CIPA Compliant Web Filtering | Domain Classification for Schools and Libraries

Why CIPA Sits at the Centre of School Network Policy

Accept an E-Rate discount or an LSTA grant and the Children's Internet Protection Act arrives attached to it. Compliance is written into the terms of the money, not offered as guidance a district can weigh up and set aside.

2000

Year Congress passed it

E-Rate & LSTA

Funding streams that require it

20–90%

Discount range on the line

Form 486

Filed with the FCC each year

Protecting E-Rate Funding

Billions move through E-Rate annually in the form of 20-90% discounts on internet access. Eligibility rests on CIPA compliance, which places your filtering layer squarely in the path of the district budget.

The Technology Protection Measure

What the statute asks for is a filter that blocks visual depictions that are obscene, that constitute child pornography, or that are harmful to minors. We supply the classification data your filter reads when it decides which is which.

A Written Internet Safety Policy

Filtering alone is not the whole obligation. Districts also have to adopt and enforce an internet safety policy, monitor minors online, and teach safe online behaviour. Each of the 59 categories can be tied to a clause in that policy.

Certification Every Funding Year

Once a year, FCC Form 486 asks a school to certify CIPA compliance. Certifying something you cannot later evidence opens the door to clawbacks, so we keep the category data in a shape that stands up to review.

What the Statute Actually Requires You to Block

Three kinds of content are named in the law itself as targets for a technology protection measure, and each one lines up with a slice of our taxonomy

Obscenity

Where a visual depiction falls under the federal definition of obscenity, the block applies to all users — adults are not carved out. Coverage keeps pace as fresh domains surface.

Adult Content Nudity

Child Pornography

On every terminal and for every user, material constituting child pornography has to be blocked. No exception exists to be granted.

Adult Content Automated Detection

Harmful to Minors

On computers minors use, the standard covers material appealing to prurient interest that holds no serious literary, artistic, political, or scientific value for minors. Districts express that standard in practice by combining the categories their board-approved policy calls for.

Violence Drugs Weapons Gambling Hate/Discrimination

Few districts stop at the statutory floor. Blocks added on top typically include:

Gambling Drugs Weapons Hate Speech Anonymizers Proxy Bypass

Every one of the 59 policy building blocks is listed on the content filtering categories page.

Where the Classification Data Fits Into Your Stack

One pre-classified taxonomy of 59 categories, delivered in two forms — either one satisfies the technology protection measure CIPA requires

Live Lookup API

Any domain classified in under 10 milliseconds
Suits DNS resolvers, proxies, and cloud filtering agents
Nothing local to refresh, so answers are always current

Downloadable CSV Corpus

All 100 million classified domains in a single file
Designed for on-premises and isolated deployments
Lookups stay inside your own network

Classified Before You Ask

All 100 million domains carry a category already, so nobody waits on a manual review when a student lands somewhere unfamiliar.

Evidence You Can Show

A category assignment sits behind each blocked domain, which is what lets you show an E-Rate reviewer the scope of the filter and the reasoning under it.

Refreshed Week by Week

Around 300,000 newly registered domains pass through classification weekly, so emerging sites and threats get picked up without anyone filing a request.

Filtering decisions are left to local authorities by design under CIPA. Which categories to block is your call, and the answer can differ by building, by grade band, or by user group.

DNS-Level Enforcement for CIPA Compliance

Filtering at the resolver reaches every device on the network, managed or not, without an agent or certificate touching the endpoint

A Lookup Begins

Some device a student is holding — laptop, tablet, phone — asks for a website, either on the school network or through a cloud resolver.

The Resolver Asks Us

Rather than answering straight away, the DNS resolver hands the domain to our classification API.

An Answer Inside 10ms

Back comes the category in under 10 milliseconds, quick enough that nobody notices the round trip.

Your Policy Decides

Guided by your internet safety policy, the resolver hands back either the real IP address or a block page.

Follows Students Home

Take-home Chromebooks and personal devices resolve through a cloud DNS service
The k12 DNS filtering policy from the classroom holds at the kitchen table
Classification runs in the cloud, leaving nothing to install

Shuts Down Workarounds

Anonymizers and open proxies carry categories of their own
Freshly registered bypass domains are picked up on an ongoing basis
Precisely the gap E-Rate auditors have started testing for

Keeping E-Rate Money Where It Belongs

Run by USAC under FCC oversight, E-Rate hands out more than $4 billion each year as 20–90% discounts covering internet access, internal connections, and managed broadband

Form 470

Open the Bidding

Describes the services your school or library is after and starts the competitive bidding window.

Form 471

Request the Discount

Requests discounts against the services you chose, at a rate driven by poverty level and rurality.

Form 486

Certify Compliance

Confirms services have begun — and that you are CIPA compliant. Certify something you cannot later evidence and you invite clawbacks and audit findings.

What we hand you for Form 486

Category-level blocking rules lined up against the clauses of your internet safety policy
Coverage figures spanning the full 100 million classified domains
Documentation of update cadence, showing newly registered domains are classified continuously

Should a program integrity assurance review or audit land on your desk, nothing has to be assembled after the fact.

The Rules That Sit Alongside CIPA

Filtering is where CIPA applies, yet several other regulations shape how a district handles student internet access day to day

COPPA

Limits are placed on how online services gather personal information from children under 13. Because sites known to collect children's data are flagged in our corpus, districts can steer students toward services that play by the rules.

FERPA

Student education records fall under its protection. Since our filtering API runs without logging student browsing data, the filtering layer stays FERPA-friendly without extra effort.

State Statutes

SOPIPA in California, Education Law 2-d in New York, and SB 820 in Texas each layer on student-privacy and security requirements. A category-driven filtering model absorbs overlapping mandates without an architecture rewrite.

With the compliance base settled, our guide to age-tiered filtering across K-12 grade levels covers how to layer policy on top of it.

How Public Libraries Handle the Same Law

A library drawing E-Rate or LSTA funds has to let adults ask for filtering to be reduced for bona fide research. One on/off switch cannot serve both duties at the same time; a category-based policy can.

Terminals in the Children's Area

Every mandated block in force, all opening hours

Mandated categories blocked, alongside whatever the library adds itself
Exceptions are not granted for a session
The effective policy can be produced for E-Rate on demand

Terminals for Adult Patrons

Relaxed on request, with the legally required blocks left untouched

Staff release individual categories for a session when lawful research warrants it
The obscenity and child pornography categories are never released
Each adjustment happens inside the written internet safety policy

The same structure handles after-hours schedules, staff workstations, and public Wi-Fi running on library-funded infrastructure.

Where This Gets Deployed

The shapes CIPA compliant filtering takes across districts, single buildings, and public libraries

District-Wide Rollout

Student and staff traffic across every building runs against the CIPA-mandated categories from a single deployment. Management of the policy stays central, while individual buildings or grade bands take overrides of their own — an elementary school ends up stricter than a high school without anyone standing up separate infrastructure. Since each block decision traces back to a category assignment, the district holds a defensible compliance posture across the whole network.

One-to-One Device Programmes

Cloud API filtering on take-home hardware carries CIPA compliance past the school gate and into student homes. A district-issued Chromebook resolving a domain from a kitchen table hits the same category lookup and the same policy it would in a classroom. Families get protection that behaves the same everywhere, the district gets compliance that does not lapse at 3pm, and IT maintains a single policy rather than two.

Public Access Computing

Running separate filtering tiers in the children's section and on adult terminals answers CIPA's requirement that adults be able to request reduced filtering for lawful research. Categories get adjusted per terminal or per session by staff, while the legally mandated blocks hold everywhere regardless. E-Rate and LSTA conditions are met without over-blocking adult patrons or leaving young ones exposed.

Visitor and Guest Networks

Guest networks sit on the same E-Rate funded infrastructure, so the federal requirement reaches them too — including visitor phones and contractor laptops nobody in the district manages. Enforcement at the DNS layer catches every device that joins, with no client configuration at all, which closes a gap plenty of districts never notice until an audit points at it.

Standardized Testing Windows

When a testing window opens, browsing is narrowed to approved assessment platforms and nothing else. Category-based allowlisting turns that lockdown into a policy edit rather than an infrastructure project, and the filtering log afterwards shows CIPA compliance held throughout a high-stakes event — the sort of record that answers state testing authorities and federal reviewers alike.

100M

Classified Domains

Filtering Categories

<10ms

Typical Lookup Time

99.9%

Guaranteed Uptime

Wiring the API Into Your Filter

Bolting CIPA-ready domain classification onto filtering infrastructure you already run takes minutes

Category Lookup for CIPA Policy

Run domains against the CIPA-mandated categories and let your internet safety policy decide the outcome.

import requests

# Categories the CIPA policy denies
CIPA_BLOCKED = ["adult", "nudity", "gambling", "violence", "drugs", "weapons"]

domains = ["khanacademy.org", "tiktok.com", "gambling-site.xyz"]

for domain in domains:
    response = requests.post(
        "https://webfilteringservice.com/api/moderate.php",
        json={"api_key": "YOUR_API_KEY", "query": domain}
    )
    result = response.json()

    category = result["primary_category"]
    print(f"{domain}: {category}")

    if category in CIPA_BLOCKED:
        print("  -> BLOCKED (CIPA policy)")
    else:
        print("  -> allowed")

# khanacademy.org: education -> allowed
# tiktok.com: social_media -> allowed (district-configurable)
# gambling-site.xyz: gambling -> BLOCKED (CIPA policy)

// Real-time domain classification behind a CIPA policy
const CIPA_BLOCKED = ["adult", "nudity", "gambling", "violence", "drugs", "weapons"];
const domains = ["khanacademy.org", "tiktok.com", "gambling-site.xyz"];

async function checkDomain(domain) {
    const response = await fetch("https://webfilteringservice.com/api/moderate.php", {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({ "api_key": "YOUR_API_KEY", "query": domain })
    });
    const data = await response.json();

    const blocked = CIPA_BLOCKED.includes(data.primary_category);
    console.log(`${domain}: ${data.primary_category} ${blocked ? "-> BLOCKED (CIPA)" : "-> allowed"}`);
    return { domain, blocked };
}

Promise.all(domains.map(checkDomain));

// khanacademy.org: education -> allowed
// tiktok.com: social_media -> allowed (district-configurable)
// gambling-site.xyz: gambling -> BLOCKED (CIPA)

# Look up one domain against the CIPA policy
curl -X POST "https://webfilteringservice.com/api/moderate.php" \
  -H "Content-Type: application/json" \
  -d '{"api_key": "YOUR_API_KEY", "query": "khanacademy.org"}'

# Response:
# {
#   "primary_category": "education",
#   "categories": ["education", "reference"],
#   "risk_level": "low"
# }

# Now a domain the CIPA policy rejects
curl -X POST "https://webfilteringservice.com/api/moderate.php" \
  -H "Content-Type: application/json" \
  -d '{"api_key": "YOUR_API_KEY", "query": "gambling-site.xyz"}'

# Response:
# {
#   "primary_category": "gambling",
#   "categories": ["gambling", "adult"],
#   "risk_level": "high"    <- BLOCKED under CIPA policy
# }

// PHP integration for CIPA content filtering
function classifyDomain($domain) {
    $payload = json_encode([
        "api_key" => "YOUR_API_KEY",
        "query"   => $domain
    ]);

    $ch = curl_init("https://webfilteringservice.com/api/moderate.php");
    curl_setopt_array($ch, [
        CURLOPT_POST           => true,
        CURLOPT_POSTFIELDS     => $payload,
        CURLOPT_HTTPHEADER     => ["Content-Type: application/json"],
        CURLOPT_RETURNTRANSFER => true
    ]);
    $response = curl_exec($ch);
    curl_close($ch);

    return json_decode($response, true);
}

$cipaBlocked = ["adult", "nudity", "gambling", "violence", "drugs", "weapons"];
$domains = ["khanacademy.org", "tiktok.com", "gambling-site.xyz"];

foreach ($domains as $domain) {
    $result = classifyDomain($domain);
    $cat = $result["primary_category"];
    $status = in_array($cat, $cipaBlocked) ? "BLOCKED (CIPA)" : "allowed";
    echo "$domain: $cat -> $status\n";
}

Questions We Hear About CIPA

What districts and libraries ask us about compliance, E-Rate, and content filtering

Is your classification data sufficient for CIPA?

It is. Every content category CIPA names — obscene material, child pornography, and material harmful to minors — is covered, and another 50+ categories sit alongside them for districts that want to reach past the minimum. A school or library running our API or offline database as its classification layer meets the technology protection measure requirement, and compliance documentation is available whenever you ask for it.

What proof does E-Rate expect from us?

The certification itself happens once a year on FCC Form 486. What sits underneath it is our category data: each domain the filter blocks maps to a documented category, the policy configuration maps to your internet safety policy, and the update-frequency documentation demonstrates that newly registered domains are covered continuously. Were USAC to open a program integrity assurance review, that trail already exists.

How do CIPA and COPPA differ?

They point in opposite directions. Schools and libraries taking federal funding must filter harmful visual content under CIPA, whereas COPPA governs how online services collect personal data from children under 13 — one is about what a student can reach, the other about what a site may gather. Both are served here: filtering categories drive CIPA enforcement, and sites known to collect children's data are identified for COPPA-aware policies.

Are the rules the same for a library as for a school?

Not quite. A library has to let adult patrons request that filtering be disabled or reduced for bona fide research or other lawful purposes, an obligation schools do not carry. Category-based filtering is what makes that practical: adult terminals run a reduced policy while children's terminals stay fully filtered, and single categories can be released for a session without touching the legally required blocks.

How fast do fresh domains get categorized?

Roughly 300,000 newly registered domains go through classification each week, and a site drawing real traffic is usually categorized within hours of showing up. That cadence matters under CIPA because harmful content keeps moving onto fresh domains — a filter leaning on a static list drifts out of compliance in practice, even if it satisfied the requirement on paper the day it was installed.

Can we pick our own set of blocked categories?

You can — all 59 categories toggle independently. Because CIPA deliberately hands filtering decisions to local authorities, the pattern is to block what the statute mandates and then extend outward to match your board-approved internet safety policy: gambling, drugs, weapons, hate speech, anonymizers, or whatever else community standards call for. Nothing stops those policies differing by building, grade band, or individual terminal.

Do school-owned devices need filtering off campus?

Where the device belongs to the school and is used with E-Rate funded internet services, yes — the FCC has clarified that CIPA obligations travel with school-issued devices off campus. The cloud API is what makes that workable in practice: a filtering agent or cloud DNS on a take-home Chromebook queries the same classification data from any network, so the district policy behaves identically at home and at school.

What about personal devices students bring in?

Filtering at the DNS layer reaches personal hardware without anything being installed on it. Whenever a device on your network resolves a domain — a student phone, a visitor laptop, a contractor tablet — the resolver consults our classification and applies your policy. Traffic riding E-Rate funded infrastructure stays CIPA compliant no matter who owns the endpoint.

CIPA Web Filtering for Schools and Libraries