COPPA and School Consent: When Can a District Approve an App for Students Under 13?

A teacher wants to use a new app with her fifth-grade class. The app looks useful, supports the curriculum and may already be popular with other educators. But it also requires students to create accounts and collects information about them. Now the request lands with the district technology or privacy team, and the real questions begin: Can the district approve it? Can the school provide consent on behalf of parents? Does the vendor need to obtain parental consent directly?

These are common questions in K-12 app vetting, and they are not always easy to answer by looking at a vendor's privacy policy. The Children's Online Privacy Protection Act, or COPPA, generally requires covered online services to provide notice and obtain verifiable parental consent before collecting personal information online from children under 13. At the same time, COPPA recognizes that schools may act on behalf of parents in certain educational settings.

The important part is understanding when that school consent is appropriate and when it is not. A district should not assume that every educational app can rely on school consent simply because a teacher wants to use it in the classroom. The decision depends on what information the vendor collects, why it collects it, how that information is used and shared, and whether those practices remain within the educational purpose authorized by the school.

Can Schools Provide Consent Under COPPA?

Yes. The Federal Trade Commission's COPPA guidance recognizes that schools may act as a parent's agent and provide consent for the collection of children's personal information when an online service is being used for the benefit of the school and its students.

However, that authority is limited to the educational context. The FTC explains that an operator may rely on school consent when the operator is collecting personal information from students for the use and benefit of the school and for no other commercial purpose.

That distinction is critical for school districts. A math application that collects information needed to create student accounts, deliver assignments and report progress back to a teacher may present a very different COPPA situation than an application that collects the same information but also uses it for targeted advertising, profiling or unrelated commercial activity.

The fact that both products call themselves educational does not answer the question. The vendor's actual data practices do.

When Can a School Consent on Behalf of a Parent Under COPPA?

A school may generally provide consent on behalf of parents when the collection of children's personal information is directly connected to a school-authorized educational purpose. In practical terms, the vendor should be collecting and using student information to provide the service the school requested, rather than using that information for unrelated commercial purposes.

This means district leaders should focus less on whether the vendor simply mentions COPPA and more on what the vendor is actually doing with student information. A privacy policy that says the company complies with COPPA may be useful, but it does not automatically tell a district whether school consent is appropriate for that particular product and use case.

The district still needs to understand the purpose of the data collection. Is the information being used to deliver the educational service? Is it being used to personalize instruction? Is it being used to provide reports back to teachers or administrators? Or is the company also using the information to build commercial profiles, support advertising or provide unrelated services?

Those distinctions matter because school consent is tied to the educational relationship.

When Is School Consent Not Enough?

School consent becomes more problematic when student information moves outside the educational purpose authorized by the district. If a vendor intends to use or disclose children's personal information for its own commercial purposes, the district should not assume that its consent can cover those uses.

For the EdTech buyer, this means the privacy review needs to go beyond determining whether personal information is collected. The district also needs to understand how that information moves through the vendor's ecosystem and whether it is being used for purposes beyond the service the school requested.

Advertising, commercial profiling, secondary uses, and undisclosed third-party sharing are warning signs. Districts should obtain clear answers about the purpose of collection and any disclosures before relying on school consent. The practical evaluation checklist below covers the questions to ask.

Does COPPA School Consent Replace a Data Privacy Agreement?

No. COPPA school consent and state student privacy laws address different obligations. COPPA may allow a school to authorize certain collection and use of children’s personal information for an educational purpose when the applicable conditions are satisfied. But some states separately require a written agreement with an EdTech vendor containing specific student privacy protections.

COPPA school consent does not override state law or eliminate a Data Privacy Agreement (DPA) when one is legally required. The fact that a vendor says it is “COPPA compliant,” or that a district may provide COPPA school consent, does not by itself satisfy applicable state contracting requirements.

Before approving a resource, districts should assess both whether school authorization is appropriate under COPPA and whether state law, FERPA, or district policy requires additional agreements or contractual safeguards. Requirements vary by jurisdiction and by how the product uses student information.

"COPPA Compliant" Is Not Enough to Approve an App

One of the most common problems in EdTech vetting is relying too heavily on a vendor's statement that it is "COPPA compliant."

That statement can be helpful, but it should not be treated as a universal approval. COPPA is not a certification that automatically makes an application appropriate for every school, every student population or every classroom use.

A district still needs to understand what the vendor collects, how that information is used, who receives it, how long it is retained and whether it can be deleted. The district should also review whether the vendor's privacy policy, terms of service and contractual commitments are consistent with one another.

In other words, the question is not simply whether the vendor says it complies with COPPA. The more useful question is whether the vendor's actual practices allow the district to approve the technology for the intended student use.

COPPA Compliance Is the Vendor's Responsibility, but Districts Still Have an Important Role

Another important distinction is that COPPA compliance remains the responsibility of the covered operator. A vendor cannot simply transfer its COPPA obligations to the school through a contract or terms of service.

That does not mean school districts have no responsibility in the process. When a vendor asks the school to provide consent on behalf of parents, the district is being asked to authorize the collection of children's personal information within an educational relationship.

That makes the district's technology approval process especially important. Teachers should be able to identify and request tools that support instruction, but they should not be expected to interpret complex privacy policies, data-processing terms and legal requirements on their own.

The district needs a consistent review process that gives teachers access to useful technology while ensuring that privacy decisions are made by the appropriate staff.

What Notice and Control Should Schools Expect?

According to the FTC’s COPPA Frequently Asked Questions, an operator relying on school authorization should give the school direct notice of its practices for collecting, using, and disclosing children’s personal information, comparable to the notice otherwise provided to parents. On request, the operator should describe the types of information collected, allow the school to review children’s information and have it deleted, and allow the school to prevent further use or online collection. If a provider cannot support the required controls, the district should not assume school consent is sufficient.

The FTC also recommends that schools consider making relevant notices available to parents and consider whether parents can review information collected about their children. Districts should document the authorization and confirm that the vendor’s commitments match the intended classroom use.

What Should Schools Review Before Approving an App Under COPPA?

When evaluating an application for students under 13, districts should look at the entire data lifecycle rather than focusing only on account creation.

The review should examine what information is collected, why it is needed, how it is used, whether it is shared, how long it is retained and whether the district can request deletion. Districts should also look for advertising technologies, tracking tools, analytics services and other third-party integrations that may affect how student information is handled.

A strong review process should help answer a few core questions:

• What personal information does the vendor collect from students?
• Why does the vendor need that information?
• Is the information used only for the educational service?
• Is it shared with third parties, and for what purpose?
• Does the vendor use advertising or tracking technologies?
• Can the district review or delete student information?
• How long does the vendor retain the information?
• What happens when the service is no longer used?

If the answers are unclear, inconsistent or spread across multiple policies, the district may need additional information before approving the application.

Age Matters, but It Is Not the Entire Privacy Review

COPPA focuses on children under 13, so the age of the intended users is an obvious starting point. However, districts should be careful about treating age as the entire privacy analysis.

An application used only by high school students may fall outside COPPA's child-specific consent requirements, but that does not mean the district can skip a privacy review. FERPA, state student privacy laws, district policies and contractual requirements may still apply.

Likewise, a product that is marketed to a broad audience may still create COPPA concerns if it collects personal information from children under 13.

The better approach is to identify the intended student population and then evaluate the technology against all applicable privacy requirements. COPPA is one part of the decision, not the entire decision.

What Counts as Personal Information Under COPPA?

Another common mistake is assuming that COPPA only applies to obvious information such as a student's name or email address.

COPPA's definition of personal information extends beyond those traditional identifiers. Depending on the circumstances, it can include usernames, contact information, persistent identifiers used to recognize users over time, photographs, video, audio containing a child's image or voice, certain geolocation information, government-issued identifiers, and biometric identifiers used for automated or semi-automated recognition.

Districts should therefore avoid limiting their review to the information students actively type into an application. An EdTech product may collect information through accounts, devices, cookies, analytics tools, embedded technologies or other functionality operating in the background.

Understanding the full scope of that collection is an important part of determining whether an application is appropriate for students.

The 2025 COPPA Amendments Did Not Create a New School-Consent Exception

In 2025, the FTC finalized changes to the COPPA Rule addressing issues such as third-party disclosures, data retention, and the definition of personal information, including certain biometric and government-issued identifiers. See the FTC’s announcement of the final amendments.

Importantly, the FTC did not finalize its proposed new school-authorization provisions. Rather than creating a new codified school-consent exception in those amendments, the agency said it would continue applying its existing guidance for educational technology and school consent. Districts should therefore continue evaluating whether the vendor’s actual collection and use of student information are limited to the school-authorized educational purpose.

That means the same core questions remain relevant: What information is being collected? Why is it being collected? How is it used? Who receives it? Can it be deleted? Is it being used for anything beyond the educational service?

Those questions continue to form the foundation of a strong COPPA review.

A Privacy Policy Alone Does Not Always Answer the Question

One of the biggest challenges for school districts is that the information needed to make a decision is rarely contained in a single document.

Relevant information may be spread across the vendor's privacy policy, terms of service, children's privacy notice, cookie policy, product-specific terms, data-processing agreement and security documentation. A general consumer privacy policy may also apply to multiple products, even though only one of those products is being considered by the district.

This makes the review more complicated than simply searching for the word "COPPA."

The district needs to reconcile all of those disclosures and turn them into an actionable decision. In the end, the technology buyer needs to know whether the resource can be approved, whether additional conditions should apply, whether parental consent is required or whether the application should not be used with students.

That is the real problem a strong EdTech vetting process needs to solve.

Schools Also Need to Consider FERPA

COPPA does not operate in isolation.

If an EdTech application receives personally identifiable information from student education records, FERPA may also apply. A vendor may need to satisfy the requirements associated with the FERPA school official exception or another authorized basis for disclosure.

That means a single application can create multiple privacy questions at once. COPPA may affect whether the school can authorize the collection of information from students under 13, while FERPA may affect how education-record information can be disclosed to and used by the vendor. State student privacy laws may add additional obligations.

For the EdTech buyer, these issues should be reviewed together rather than treated as separate compliance exercises.

The Goal Is Not to Say No to Technology

School districts are being asked to evaluate more technology than ever. Teachers find new applications, curriculum teams introduce instructional platforms, vendors add AI features, and products that were approved last year may change their privacy practices or functionality.

A privacy program that takes months to evaluate every application is difficult to sustain. At the same time, approving technology without understanding how student information is handled creates real risk for the district.

The goal is not to prevent teachers from using technology. The goal is to give the district enough information to make a confident and defensible decision.

In many cases, that decision will be yes. In other cases, the district may approve the application with conditions or restrictions. Sometimes the right answer will be no.

The important thing is that the decision is based on the vendor's actual practices.

How EdPrivacy Helps Districts Evaluate COPPA Risk

EdPrivacy was built to help school districts make these decisions without requiring administrators to manually interpret every privacy policy and legal document from scratch.

EdPrivacy reviews EdTech resources for student data privacy concerns and helps districts identify the information they need to make approval decisions. District teams can evaluate data collection, age restrictions, advertising, third-party sharing, retention and deletion practices, consent requirements and other issues that may affect whether a product is appropriate for students.

The review then connects directly to the district's technology approval workflow. Teachers can request applications, administrators can review privacy findings, districts can approve or deny resources, establish conditions for use, manage agreements and DPAs, and communicate those decisions back to staff.

Instead of treating COPPA compliance as a separate legal exercise, EdPrivacy helps districts incorporate privacy review into the technology approval process they are already managing.

A Better Question to Ask About Every App

When a teacher asks to use an application with students under 13, the question should not simply be, "Is this app COPPA compliant?"

A better question is:

Do this vendor's actual data practices allow our district to approve this application for the way our students will use it?

That question moves the district beyond compliance claims and toward the information that actually matters. It focuses the review on what data is collected, why it is collected, how it is used and shared, whether it can be deleted and whether the school is in a position to authorize that collection.

COPPA gives schools an important role in making those decisions. EdPrivacy helps districts make them consistently, document them clearly, and communicate them across the organization.

See How EdPrivacy Supports School Consent Decisions

Not sure whether your district can authorize an EdTech application for students under 13? EdPrivacy helps you examine vendor data practices, flag privacy concerns, and document approval decisions.

Start your free EdPrivacy trial and review an application your district uses. No credit card required.