Estimated reading time: 7 minutes
COPPA and AI matters most for elementary and middle schools, because COPPA, the Children’s Online Privacy Protection Act, governs how online services collect personal information from children under 13. Many AI learning tools are online services that collect such information, so districts serving young students need to understand how COPPA applies. This guide explains, in plain terms, what COPPA requires, how schools can provide consent on behalf of parents, and how to vet an AI tool for young learners. It is general information, not legal advice.
Table of contents
Executive Summary
COPPA requires online services directed to children under 13 to give notice and obtain verifiable parental consent before collecting a child’s personal information, and to limit how that data is used. In a school setting, the FTC has said a school can provide consent on behalf of parents when the online service is used solely for an educational purpose and the school authorizes it, though many districts still inform parents directly. The practical rule for AI: for under-13 students, choose tools designed for children, collecting minimal data, used only for education, and backed by a clear agreement.
Key Takeaways
- COPPA and AI: COPPA covers online collection of data from under-13 children.
- It requires notice and verifiable parental consent, plus limits on data use.
- Schools can consent for parents when use is solely educational and school-authorized.
- For young learners, choose AI built for children that minimizes data.
- Document it with a data-privacy agreement.
What COPPA Requires
Quick answer: COPPA requires online services that collect personal information from children under 13 to provide clear notice, obtain verifiable parental consent, collect only what is needed, and protect and limit the use of that data. It is enforced by the Federal Trade Commission and applies to many AI learning tools used by young students.
How Schools Provide Consent
Under FTC guidance, a school may act as the parent’s agent and consent to the collection of students’ personal information when an online service is used solely for an educational purpose authorized by the school, and the operator collects data only for that purpose. This school-consent path is how most classroom tools operate for under-13 students. Even where it applies, transparency with families is good practice, and some districts choose to notify or involve parents directly.
What to Require for Young Learners
| Requirement | Why it matters under COPPA |
|---|---|
| Designed for children | Age-appropriate data practices and content |
| Data minimization | Collect only what the service needs |
| Educational-use-only commitment | Supports the school-consent path |
| No behavioral ad targeting | COPPA restricts use of children’s data |
COPPA, FERPA, and District Policy
COPPA and FERPA are different laws that often apply at the same time: FERPA covers education records, COPPA covers online collection of data from under-13 children. On top of both, many states now publish K-12 AI guidance and many districts have board-adopted AI policies that set expectations for young learners. Treat the two federal laws as the floor and your state and district rules as the rest. See AI Safety in Schools for the full framework.
Common Mistakes District Leaders Make
- Using consumer AI not designed for children with young students.
- Assuming COPPA does not apply because it is a school.
- Skipping the educational-use-only commitment.
- Failing to be transparent with families.
Recommended Actions
Immediate (this month): Identify AI tools used by under-13 students and confirm they are child-appropriate.
Medium-term (this year): Require an educational-use-only data agreement for any tool serving young learners.
Long-term (strategy): Build a consistent parent-transparency practice for AI in the early grades.
Questions District Leaders Should Ask
- Is the tool designed for children under 13?
- Does it collect only the data it needs and use it solely for education?
- Does it avoid behavioral advertising to children?
- How will we be transparent with families?
The 2025 COPPA Amendments District Leaders Should Know
COPPA was updated for the first time in over a decade. The FTC published final amendments to the COPPA Rule in April 2025; the rule took effect on June 23, 2025, and full compliance was required by April 22, 2026, a deadline that has now passed. For districts serving young students with AI tools, several changes are directly relevant.
First, the definition of personal information now expressly includes biometric identifiers, which can cover voiceprints and other data that some AI tools process. Second, operators must obtain separate verifiable parental consent before disclosing a child’s personal information for purposes that are not integral to the service, which limits how student data can be shared with third parties. Third, operators must now maintain a written information security program and a written data-retention policy, and they may not keep a child’s personal information longer than needed for the specific purpose it was collected for. When you evaluate an AI vendor for the early grades, ask directly whether their product reflects these amended requirements, including how long they retain student data and when they delete it.
Verifiable Parental Consent in Practice
COPPA requires verifiable parental consent, meaning a reasonable effort to confirm that the person consenting is actually the child’s parent. The FTC recognizes several acceptable methods, such as a signed consent form, a verified payment transaction, or a phone or video call with trained personnel. In most K-12 settings, districts rely on the school-consent path instead, where the school acts as the parent’s agent because the tool is used solely for a school-authorized educational purpose. To use that path safely, a district should confirm in writing that the vendor collects data only for the educational purpose, keep a signed data-privacy agreement on file, and maintain a clear record of which tools have been vetted. Documenting these steps protects the district and makes the annual policy review far simpler.
Frequently Asked Questions
How do COPPA and AI relate?
COPPA governs online collection of personal information from children under 13, and many AI learning tools are online services that collect such information. So for young students, AI tools must meet COPPA’s notice, consent, and data-use requirements.
Can a school consent on behalf of parents?
Under FTC guidance, yes, when the online service is used solely for a school-authorized educational purpose and the operator collects data only for that purpose. Many districts still inform families directly as good practice.
Is COPPA the same as FERPA?
No. FERPA covers student education records held by schools; COPPA covers online collection of personal information from under-13 children. Both can apply to the same AI tool at once.
Is this legal advice?
No. This is general information to help district leaders ask the right questions. Consult district counsel and the FTC’s COPPA guidance for decisions about specific tools.
What changed in the 2025 COPPA amendments?
The amended rule took effect June 23, 2025, with compliance required by April 22, 2026. It expanded personal information to include biometric identifiers, required separate consent before disclosing data for non-integral purposes, and mandated a written data-security program and data-retention limits so children’s data is not kept longer than needed.
Does COPPA cover voice data from AI tools?
It can. The 2025 amendments added biometric identifiers to the definition of personal information, which may include voiceprints. Since many AI speaking tools process a child’s voice, districts should ask vendors how voice data is collected, used, retained, and deleted.
How long can an AI tool keep our students’ data?
Under the amended rule, only as long as needed for the specific purpose it was collected for, after which it must be deleted. Ask any vendor serving under-13 students for their written data-retention policy before adopting the tool.
Related Resources
- AI in Education: Complete Guide
- FERPA and AI
- AI Safety in Schools
- Best AI Tools for Schools
- AI for English Learners
Conclusion
COPPA and AI come together in the early grades, where AI tools collect data from children under 13. COPPA requires notice, consent, and limited data use; schools can often provide consent when use is solely educational and authorized. For young learners, the safe path is clear: choose AI built for children, minimize data, keep use educational, and be transparent with families, all on top of FERPA and your district’s AI policy.
Sources: Federal Trade Commission, Children’s Privacy (COPPA); U.S. Department of Education, Student Privacy Policy Office.
This article is general information, not legal advice. Consult your district counsel for guidance on specific tools.
Safe by Design for the Youngest Learners
The under-13 classroom is where AI adoption gets most delicate. An elementary teacher wants a tool that supports young learners, but the app was built for adults, and now the district is weighing consent, data collection, and advertising practices it never intended to inherit.
The challenge is not the law itself but the mismatch beneath it. Consumer tools were never designed for children, so a district ends up compensating with agreements and oversight for a product that assumes an adult user. The burden is structural, not a lapse in care.
Districts on solid ground choose tools designed for children, that minimize data and commit to educational use only. Telo AI is one example built with those constraints in mind, offering supervised practice in English plus Spanish and French for early dual-language settings.
See how a child-first tool is built for young learners: https://mytelo.ai/how-telo-works/
For the youngest students, safety cannot be an add-on. When a tool is built for children from the start, COPPA compliance follows the design rather than fighting it, and adults can keep their attention on teaching.