COPPA
COPPA (Children's Online Privacy Protection Act) is a federal law governing the collection of personal information from children under 13, critical for EdTech vendors serving elementary schools.
What Is COPPA?
COPPA (the Children's Online Privacy Protection Act) is a federal law that regulates the collection, use, and disclosure of personal information from children under 13. It is enforced by the Federal Trade Commission (FTC) and carries significant penalties for violations.
For EdTech vendors whose products are used by K-12 students in elementary and middle school, COPPA compliance is mandatory. While FERPA governs student education records at the institutional level, COPPA adds protections specific to children's online activity.
What COPPA Requires
- Verifiable parental consent before collecting personal information from children under 13
- Clear privacy notice describing what data is collected and how it is used
- Parental access to review and delete their child's information
- Data minimization collecting only what is necessary for the service
- Data security protecting collected information with reasonable measures
- No behavioral advertising targeted at children based on collected data
COPPA in the School Context
In practice, schools can provide consent on behalf of parents when the vendor's service is used for an educational purpose. This is the "school consent" provision that enables EdTech vendors to collect student data without individually contacting each parent. However:
- The school must agree that the data will be used solely for educational purposes
- The vendor cannot use the data for commercial purposes outside the school context
- A Data Privacy Agreement should document this consent
COPPA vs. FERPA
| Factor | COPPA | FERPA |
|---|---|---|
| Enforced by | FTC | Department of Education |
| Applies to | Online services collecting data from children under 13 | Educational institutions receiving federal funds |
| Consent | Parental consent (school can provide in educational context) | School official exception with DPA |
| Penalties | FTC fines up to $50,120 per violation | Loss of federal funding |
| Focus | Online data collection from children | Education records privacy |
COPPA Compliance for EdTech Vendors
- Know your audience. If any users are under 13, COPPA applies to your product.
- Get school consent documented. Work with districts to establish that the school is providing consent for educational use of your product.
- No ads, no tracking. Do not serve behavioral advertising or use third-party tracking on products used by children.
- Have a COPPA-compliant privacy policy. Clearly describe what data you collect from children and how it is used.
- Prepare for FTC scrutiny. The FTC actively enforces COPPA against EdTech companies. Several high-profile enforcement actions have resulted in millions in fines.
Frequently Asked Questions
What is COPPA?
COPPA is the Children's Online Privacy Protection Act, a federal law that regulates the collection of personal information from children under 13 online. It is enforced by the FTC with penalties up to $50,120 per violation.
How does COPPA apply to EdTech vendors?
Any EdTech product used by students under 13 must comply with COPPA. Schools can provide consent on behalf of parents when the product is used for educational purposes, but the vendor cannot use data for commercial purposes.
What is the difference between COPPA and FERPA?
COPPA is enforced by the FTC and focuses on online data collection from children under 13. FERPA is enforced by the Department of Education and protects student education records at any age. EdTech vendors serving elementary schools must comply with both.
Can schools provide COPPA consent for parents?
Yes, in the educational context. Schools can consent on behalf of parents when the vendor's service is used solely for educational purposes and data is not used commercially.
What are the penalties for COPPA violations?
The FTC can impose fines up to $50,120 per violation. Several EdTech companies have faced multi-million dollar settlements for COPPA violations. The FTC actively monitors and enforces COPPA in the education technology space.