Children and Students

Children and students get more legal protection for their data than adults do, and less than most parents assume. Two federal laws do the heavy lifting: the Children's Online Privacy Protection Act for the commercial internet, and the Family Educational Rights and Privacy Act for schools. They were written 24 years apart for different problems, and a child's data often falls between them. A math app the teacher picked, a district's camera system, a teen's social media account: each lands under a different rule or none. This lesson takes each law in turn, then the newer state laws and the court rulings that decide how far states can go.

COPPA: who it covers

COPPA applies to an operator: a person who runs a commercial website or online service and collects or keeps personal information from its users. 15 U.S.C. 6501 leaves out nonprofits that are outside the FTC Act's reach, so most charities and public schools are not operators. A child is "an individual under the age of 13." Under 6502(a)(1), the law reaches two kinds of operators:

• Operators of a website or service directed to children, judged under 16 CFR 312.2 by factors such as subject matter, visual content, animated characters, music, the ages of models, child-appealing celebrities, ads on the site, and evidence of the actual audience such as marketing materials and user reviews.
• Any operator, including a general-audience one, that has actual knowledge it is collecting personal information from a child. A birthdate field showing age 9, a parent's email, or a support ticket from a child can create actual knowledge.

The 2025 rule adds a stand-alone definition of a mixed audience service: one that is directed to children but does not target them as its main audience. Such a service may screen users by age, without collecting personal information first, and apply COPPA's rules only to users who say they are under 13.

What counts as personal information

The current rule at 16 CFR 312.2 lists names, home addresses, online contact information, screen names that work as contact information, phone numbers, Social Security numbers, photos, videos and audio files with a child's image or voice, geolocation precise enough to find a street and city, and persistent identifiers that "can be used to recognize a user over time and across different websites or online services," such as cookies, IP addresses and device serial numbers. The 2025 amendments added biometric identifiers (fingerprints, voiceprints, faceprints and similar) and government-issued identifiers such as passport numbers. The FTC dropped a proposal to cover data merely derived from voice, gait or facial data.

Persistent identifiers are the reason COPPA matters for advertising. The rule lets an operator use them without consent only for "support for the internal operations" of the service, such as keeping a user logged in or limiting how often an ad repeats. Using them to build a profile or target ads at a child requires consent. Under the 2025 rule, an operator that collects persistent identifiers under that exception must say in its online notice which internal operations it uses them for and how it keeps them from being used for profiling or behavioral ads (312.4(d)(3)).

Notice and verifiable parental consent

Before collecting, an operator must post a clear online notice, send a direct notice to the parent, and obtain verifiable parental consent, defined in the statute as "any reasonable effort (taking into consideration available technology)" to make sure the parent learns of the practices and authorizes them first. The rule at 312.5(b)(2) lists accepted methods:

• a signed consent form returned by mail, fax or scan;
• a payment card transaction that notifies the account holder;
• a call to a staffed toll-free number or a video conference with trained staff;
• checking a government ID against a database, then deleting the ID;
• knowledge-based authentication with questions hard enough that a child could not answer them;
• matching a government photo ID to the parent's face with facial recognition, then deleting the images;
• for operators that do not disclose children's data, the "email plus" method or the new "text plus" method, which use a message plus a confirming step.

Parents keep rights after consent: to review what was collected, to delete it, and to refuse further use. Under 6502(b)(1)(C), an operator may not make a child's participation in a game or contest depend on handing over more personal information "than is reasonably necessary."

The 2025 amendments

The FTC's final rule was published April 22, 2025, took effect June 23, 2025, and set a compliance date of April 22, 2026 for most changes. As of October 2026 that date has passed. The main changes:

• Separate consent for third-party disclosure. Under amended 312.5(a)(2), if disclosure to third parties is not integral to the service, the operator must let parents consent to collection without consenting to disclosure, and must get separate verifiable consent for the disclosure. Sharing a child's data with an ad network is the main target.
• Data retention. 312.10 now says children's personal information "may not be retained indefinitely." Operators need a written retention policy stating why they collect, why they keep it, and when they delete it, and must post it in the online notice.
• Security program. 312.8 requires a written information security program, one or more employees to run it, an annual risk assessment, safeguards matched to the risks, regular testing, and an annual review.
• New identifiers and consent methods, as described above, including mobile numbers as contact information when used to text a parent for consent.
• Safe harbor programs, the industry self-regulatory groups approved under the law, must publicly list their members and update the list every six months, file an annual report with the FTC, and file a report every three years starting April 22, 2028 (312.11).

Two proposals did not make it. The FTC declined to finalize rules letting schools authorize ed tech data collection in place of parents, saying it wanted to avoid conflicts with possible FERPA changes. And it dropped a ban on using persistent identifiers to prompt children to keep using a service.

On February 25, 2026 the FTC added a policy statement on age verification. It said the agency will not bring a COPPA case against a general or mixed audience operator that collects personal information solely to verify age, without parental consent, if the operator uses the data only for that purpose, deletes it promptly, shares it only with vetted vendors under written assurances, gives notice, secures it, and uses a method likely to be accurate. The Commission also said it would open a new COPPA review on age verification.

Enforcement and penalties

A COPPA rule violation is treated as a violation of an FTC rule against unfair or deceptive practices (6502(c)). That matters because rule violations carry civil penalties from the first offense, unlike most Section 5 cases. The maximum is $53,088 per violation under 16 CFR 1.98, the January 17, 2025 adjustment, and each child can be a separate violation. State attorneys general may also sue in federal court under 6504 for injunctions and money for residents, after giving the FTC written notice. There is no private right of action under COPPA itself.

Case	Year	What the FTC alleged	Amount
Google and YouTube	2019	Collected persistent identifiers from viewers of child-directed channels without parental consent and used them for targeted ads, while telling an ad company it had no users under 13	$170 million ($136 million to the FTC, $34 million to New York)
Epic Games (Fortnite)	2022	Collected children's data without consent and turned on live voice and text chat by default, matching children and teens with strangers	$275 million penalty, which the FTC called the largest ever obtained for violating an FTC rule, plus $245 million in refunds over billing practices
Cognosphere, doing business as HoYoverse (Genshin Impact)	2025	Knew children under 13 played, collected their data without parental notice or consent, and shared device and user IDs with analytics and ad firms; also deceptive loot box practices	$20 million; ban on selling loot boxes to teens under 16 without parental consent
Disney	2025	Labeled YouTube videos at the channel level, so kid-directed videos defaulted to "Not Made for Kids" and YouTube collected viewing data for targeted ads; kept the practice after YouTube flagged more than 300 videos in 2020	$10 million; video review program that can end if YouTube adopts age assurance

The Disney case shows how the YouTube settlement rippled outward. After 2019, YouTube required channel owners to label content made for kids. The FTC's theory in 2025 was that the content owner, by mislabeling, enabled the collection. Any company that posts children's content on a platform now owns part of the COPPA risk.

FERPA: student records

FERPA applies to every school, district and college that receives funds from a Department of Education program, which is nearly all public schools and most private colleges. It protects education records, defined in 20 U.S.C. 1232g(a)(4)(A) as records that "contain information directly related to a student" and are kept by the school or someone acting for it. The regulations at 34 CFR Part 99 exclude a teacher's private notes kept in sole possession, records of a campus law enforcement unit, employment records of students who work for the school in jobs not tied to being a student, treatment records of adult students, records made after a student leaves, and peer-graded papers before a teacher records the grade. How FERPA records relate to HIPAA's protected health information is covered in lesson 01.

The rights

• Inspect and review. The school must provide access "in no case more than forty-five days after the request." It may charge for copies but not for finding the records.
• Seek amendment. A parent or eligible student may ask the school to correct records that are inaccurate, misleading or in violation of privacy rights, and is entitled to a hearing if the school says no. If the hearing goes against them, they may put a statement in the record. FERPA does not let you challenge a grade as unfair, only whether it was recorded correctly.
• Consent before disclosure. Most disclosures need signed, dated written consent naming the records, the purpose and the recipient.
• Annual notice. Schools must tell parents and eligible students about these rights every year (34 CFR 99.7).

The rights belong to parents until the student turns 18 or enrolls in a postsecondary school at any age. Then they become the student's, and the student is an eligible student (1232g(d)). A college may still share with parents who claim the student as a dependent under section 152 of the Internal Revenue Code (34 CFR 99.31(a)(8)), and in health or safety emergencies.

Disclosure without consent

The exceptions in 1232g(b) and 34 CFR 99.31 are where most real disputes arise.

• School officials with a legitimate educational interest. This covers teachers and staff, and also contractors and ed tech vendors if they perform a function the school would otherwise do, are under the school's direct control for the use of the records, and use the data only for that purpose. A district that hands student data to an app under a click-through agreement it never read is relying on this exception, sometimes shakily.
• Directory information. Name, address, phone listing, date and place of birth, major, dates of attendance, degrees and awards, and the most recent prior school, among others, may be released if the school has given public notice and a chance to opt out (99.37). A Social Security number can never be directory information.
• Other schools where the student seeks to enroll.
• Health or safety emergencies, to "appropriate persons" when needed to protect the student or others.
• Subpoenas and court orders, with advance notice to the family when possible; a grand jury subpoena can come with a court order not to disclose it.
• Studies, audits and evaluations under written agreements, financial aid, accrediting bodies, and the juvenile justice system as state law allows.

Schools must log most disclosures (99.32), and recipients generally may not pass records on (99.33). A third party that rediscloses improperly can be barred from the school's records for at least five years.

Enforcement: no lawsuits

FERPA is a funding condition. In Gonzaga University v. Doe (June 20, 2002), a former education student won about $1.155 million from a jury after a university official told a state certification agency about an unproven allegation against him. The Supreme Court reversed, holding in an opinion by Chief Justice Rehnquist that FERPA's nondisclosure provisions create no personal rights enforceable under 42 U.S.C. 1983. So the only enforcer is the Department of Education. Its regulations name the Office of the Chief Privacy Officer, and complaints go to its Student Privacy Policy Office. Complaints must be filed within 180 days of the violation, or of when you knew or should have known of it (99.64). If a school will not comply voluntarily, the Secretary may withhold payments, seek a cease and desist order or end the school's eligibility for funds (99.67). That last step would cut off money for the very students the law protects, so the office's everyday tools are written findings and required corrective steps.

The PPRA: surveys and marketing

The Protection of Pupil Rights Amendment, 20 U.S.C. 1232h, covers what schools ask students. In federally funded programs, a minor student may not be required to take a survey that reveals information about any of eight protected areas without prior written parental consent: political affiliations or beliefs; mental or psychological problems; sex behavior or attitudes; illegal, antisocial, self-incriminating or demeaning behavior; critical appraisals of close family members; legally privileged relationships such as with lawyers, doctors and ministers; religious practices or beliefs; and income, except to determine program eligibility. Districts must adopt policies with parents, notify them each year, and let them opt a student out of surveys on those topics, certain non-emergency invasive physical exams, and the collection of student data for marketing or sale. Parents may inspect surveys and instructional materials. Rights pass to the student at 18 or emancipation. The PPRA is enforced by the same office as FERPA, and for PPRA complaints the office expects you to contact the school first.

State student privacy laws

FERPA binds schools, not the companies that sell to them, unless a contract passes the duties along. States filled that gap with laws aimed directly at ed tech vendors. The model is California's Student Online Personal Information Protection Act, Business and Professions Code 22584, known as SOPIPA. It applies to an operator of a website, service or app that knows its product is used primarily for K-12 school purposes and was designed and marketed for them. Such an operator may not knowingly:

• target advertising to students using information gained through its service;
• build a profile of a student except for K-12 purposes;
• sell a student's information (a merger is allowed if the buyer stays bound);
• disclose covered information except for listed purposes such as school purposes, legal compliance, safety and contracted service providers.

It must keep reasonable security and delete a student's information when the school asks. Many states have since passed similar vendor laws, and the count changes most sessions, so check your state's code. Idaho's Student Data Accessibility, Transparency and Accountability Act, Idaho Code 33-133, is covered in lesson 10, Idaho Privacy Law Up Close.

Law	Covers	Who it binds	Rights	Enforcer	Penalties
COPPA, 15 U.S.C. 6501 to 6506; 16 CFR 312	Personal information from children under 13 online	Commercial operators directed to children or with actual knowledge	Parental notice, consent, review, deletion, refusal of further use	FTC; state AGs	Up to $53,088 per violation; no private suit
FERPA, 20 U.S.C. 1232g; 34 CFR 99	Education records	Schools and colleges receiving Education Department funds	Inspect within 45 days, seek amendment, consent before most disclosures, opt out of directory information	Student Privacy Policy Office	Loss of federal funds; no private suit (Gonzaga)
PPRA, 20 U.S.C. 1232h	Surveys on 8 protected topics, marketing data, invasive exams	Schools in federally funded programs	Consent or opt-out, inspection of surveys	Student Privacy Policy Office	Funding termination after failed voluntary compliance
SOPIPA, Cal. Bus. and Prof. Code 22584 (and similar state laws)	Student data held by K-12 ed tech operators	Operators with actual knowledge of K-12 use	Deletion at school's request	California AG under unfair competition law	Civil penalties under state law
State design codes and social media age laws	Minors on platforms	Large platforms and sites (definitions vary)	High-privacy defaults, parental consent, age checks	State AGs	Varies; many are enjoined

Age verification and design codes in court

States have tried two newer approaches: requiring sites to check ages, and requiring platforms to design services with children in mind. Courts have split them along First Amendment lines.

Age verification for adult sites. In Free Speech Coalition, Inc. v. Paxton (June 27, 2025, 6 to 3), the Supreme Court upheld Texas's H.B. 1181, which requires age verification for websites where more than one-third of the content is sexual material harmful to minors. Justice Thomas wrote that the law "only incidentally burdens the protected speech of adults," so intermediate scrutiny applied, and the law passed it. Justice Kagan, for the dissent, would have applied strict scrutiny. The ruling settled the question for adult content and left open how far it reaches general social media.

Social media age laws. Laws requiring platforms to verify ages and get parental consent for minors have mostly been blocked in lower courts. In NetChoice, LLC v. Fitch (August 14, 2025), the Supreme Court declined to block Mississippi's law while the appeal continued. Justice Kavanaugh concurred, writing that the Mississippi law "is likely unconstitutional" under current precedent, but that NetChoice had not shown the balance of harms favored emergency relief.

California's Age-Appropriate Design Code. A federal district court blocked the CAADCA in full in September 2023. In August 2024 the Ninth Circuit held its data protection impact assessment requirement likely unconstitutional but sent the rest back. After the district court blocked the whole law again, the Ninth Circuit ruled on March 12, 2026 that the impact assessment, the data use limits tied to "materially detrimental" and "best interests of children," the dark patterns ban and the 90-day cure provision stay blocked, while the age estimation requirement, high-privacy default settings, child-appropriate privacy disclosures and some other duties may take effect. The case is back in district court, and the rulings so far address only preliminary relief.

KOSA, COPPA 2.0 and the KIDS Act

Two federal bills have dominated the debate for years. The Kids Online Safety Act (KOSA) would put a "duty of care" on platforms to prevent specific harms to minors and require safer default settings. COPPA 2.0 would extend COPPA-style protection to teens, ban targeted ads to minors and replace the actual knowledge standard with a broader one. Both have passed the Senate in earlier forms and cleared the House Energy and Commerce Committee, according to Crowell and Moring's 2026 summary, but neither has reached the President.

In 2026 the House took a different path. House Energy and Commerce leaders reached a bipartisan deal in June 2026, and on June 29, 2026 the House passed H.R. 7757, the Kids Internet and Digital Safety (KIDS) Act, 267 to 117. It combines provisions from 14 bills, including versions of KOSA and COPPA 2.0. The Future of Privacy Forum's comparison shows the House text treats children as under 14 and teens as 14 to 17, uses a "knows or should have known" standard for all operators, and preempts only state laws that conflict with it. It also bans targeted ads to minors and limits features such as autoplay and infinite scroll. It leaves out KOSA's duty of care, which is why the Senate sponsors of KOSA have rejected it. As of October 2026 the Senate has not passed the House bill and no children's online privacy bill has become law in this Congress. The one recent federal law in this area, the TAKE IT DOWN Act of 2025 on nonconsensual intimate images, is covered in lesson 07.

Questions and answers

My 11-year-old wants a social media account. Does COPPA stop that?

COPPA sets conditions, and a child may use any service that meets them: an operator that knows it has a child user, or runs a child-directed service, must get your consent before collecting the child's personal information. Many large platforms set a minimum age of 13 in their terms. A child who lies about age puts the platform outside COPPA until it gains actual knowledge. Some states have their own age laws, many of them blocked in court.

Can a school share my child's photo in the yearbook or on its website?

Usually yes, if photos are listed as directory information in the school's annual notice and you did not opt out. A photo that is directly related to a student and kept by the school is an education record, but directory information may be released after notice. If you want to stop it, file the opt-out the notice describes.

The teacher assigned an app. Did I have to consent under COPPA?

The FTC's COPPA FAQ says schools "may act as the parent's agent and can consent under COPPA" when the operator collects data for the school's use and "for no other commercial purpose." The 2025 rule did not write that into the regulation, leaving it in guidance pending possible FERPA changes. Under FERPA, the school is sharing records with the vendor under the school official exception, which requires the vendor to be under the school's direct control for that data. You can ask the school for the vendor's privacy agreement.

My child is 15. Does any federal law protect their data online?

Not COPPA. FERPA protects school records. The FCRA lets you freeze the credit file of a child under 16 for free, which blocks new accounts in the child's name, a useful step after a breach of a child's Social Security number. Federal teen privacy protection is in the House-passed KIDS Act, which is not law. State laws vary.

Can a college tell me my 19-year-old's grades?

Only with the student's written consent, unless you claim the student as a dependent for federal tax purposes, there is a health or safety emergency, or another exception applies. Once a student enters college, the FERPA rights are the student's.

Does FERPA apply to a private school?

Only if it receives funds from a Department of Education program. Many private K-12 schools do not. Private colleges usually do through federal student aid.

What happens to the data an age verification vendor collects?

Under the FTC's February 2026 policy statement, a COPPA-covered operator that collects data solely to verify age avoids enforcement only if it uses the data for nothing else, deletes it promptly and binds its vendors in writing. State age verification laws set their own rules, so check the one that applies. Whether vendors follow them is a good question for any parent to ask.

Can a state attorney general bring a COPPA case?

Yes. 15 U.S.C. 6504 lets a state attorney general sue in federal court for injunctions and money for residents, after notifying the FTC. New York shared in the YouTube settlement that way.

Hard questions

Should COPPA's line be 13 or higher?

Congress chose 13 in 1998. Supporters of raising it, through COPPA 2.0 or the KIDS Act, point to research on teens and social media and to the ad-driven data collection that targets 13- to 17-year-olds at full adult scale. Opponents argue that raising the age pushes services to verify everyone's age, which means collecting more data from adults and teens, and that teens have their own speech and information rights. The House text's split between children under 14 and teens 14 to 17 tries to treat the two groups differently. The Senate fight is over the duty of care, not the age line.

Is age verification a privacy protection or a privacy risk?

Both, depending on how it is done. Paxton accepted that states may require it for sexual content harmful to minors. Privacy and civil liberties groups argue that ID checks build databases tying adults to what they read and watch, and that breaches of such databases would be severe. Child safety advocates answer that age estimation and third-party tokens can confirm age without revealing identity, and the FTC's 2026 policy statement tries to encourage that by conditioning its enforcement relief on prompt deletion. The evidence on how accurate and private current methods are is still developing.

Should FERPA have a private right of action?

Gonzaga leaves families with an administrative complaint and an agency whose ultimate weapon, cutting off federal funds, would hurt the students it protects. Supporters of a private right argue that only lawsuits would make districts and vendors take it seriously. Schools answer that money damages would come out of instructional budgets and that most violations are mistakes corrected once raised. States have answered partly by giving their own student privacy laws teeth against vendors rather than schools.

Do design codes violate the First Amendment?

California argues that its design code regulates data practices and product features, not speech. NetChoice argues that requiring platforms to judge what is "materially detrimental" to children forces them to assess and restrict content, which is speech regulation. The Ninth Circuit has split the difference: duties tied to vague judgments about harm are blocked, while age estimation and default settings may go forward for now. The Supreme Court has not taken a design code case.

Who should be liable when kids' content sits on a platform?

The YouTube case put liability on the platform; the Disney case put it on the content owner that mislabeled videos. Platforms argue that creators know their audience best. Creators argue that only the platform controls the tracking. The FTC's approach as of October 2026 is to hold both responsible for the part each controls, and to let Disney's review duty end if YouTube adopts age assurance for all users.