COPPA and PPRA

The Children's Online Privacy Protection Act and the Federal Trade Commission's COPPA Rule (16 CFR Part 312) apply to operators of websites, apps and online services that are directed to children under 13, or that have actual knowledge they are collecting personal information from a child under 13. Before collecting that information, the operator must give clear notice and obtain verifiable parental consent, subject to a few narrow exceptions. Parents can review and delete their child's information, and operators must keep it secure and retain it only as long as necessary. The FTC enforces COPPA and can seek civil penalties for each violation.

Unlike FERPA, COPPA applies directly to the company. An edtech vendor whose product is used by elementary students is an operator under COPPA in its own right, whatever its contract with the school says.

Getting individual parental consent for every classroom tool would be impractical, so the FTC's long-standing guidance lets a school act as the parent's agent and consent on their behalf in one specific situation: when the operator collects the child's information solely for the use and benefit of the school, and for no other commercial purpose.

The boundary is commercial use. If a vendor uses information collected from students under school consent to build marketing profiles, to target advertising, or to improve unrelated products, school consent does not cover it and the vendor needs parental consent instead. The school should also be told what information is collected and how it is used, and should be able to review and delete it.

The FTC considered writing this school authorization approach into the rule during its 2025 amendments but chose not to codify it, so the agency's existing guidance remains the reference. That is a good reason to check the FTC's current COPPA FAQ before relying on school consent for a new feature.

The FTC published amendments to the COPPA Rule in the Federal Register on April 22, 2025. They took effect on June 23, 2025, and most operators had until April 22, 2026 to comply, so the amended rule is now fully in force.

The changes that matter most for edtech are these. Operators need separate verifiable parental consent before disclosing children's information to third parties, for example for targeted advertising, unless the disclosure is integral to the service. Operators must have a written information security program and a written data retention policy that sets how long children's information is kept and why, rather than keeping it indefinitely. The definition of personal information was expanded, including to biometric identifiers. Notice requirements were also tightened, including more detail about third parties that receive data.

For an AI feature this means asking two extra questions. Is any child's information going to a third party such as a model provider, and if so, is that disclosure integral to the service the school requested? And does the retention policy cover prompts, outputs and logs, not just the main database?

The Protection of Pupil Rights Amendment (20 U.S.C. 1232h, regulations at 34 CFR Part 98) protects students from intrusive surveys. It applies to programs funded by the Department of Education. When a survey, analysis or evaluation funded by the Department asks students about any of eight protected areas, the school must get prior written consent from parents of minor students.

The eight protected areas are political affiliations or beliefs of the student or parent; mental or psychological problems of the student or family; sex behavior or attitudes; illegal, anti-social, self-incriminating or demeaning behavior; critical appraisals of close family members; legally recognized privileged relationships such as with lawyers, doctors or ministers; religious practices, affiliations or beliefs of the student or parent; and income, other than what is required to determine eligibility for a program.

PPRA also requires districts to adopt policies, in consultation with parents, and to notify parents and offer an opt-out for surveys on these topics even when they are not Department-funded, as well as for the collection of student personal information for marketing.

Income is a protected area. A needs assessment that asks students about household income, housing stability, food security or a parent's job status can trigger PPRA, depending on how it is funded and administered. That is exactly the kind of question community partners working on poverty want answered.

The practical pattern is to collect income and benefits information from parents or adults rather than from students where you can, to use program eligibility processes that already have consent built in, and to involve the district early so its PPRA notice and opt-out cover the survey. Module 6 picks this up from the nonprofit side.