Web filtering for charter schools: CIPA, E-Rate and a small IT team
Charter schools often run lean: one network, one technology lead, sometimes a management organization in the background. This guide shows when CIPA applies to your charter, what the filter needs to do, and how to run it without a large team.
Does CIPA apply to your charter school?
CIPA is a funding condition, not a general rule for every school. It attaches when your charter takes certain E-Rate support. Work through these four questions in order.
Is the school E-Rate eligible?
The federal definition used by E-Rate includes public charter schools. The school must be non-profit, not run as a for-profit business, and must not hold an endowment over $50 million.
Do you apply for E-Rate?
Some charters apply on their own, some through their state or a consortium, and some never apply. If you take no E-Rate support, CIPA does not attach through that route.
Which services are discounted?
Discounts only for telecommunications services do not trigger CIPA. Internet access, internal connections or basic maintenance of internal connections do, even when bundled with telecom.
The result
If you answered yes to all three, CIPA applies and you certify compliance each funding year. Check the current USAC guidance, as program details change.
Even without E-Rate, your charter contract, authorizer or state law may require filtering, and most families expect it anyway. Look at your state school internet safety law guide for rules that apply beyond CIPA.
Meet the filtering rule without hiring for it
The hosted CIPA filter is a DNS filter run for you, so a charter school gets category blocking without a server to maintain. Start with the CIPA preset and adjust from there.
- Adult and VPN/Proxy/Anonymizers are on from the start, with Lingerie, Gambling and Weapons optional.
- One console holds separate settings if your network has more than one campus.
- Activity reports and a policy record are ready for E-Rate and your authorizer.
What CIPA asks a charter school to have in place
The law sets three things. None of them are unique to charters, but a charter has to own each one itself rather than lean on a district office.
Technology protection measure
- Blocks or filters visual depictions that are obscene or child sexual abuse material, for all users.
- Also blocks material harmful to minors on computers used by minors.
- Covers every internet-connected computer the school owns, including staff machines.
- An authorized person may disable it for an adult doing bona fide research or other lawful work.
Internet safety policy
- Addresses minors' access to inappropriate material and their safety in email, chat and other direct messaging.
- Covers unauthorized access such as hacking, and unlawful activity online.
- Covers disclosure of minors' personal information and measures restricting harmful material.
- Includes monitoring of minors' online activities and education about appropriate online behavior, including social networking and cyberbullying.
Public notice and meeting
Before adopting the policy, give reasonable public notice and hold at least one public hearing or meeting about it. For most charters, an agenda item at a regular governing board meeting does the job, recorded in the minutes.
Certification and records
Certify on FCC Form 486 for CIPA certification, or Form 479 if you are a consortium member. Keep the policy, minutes, notices and filter evidence ready for review.
For a full walk through every element, see what CIPA requires and the CIPA compliance checklist.
Why charter schools face different filtering problems
A traditional district has a technology department, a central firewall and policy staff. Many charters have none of these, which changes how filtering should be set up.
One person, many jobs
The technology lead often also handles devices, testing platforms, phones and the front office printer. The filter must run with little attention.
Leased or shared buildings
Some charters share a building or rent space with a landlord's network. You may not control the main router, so a filter that follows your devices or your own DNS matters.
Networks of campuses
Charter networks run several campuses under one board. Each site may need its own settings and contact person while policy stays the same.
Management organizations
A management organization may run IT for you. The school still certifies, so the school needs its own copies of the settings and records.
Take-home devices
Many charters run 1:1 programs from the start. Devices leave the building every night, so filtering on the campus network alone is not enough.
Renewal cycles
Charter renewal and authorizer reviews may ask about safety and technology policies. Good records save scramble time at renewal.
Categories a charter school usually decides first
These real lookups show how our data labels sites a charter policy usually names. The note column is a typical first decision, which you can change.
| Website | Categories in our data | Typical first decision |
|---|---|---|
| tiktok.com | Social Networking, Streaming Media | Blocked on student devices |
| draftkings.com | Gambling, Sports & Recreation | Blocked, the Gambling category |
| snapchat.com | Social Networking | Blocked for students |
| khanacademy.org | Education/Reference | Allowed, instruction |
| nordvpn.com | File Sharing/P2P, VPN / Proxy / Anonymizers | Blocked by the VPN / Proxy switch |
| quizlet.com | Education/Reference, Webinars/E-learning | Allowed, study tool |
A category policy that fits a charter school
Start with the categories that cover the CIPA core, then add the ones most schools choose for safety and focus. Keep education and research categories open so teaching is not blocked.
| Category | Students | Staff | Why |
|---|---|---|---|
| Adult | Block | Block | The core of the CIPA requirement for all users. |
| VPN / Proxy / Anonymizers | Block | Block | Bypass tools defeat every other rule. See stopping proxy and VPN bypass. |
| Malware / Phishing / Suspicious | Block | Block | Protects accounts and devices, especially staff with payroll and student records. |
| Gambling | Block | Local choice | Common harmful-to-minors choice; sports betting ads target teens. |
| Illegal Drugs, Weapons, Violence, Hate/Discrimination | Block | Local choice | Typical student protections; staff may need some access for lessons. |
| Dating, Alcohol, Tobacco, Lingerie/Swimsuits/Intimate Apparel | Block | Local choice | Age-inappropriate for minors in most communities. |
| Social Networking, Gaming, Streaming Media | Local choice | Local choice | Focus and bandwidth decisions, not CIPA. Many charters block for younger grades only. |
| AI / LLM Tools | Local choice | Local choice | Depends on your academic integrity and AI policy. |
| Education/Reference, Science, Government & Legal | Allow | Allow | Keep open so research and coursework work. |
Your full set of choices is described in the school web filtering categories taxonomy. If a teacher reports a wrongly blocked site, you can look it up with the domain category checker.
Filtering options for small charter IT teams
There are three common ways to deliver the filter. The right one depends on whether you control your network and how many devices go home.
Hosted DNS filter
You point your network's DNS at a filter run for you. Every device on campus is covered with nothing installed, and categories are switched on or off in a dashboard.
Best fit: single-campus charters and networks without a dedicated network engineer. Pair with device settings for take-home laptops.
Device-based filter
Software or browser policy on each managed device applies the rules on and off campus. On Chromebooks this usually sits in the admin console.
Best fit: 1:1 programs. See category filtering on managed Chromebooks.
Firewall filtering
The firewall at your internet edge inspects traffic and applies category rules. It is powerful, but it needs someone who can maintain the firewall and its licences.
Best fit: larger charter networks that already run a managed firewall with support.
Many charters combine a hosted CIPA filter on the campus network with device rules for take-home laptops. The two layers cover each other's gaps. Read more on enforcing CIPA on off-campus student devices.
Keeping lists current is the filter's work
Categories come from the same database, so you do not maintain a block list yourself. Always-allow and always-block lists per site cover the few exceptions your school really has.
Setting it up in your first week
A realistic plan for a technology lead with other duties. Each day is a short block of work, not a full day.
Day 1: inventory
List networks, sites, guest wifi and device types. Note who controls each router and who holds the admin passwords.
Day 2: policy draft
Write the student and staff category lists from the table above. Agree them with the school leader.
Day 3: switch on
Point the campus DNS at the filter or enable the rules on devices. Start with one room or one grade to check nothing breaks.
Day 4: test
Try a set of sites in each blocked category and a set of learning sites that must work. Record the results.
Day 5: tell people
Send staff a short note on what is blocked, how to request a site and how the adult research bypass works.
For a structured test plan, use the school web filter test. For a longer rollout across several campuses, follow how to implement web filtering in schools.
Who does what in a charter school
Clear ownership keeps the filter working when staff change. Charter turnover can be high, so write these roles down.
| Role | Owns | Typical time |
|---|---|---|
| Governing board | Adopts the internet safety policy after public notice and a meeting; approves major changes. | One agenda item a year |
| School leader or executive director | Signs off the category policy, decides on contested requests, names the authorized person for adult bypass. | A few hours a year |
| Technology lead | Runs the filter, handles unblock requests, keeps settings exports and test results. | One to two hours a month |
| Management organization (if any) | May run the network and filter under contract; should send the school copies of settings and reports. | As contracted |
| E-Rate contact or consultant | Files forms on time and confirms the CIPA certification is backed by records. | Around filing deadlines |
| Teachers | Report wrongly blocked learning sites and supervise screens in class. | As needed |
Records to keep for E-Rate and your authorizer
If USAC reviews your CIPA certification, you need to show the policy existed, was adopted properly and that a filter was running. The same folder helps at charter renewal.
- Current internet safety policy, with the date it was adopted
- Public notice for the meeting where it was discussed
- Board minutes showing the hearing or meeting took place
- A summary of blocked categories for students and staff
- Screenshots or exports of filter settings each funding year
- Test results showing blocked categories work on campus
- Your process for unblock requests and the adult research bypass
- Lessons or materials used to teach appropriate online behavior
- Copies of Form 486 or Form 479 and related emails
- Any management organization contract clauses covering IT and filtering
USAC review questions are covered in what USAC asks for in a CIPA audit. For the policy text itself, start from the guide to the CIPA internet safety policy.
Common charter school filtering mistakes
These come up again and again in small schools. Each one is simple to prevent once you know it.
Guest wifi left open
Students find the guest network password within weeks. Filter guest wifi too, as explained in school guest wifi filtering.
Settings live only with a contractor
When the contract ends, nobody can show what was blocked. Export settings each year and keep them in the school's own files.
Blocking too much
Over-blocking drives teachers to hotspots and personal devices. Review the top blocked sites monthly and open what teaching needs.
No adult bypass process
CIPA allows disabling the filter for adult research. Without a simple process, staff stop asking and start working around the filter.
Policy never adopted
A policy written by a vendor but never put before the board does not meet the public meeting step. Add it to an agenda.
Confusing filtering with monitoring
A category filter blocks sites. It does not read messages or flag students, so your safeguarding process still matters.
Website category filtering is one layer of student safety. Concerns about a student's wellbeing go through your school's safeguarding and counseling process. The difference is explained in web filtering vs monitoring vs classroom management.
Budgeting for a charter school filter
Charter budgets are tight and often set before enrolment is final. Plan the filter as a small, predictable line rather than a one-off purchase.
What drives cost
Number of students or devices, number of campuses, whether take-home devices need coverage, and how much reporting you need for records.
E-Rate and the filter
Content filtering itself has generally not been an E-Rate eligible service. Check the current Eligible Services List before assuming any discount.
Hidden cost: staff time
A cheaper tool that needs hours of weekly attention can cost more than a hosted service. Count the technology lead's time honestly.
Price ranges and questions to ask are covered in how much a school web filter costs, and the trade-offs of free tools in free vs paid web filtering for schools.
Questions to ask your management organization or IT contractor
If someone outside the school runs your network, these questions confirm the filter will stand up to a review and survive a change of contractor.
Which categories are blocked?
Ask for a written list for students and for staff, matched to your board-approved policy.
Which networks are covered?
Confirm campus wired, staff wifi, guest wifi and take-home devices, with no network left out.
Can we get an export?
Request a settings export each funding year, saved in the school's own files.
What happens at contract end?
Agree in writing how settings, lists and reports pass to the school or the next provider.
Charter school filtering, step by step
- Confirm whether CIPA appliesCheck your E-Rate applications for internet access or internal connections. If unsure, ask your E-Rate contact.
- Draft or update the internet safety policyCover every required element, including monitoring of minors' online activity and online behavior education.
- Hold the public meetingGive notice, discuss the policy at a board meeting and minute it.
- Choose and configure the filterSet student and staff category policies, an allow list for core learning sites and the adult bypass.
- Cover every network and deviceCampus wired, staff wifi, guest wifi and take-home devices.
- Test and recordRun the test, save results and export settings.
- Certify and fileComplete Form 486 or 479 on time with the records ready behind it.
- Review each yearRe-test, update categories such as AI tools and confirm the policy is still current.
If your charter belongs to a larger network of schools, the web filtering guide for school districts covers multi-site policy in more depth. For a broader view of the K-12 picture, see web filtering for K-12 schools.
Charter filtering options side by side
A charter IT lead can use this to size the work before choosing.
| Consideration | Do it in house | Hosted CIPA filter |
|---|---|---|
| Staff time to maintain lists | Ongoing | None for categories, lists only for exceptions |
| CIPA preset | Built from scratch | Adult and VPN/Proxy/Anonymizers on |
| E-Rate paperwork | Screenshots and notes | Activity reports, policy record, log export |
| More than one building | Repeat the setup | One console, separate settings per school |
| Laptops at home | Usually unfiltered | Private encrypted link keeps the same rules |
| Time to switch | Days of testing | Change one DNS setting |
Charter school web filtering FAQ
Does CIPA apply to charter schools?
CIPA applies when the charter receives E-Rate discounts for internet access, internal connections or basic maintenance of internal connections. Without that support it does not attach through E-Rate, but your charter, authorizer or state law may still require filtering.
Are charter schools eligible for E-Rate?
Generally yes. The federal definition used by the program includes public charter schools, provided the school is non-profit and has no endowment over $50 million. Confirm with current USAC guidance and your state definition.
If our charter is run by a management company, who certifies CIPA?
The school or its billed entity certifies on Form 486, or the consortium member on Form 479. The management company can do the technical work, but the school should keep its own copies of the records.
Can a charter school with one IT person run a CIPA-compliant filter?
Yes. A hosted filter removes most server work. The IT person sets the policy once and spends a little time each month on reviews and requests.
Do we need to filter staff devices?
Yes, for obscene images and child sexual abuse material. Staff policies can be broader than student policies, and an authorized person can disable the measure for an adult doing bona fide research.
What happens with charter renewal or authorizer reviews?
Requirements differ by state and authorizer. Keeping the policy, minutes and a filtering summary in one folder makes renewal paperwork faster.
Related guides
Charter pricing depends on the number of schools and devices, and we answer with a quote within one business day. A pilot on one campus shows the blocks and reports before you commit to anything.
Talk to us about your charter school
Tell us how many campuses and devices you run, and whether you control your network. We will suggest a filtering setup your team can manage.
Talk to us about your school See the hosted CIPA filter