There is / will be no "educational exception". It is not clear whether it is possible to do anything in that direction, without violating a particular state's anti-phishing law (around half the states have them). Let me first posit a hypothetical means of doing this: put up a fake Facebook login page with boxes for name and password, where users type that data in. The data remains on the users browser and is not posted back to the phisher. In Washington, RCW 19.190.080 says
It is a violation of this chapter to solicit, request, or take any
action to induce a person to provide personally identifying
information by means of a web page, electronic mail message, or
otherwise using the internet by representing oneself, either directly
or by implication, to be another person, without the authority or
approval of such other person.
The law is broader than a prohibition against storing or receiving (and forgetting) PII, it includes asking. When a person types their PII into the boxes, they will have provide that information. They don't even have to type the information in, because setting up the web page constitutes inducing to provide that information. So don't do it in Washington, or Oregon (ORS § 646.A.808), or California.
The applicable Virginia law §18.2-152.5:1(A) is more general, not tailored to phishing. It says
It is unlawful for any person...to use a computer to obtain, access,
or record, through the use of material artifice, trickery or
deception, any identifying information, as defined in clauses (iii)
through (xiii) of subsection C of § 18.2-186.3.
Under the hypothetical scenario, you will not have recorded, and probably will not have obtained or accessed. Their law does not define "access" or "obtain". If prosecuted in Virginia, you may be able to defend yourself based on a interpretation of those terms, but that is a risk, and you should absolutely hire a cyberlaw attorney knowledgeable about Virginia.