COPPA
COPPA — the Children's Online Privacy Protection Act, implemented by the Federal Trade Commission's rule at 16 CFR Part 312 — requires operators of online services directed to children under 13, or that knowingly collect data from them, to obtain verifiable parental consent before collecting personal information.
| COPPA | FERPA | SOPIPA-style state law | |
|---|---|---|---|
| Who is regulated | The operator of the online service | The educational agency | The operator, directly |
| Whose data | Children under 13 | Students of any age, in education records | K-12 students, covered information |
| What triggers it | Online collection from a child | Receipt of federal education funds | Service designed and marketed for K-12 use |
| Consent model | Verifiable parental consent, or school authorisation in the school context | Written consent, or a listed exception | No consent model — conduct is simply prohibited |
| Enforced by | FTC, and state attorneys general | US Department of Education, funding sanction only | State attorney general |
| Private right of action | No | No | Generally no |
The school authorisation question
The point districts care about is whether a school can consent on parents' behalf so that an ed-tech service can be deployed without collecting thousands of individual consents. The FTC has long taken the position that it can, in the school context, and the Commission's 2025 amendments to the COPPA Rule wrote a school-authorisation pathway into the rule text itself with a compliance date in 2026. Check the current rule rather than a 2019 summary, because this is the part that changed.
The conditions have been consistent in substance. School authorisation covers collection and use for a school-authorised educational purpose only. It does not extend to commercial purposes — advertising, building a marketing profile, or using the data to sell something to the family. And the operator must not condition participation on collecting more than is reasonably necessary.
That commercial-use condition is where the analysis usually breaks, and it is worth being blunt about the shape of the market. A platform that gives its product to districts for nothing and earns its revenue from a family subscription is monetising an audience the school delivered. Whether that survives the school-authorisation analysis is a question for district counsel, but it is the question, and it is not the one the vendor's privacy page answers.
What it means for a school-home messaging platform
Most school-home communication is adult-to-adult. The COPPA surface is therefore small, but it is not zero, and it is worth mapping deliberately:
- Does any product surface accept input from a student under 13? A student login, a reply field, a reaction, a profile photo.
- Does the platform collect persistent identifiers from a child's device? Cookies and device IDs are personal information under the rule.
- Is there advertising anywhere in the family experience? Including a house ad for the vendor's own paid tier.
- Does any student-derived data leave for a non-educational purpose? Analytics, model training, enrichment.
Kastr's answer, for the record. Families use the platform as guardians, and there is no student account, no student-facing app and no advertising surface anywhere in the product. Contract clause 9.4 prohibits us from marketing or selling to district families and prohibits family-facing subscription revenue for the life of the agreement, so the commercial-use condition is answered by a clause you can read rather than by a policy we could rewrite.
Common misreadings
"Our students are 14, so COPPA does not apply." Correct as to COPPA, which stops at 13. It says nothing about state student-privacy laws, most of which apply through grade 12, or about FERPA, which has no age floor.
"COPPA is a school obligation." It is an operator obligation. A school's role is to authorise, and to satisfy itself that the operator's practices fit within what it is authorising. The school is not the regulated party, but it is the party that has to explain the decision to parents.
"Parental consent forms cover it." Verifiable parental consent has specific methods under the rule, and a form in a first-week packet may or may not meet them. Where school authorisation is available it is usually the cleaner path.
"COPPA compliance is a certificate." There is no COPPA certification, though FTC-approved safe harbour programmes exist and a vendor may participate in one. Participation is a fact you can verify; "COPPA compliant" on a footer is not.
This entry describes what the rule says. Whether and how it applies to your district is a question for your own counsel, not for a vendor.
Questions people actually ask
Can a school consent to data collection on behalf of parents?
In the school context the FTC has permitted it, and the 2025 amendments to the COPPA Rule set out a school-authorisation pathway explicitly. The authorisation covers school-authorised educational purposes only and does not extend to commercial use of the data.
Does COPPA apply if only parents use the app?
If the service collects no personal information from children under 13 and is not directed to them, COPPA has little to reach. The analysis still needs doing, because persistent identifiers collected from a child's device count as personal information even where the account belongs to an adult.
What is the difference between COPPA and FERPA?
COPPA regulates the operator of an online service and concerns children under 13. FERPA regulates the educational agency and concerns education records for students of any age. A district may need both analyses for the same product, and they reach different parties with different remedies.
Does COPPA cover students over 13?
No. Above 13 the relevant protections are FERPA and state student-data-privacy statutes, many of which apply through grade 12 and are stricter than COPPA on advertising and profiling.
One price. Every feature. Locked for three years.
$3.50 per student per year under 5,000 students. No tiers, no add-on modules, no per-message fees. Published on the site because you should not have to book a call to learn a price.