The EdTech COPPA Compliance Checklist: What to Verify in 2026 & 2027
The compliance date has passed. So the question facing your engineering team isn't whether you have a privacy policy. It's whether your system can show, for one specific student record, what you collected, why, who consented, and when it gets deleted.
Those are different problems. A policy is a document written once. Evidence is a query that has to return the right answer whenever a district reviewer or an FTC investigator asks.
This checklist covers what to verify in the code.
What changed in the COPPA Rule on April 22, 2026?
The amended Rule makes several material changes, including separate parental consent for certain third-party disclosures, written and publicly disclosed retention policies, expanded personal-information definitions, enhanced notice requirements, and a documented written information security program. The FTC published the final amendments on April 22, 2025. The amendments became effective June 23, 2025, and most operators had until April 22, 2026, to comply.
| Requirement | 2013 Rule | Amended Rule (in force now) |
|---|---|---|
| Third-party disclosure | Parents had to be offered an option to consent to collection and use without consenting to non-integral third-party disclosure | Separate verifiable parental consent is required for disclosure to third parties unless the disclosure is integral to the nature of the website or online service |
| Personal information | Name, contact details, persistent identifiers | Expressly covers biometric identifiers used for automated or semi-automated recognition and broadens coverage of government-issued identifiers |
| Data retention | "Reasonably necessary" standard | Written policy required, published in the online notice (§ 312.10) |
| Security program | General safeguards obligation | Written information-security program with safeguards appropriate to the sensitivity of the information, a designated coordinator, annual risk assessments, regular testing, and reasonable steps to assess covered third parties |
For non-integral third-party disclosures, parents must be able to consent to collection and use without being required to consent to disclosure. The retention policy must state the specific purposes for collecting personal information, the business need for retaining it, and a timeframe for deleting it.
Penalties run up to $53,088 per violation. The FTC's maximum penalty did not increase in 2026 because OMB instructed agencies to continue using the applicable 2025 penalty levels.
For how COPPA sits alongside FERPA, state law, and accessibility rules, see our EdTech compliance founder's guide.
Why isn't the school consent exception written into the Rule?
Because the FTC chose not to put it there. The school authorization exception lets districts consent on behalf of parents for educational use, and most EdTech companies build their entire consent model on it. It rests on FTC guidance, not on the Code of Federal Regulations.
The 2024 proposed rule would have codified it. The final rule dropped that section. The FTC's stated reason was to avoid conflicting with potential FERPA rulemaking from the Department of Education, and it confirmed it would keep enforcing COPPA in the EdTech context consistent with its existing COPPA FAQs.
The school-authorization model remains grounded in FTC guidance rather than an express provision in the current Rule. It also means the boundary is guidance-shaped rather than rule-shaped: school authorization is limited to collection and use for the school-authorized educational purpose and not for independent commercial uses. Targeted advertising and commercial profiling unrelated to providing the school-requested service fall outside that authorization.
Evaluate product-improvement uses based on the specific data flow, contract, and purpose rather than treating every product-development activity as categorically prohibited.
What is the Consent Provenance Chain?
The Consent Provenance Chain is our framework for post-deadline COPPA readiness. It is a five-part engineering-control framework designed to make compliance evidence queryable for each student account.
If any link is missing, you may have difficulty demonstrating that collection, consent, retention, and deletion practices operate as intended.
| Link | What the record must show | Where it usually breaks |
|---|---|---|
| 1. Collection Purpose | Why each field was collected, tied to a stated purpose | Fields added by feature teams without updating the purpose map |
| 2. Notice Artifact | The exact notice version the parent or school saw | Notices overwritten in place, so prior versions are unrecoverable |
| 3. Consent Record | Who consented, to what scope, when, by which method | One boolean covering core service and third-party sharing together |
| 4. Retention Clock | The deletion date derived from the collection purpose | No clock exists, so data persists until someone files a ticket |
| 5. Deletion Proof | Confirmation the record is gone, including analytics and backups | Deleted from the primary database only, still live in the warehouse |
Link 3 is often a high-risk area because a single consent flag may not show whether a parent separately authorized non-integral third-party disclosure. A single undifferentiated consent choice should not be used to obtain both consent for core collection and use and consent for non-integral third-party disclosure. The Rule requires distinct consent choices; storing the results separately is a strong engineering practice.
Link 5 is the second wave. Deleting a production record alone may not satisfy a deletion obligation if the information remains retrievable or usable in the normal course of business elsewhere. Validate deletion across analytics systems, event pipelines, warehouses, and backup/recovery processes.
The 7-point EdTech COPPA compliance checklist
- Audit every SDK, service provider, and third party on child-facing surfaces. Map each recipient of children's personal information, its role, the data received, the purpose of the transfer, and whether it qualifies as an operator, an internal-operations provider, or a third party under COPPA.
- Implement separate consent choices for core collection and use versus non-integral third-party disclosure. Maintain auditable records showing the consent scope, method, identity of the consenting party, and date. Independent storage and revocation workflows are recommended engineering controls, not expressly prescribed record formats.
- Put required disclosures inside the direct notice. Section 312.4(c)(1) specifies the content of a direct notice seeking consent; the notice must identify the information collected, intended uses, disclosure practices, and relevant third-party recipients or categories. A link to the online notice does not replace required direct-notice content.
- Write and publish the retention policy. Include the collection purpose, business need for retention, and deletion timeframe in the online notice. Do not retain children's personal information indefinitely; retain it only as long as reasonably necessary for the disclosed purpose.
- Run a biometric audit. Review features that create or use voiceprints, facial templates, gait patterns, fingerprints, iris patterns, or similar identifiers for automated or semi-automated recognition. Do not assume that raw voice or video files became newly regulated in 2025; they may already have been personal information under COPPA.
- Review dual-pathway logins. For a school-authorized educational deployment, confirm that collection and use remain within the school-authorized educational purpose. For a direct-to-family flow involving collection from a child under 13, obtain verifiable parental consent unless another COPPA exception applies.
- Document the security program. Section 312.8 requires an appropriate written information-security program, including a designated coordinator, annual risk assessments, safeguards proportionate to data sensitivity, regular testing, and reasonable steps to evaluate parties handling children's personal information.
Finding architectural gaps rather than paperwork gaps?
That's what our EdTech engineering teams are usually brought in to fix.
See Our EdTech Practice →What does the PlayOn fine tell EdTech vendors?
State regulators moved first, and they moved under state law rather than COPPA. In March 2026, the California Privacy Protection Agency fined PlayOn Sports $1.10 million and required it to change its practices. It was the agency's first decision addressing student privacy.
PlayOn's GoFan platform sells digital tickets to high school events, and roughly 1,400 California schools use it. Students had to accept tracking before they could display a ticket at the door.
Three operational lessons are relevant: a school relationship does not eliminate applicable state privacy duties; a company cannot force users to accept tracking where law requires an opt-out path; and required privacy notices must remain current.
Pointing users to third-party industry opt-out tools doesn't discharge your own obligation to provide one. PlayOn's privacy policy was not updated from July 2022 until February 2024, exceeding California's annual privacy-policy update requirement.
Frequently asked questions
Only for the school's educational purpose. Schools may authorize collection on parents' behalf under longstanding FTC guidance, which the 2025 amendments declined to codify into the Rule itself. Targeted advertising and commercial profiling unrelated to the school-authorized service fall outside school authorization. For secondary uses, including product improvement, assess the purpose, data handling, contractual commitments, and applicable federal and state laws; do not assume a district authorization covers an independent commercial use.
No. Email-Plus is available only to operators that don't disclose children's personal information to third parties, and the newer text-message method carries the same limitation. If sending children's personal information to an AI provider constitutes a 'disclosure' under COPPA, Email-Plus and Text-Plus are unavailable. Evaluate the provider's role, contract, data reuse rights, training practices, and whether it performs a permitted internal-operations function before selecting a consent method.
It depends on whose data you collect, not who logs in. COPPA generally applies when a covered operator collects personal information online from children under 13, or has actual knowledge that it is doing so. A teacher-facing workflow may still raise FERPA, state student-privacy, contract, and security obligations even when COPPA is not triggered by collection from a child. Teacher-facing does not mean student-data-free, and district procurement reviewers test that assumption directly.
No, and you shouldn't build against it. The Senate passed S. 836 by unanimous consent on March 5, 2026, extending protections to teens under 17, but the House has not passed the Senate legislation, and Congress has not enacted it. The bill is therefore not law and does not change current operator obligations. Nothing changes for operators until both chambers agree and it's signed.
Where to start
The amended Rule doesn't reward good intentions. It rewards systems that can answer questions about individual student records on demand, which isn't something your legal team can solve alone.
Work the EdTech COPPA compliance checklist above against one student account in staging, then run the Consent Provenance Chain on it. Try to produce all five records. Use one representative student account in staging to test whether the necessary consent, retention, and deletion evidence can be produced on demand. Document any gaps and assign remediation owners.
Found gaps in your implementation?
If your review identifies engineering or data-governance gaps, Hireplicity can assess implementation options for EdTech platforms that must address privacy, security, and accessibility requirements. Tell us what you found and we'll scope what it takes to close it.
Tell Us What You Found →- Federal Register, Children's Online Privacy Protection Rule, 90 FR 16977 (April 22, 2025) - https://www.federalregister.gov/documents/2025/04/22/2025-05904/childrens-online-privacy-protection-rule
- eCFR, 16 CFR § 312.10, Data retention and deletion requirements - https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-312/section-312.10
- Cornell LII, 16 CFR § 1.98, Adjustment of civil monetary penalty amounts - https://www.law.cornell.edu/cfr/text/16/1.98
- FTC, Complying with COPPA: Frequently Asked Questions - https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions
- California Privacy Protection Agency, Youth Sports Media Company to Pay $1.10 Million Fine (March 3, 2026) - https://privacy.ca.gov/2026/03/youth-sports-media-company-to-pay-1-1-million-fine-change-practices-over-privacy-violations
- Congress.gov, S. 836, Children and Teens' Online Privacy Protection Act - https://www.congress.gov/bill/119th-congress/senate-bill/836
