chromebooks · Blocking proxy sites in schools
Before adopting the internet safety policy, the school or library must give reasonable public notice and hold at least one public hearing or meeting on the proposed policy and technology protection measure. Private schools give notice to their appropriate constituent group. Later amendments need no new meeting unless state or local rules or the policy itself require one. Keep the notice, the agenda and the minutes.
Read more: CIPA compliance checklist
A document that describes what you want to buy and how bids will be judged. For E-Rate services an RFP is optional unless state or local rules, or FCC rules for certain services, require one. If you issue one, it must be uploaded with your Form 470. For a filter, an RFP lets you compare coverage, reporting, support and price on the same terms.
Read more: School web filter RFP checklist
A search engine setting that hides explicit results. A filter can force it on for every device on the network, so a user cannot switch it off. It works alongside category blocking, because image results can show content from sites that are not themselves blocked.
Read more: SafeSearch enforcement for schools
Decrypting encrypted (https) traffic so a filter can see full web addresses and page content, then encrypting it again. It needs a trusted certificate on every device and brings privacy, performance and support questions. DNS filtering does not need it, because it decides by domain before the encrypted connection starts.
Read more: SSL inspection in schools
A way for staff to unblock adult content for a short time, usually for an adult's research request, by entering a PIN. The filter switches back on by itself and each use is logged. It is one way to apply CIPA's adult unblocking provision while keeping other blocked categories closed.
Read more: The staff PIN in the hosted filter · Library staff guide to filter requests
CIPA's term for the filter: a specific technology that blocks or filters internet access. It must protect against visual depictions that are obscene, child pornography or, for minors, harmful to minors, and it must be enforced while computers with internet access are in use. The law does not name products. The FCC has said E-Rate discounts cannot be used to buy it.
Read more: What makes a CIPA-compliant web filter
A certification for the first funding year in which a school or library applies for CIPA-covered services. Instead of full compliance, it states that the school or library is taking steps to comply by the next funding year, such as a board agenda item on CIPA or a request for filter quotes. The steps must be documented and taken before services start.
Read more: FCC Form 486 and CIPA certification
The organization that runs the E-Rate program under the FCC's direction. It reviews applications, issues funding decisions, pays discounts and audits compliance, including CIPA. Its website holds the forms, filing windows, deadlines and guidance that applicants use, and its online portal is where the forms are filed.
Read more: What USAC asks for in a CIPA audit
Controlling which websites people can reach on a network or device, usually by category, with allow and block lists for exceptions. It can work at the DNS level, in a proxy or firewall, or in software on each device. For schools and libraries that take E-Rate, it is the usual form of CIPA's technology protection measure.
Read more: What is school web filtering? · Why schools need web filtering
A YouTube setting that hides videos that may be mature. A filter or device policy can force it on, so students cannot turn it off. It works automatically, so some useful teaching videos may be hidden and not every unsuitable video is caught. Review it with teachers so the setting fits how they use video.
Read more: YouTube and streaming filtering · Blocking YouTube on Chromebooks
Set one DNS address on your router and every device on the network is filtered: the CIPA categories blocked, a staff PIN for adult research, and reports for your records. Nothing to install.