A COPPA Compliance Checklist for AI Tools in Schools
Among 9- to 12-year-olds, 81% now use or interact with AI in some form, and 17% do so every single day (Common Sense Media Census: AI Use by Tweens and Teens, 2026). Almost all of that usage falls squarely inside COPPA's under-13 trigger. The checklist that actually matters for this age band isn't a general FERPA vendor review; it's three narrower questions: who consented, what counts as "collection," and how long the data sits afterward.
Quick Answer: COPPA (16 CFR Part 312) requires verifiable parental consent before an online service collects personal information from a child under 13, though a school can typically consent on a family's behalf for a strictly educational purpose. The 2025 FTC amendments add new accepted consent methods, expand what counts as personal information, and require a written, purpose-limited data-retention policy instead of indefinite storage. This checklist walks through consent, "collection," and retention specifically for AI tools used with elementary and early-middle-grade students, not FERPA's broader disclosure rules.
This is deliberately narrower than a general vendor-vetting checklist. Districts already have FERPA-focused checklists covering contracts, admin consoles, and training defaults; the foundational legal picture sits in our AI, FERPA & COPPA: The Complete School Data-Privacy Guide (2026). What follows focuses only on the under-13 consent, collection, and retention questions COPPA specifically raises, the questions a broad FERPA checklist tends to touch only in passing.
What COPPA Actually Regulates, in One Paragraph
COPPA is a 1998 federal law, enforced by the Federal Trade Commission, that regulates any online service directed at children under 13 or that has actual knowledge it is collecting personal information from a child that age. Unlike FERPA, COPPA binds the vendor directly, not just the school using the vendor's product.
The FTC has already shown it will enforce this against education technology specifically. In 2023, the agency reached a $6 million settlement with the ed-tech platform Edmodo, which had used student data, including persistent identifiers, for advertising purposes without verifiable parental consent, and had improperly pushed COPPA compliance obligations onto teachers rather than handling them itself (FTC, 2023). The order also required Edmodo to delete any models or algorithms built using improperly collected children's data, a remedy known informally as algorithmic disgorgement.
That case is the backdrop for every item on the checklist below: a vendor's consent process, its definition of "collection," and its retention policy aren't abstract legal boxes. They're the exact three things the FTC has already litigated against an ed-tech company for getting wrong.
It's also worth naming what COPPA doesn't do. It doesn't regulate the school directly the way FERPA does, and it doesn't require a government certification a vendor can display. The FTC does recognize one voluntary mechanism, its approved Safe Harbor programs (organizations like iKeepSafe, PRIVO, and kidSAFE), which independently review a vendor's COPPA practices. A vendor naming its Safe Harbor participation specifically is offering a stronger signal than a vendor simply asserting "we're COPPA compliant" on a marketing page.
Checklist 1: Does Verifiable Parental Consent Apply, and Which Method Fits?
Verifiable parental consent (VPC) is required before an AI tool collects personal information directly from a child under 13, unless the school itself is providing that consent as the parent's agent for a strictly educational purpose. Getting this distinction right determines whether a district needs individual parent sign-off at all.
When a School Can Consent Instead of Each Parent
Longstanding FTC guidance lets a school act as the parent's agent for consent purposes, but only under specific conditions:
- The AI tool is used strictly for an educational purpose the school has authorized.
- The data collected is not used for commercial purposes, including targeted advertising.
- The school has been clearly notified of what the vendor collects and why.
- The vendor doesn't use the data for any purpose beyond the one the school authorized.
If any of those four breaks down, individual parental consent is back on the table, regardless of how the tool is marketed to schools.
The Verifiable Parental Consent Methods Available in 2026
The FTC's amended rule, published in the Federal Register on April 22, 2025 and effective June 23, 2025 with full compliance required by April 22, 2026, added three new accepted VPC methods on top of the older ones (FTC, 2025).
| VPC method | How it works | Best fit |
|---|---|---|
| Signed consent form | Parent returns a physical or scanned signed form | Low-tech, well-understood, slower to process at scale |
| Credit card or payment verification | A small transaction confirms an adult is present | Common for consumer apps; rarely how school-mediated consent works |
| Government ID verification | Parent uploads and confirms a photo ID | Higher friction, high confidence |
| Video conference with trained personnel | A live check confirms the parent's identity | Resource-intensive, used for higher-risk data collection |
| Knowledge-based authentication (new, 2025) | Parent answers dynamic multiple-choice questions unlikely to be guessable by a child 12 or under | Added specifically to widen consent options without weakening verification |
| Facial recognition match to government ID (new, 2025) | A photo taken via phone or webcam is matched to an uploaded ID, then promptly deleted | Higher assurance; requires immediate deletion of the images after matching |
| Text-plus method (new, 2025) | Consent given by text message, confirmed by a follow-up text, letter, or phone call | Lower friction for a district already communicating with families by text |
For most K-9 classroom AI tools, the far more common pattern is the school-as-agent path above, not a parent VPC flow at all. But when a tool markets itself directly to families, or asks a student to create an individual account outside a teacher-managed workflow, one of these seven methods needs to actually be in use, not just referenced vaguely in a privacy policy.
Checklist 2: What Actually Counts as "Collection" Under COPPA
"Collection" under COPPA is broader than most people assume; it includes anything from a typed answer to a passive tracking identifier, and it's the checklist item districts most often get wrong by assuming a tool doesn't trigger COPPA at all. Under the FTC's rule, collection includes:
- Directly requested information, like a student typing their name, a photo, or written work into a chat interface.
- Passive tracking, including persistent identifiers such as device IDs or cookies used to recognize the same child across sessions, even without a name attached.
- Prompted disclosure, where a service encourages a child to submit personal information even if the child could technically decline.
- Third-party collection enabled by the service, such as an embedded chat widget or analytics tool gathering data the AI vendor itself never directly asks for.
Walk any classroom AI tool through these four questions before assuming COPPA doesn't apply:
- Does a student type identifiable content directly into the tool (a name, a personal story, a photo)?
- Does the tool assign a persistent identifier to a specific device or browser that would let it recognize the same child returning later?
- Does the interface prompt for information beyond what's needed for the immediate educational task?
- Does the tool embed any third-party script, analytics pixel, or chat widget that could independently collect data from the page?
A teacher-mediated workflow, where the teacher operates the tool and no student ever logs in individually, sidesteps most of these triggers by design, which is one reason it's become a common structural pattern for K-9 AI products. That doesn't eliminate the need to check; a "teacher-only" tool that still embeds third-party trackers on a page students view can still trigger collection under the third and fourth questions above.
Newer AI modalities widen the definition further. A speech-to-text reading tool captures a voice sample, which the 2025 amendments now classify as personal information in its own right, not just the transcript generated from it. A handwriting-recognition worksheet scanner captures an image of a student's actual handwriting alongside their answers. Both count as collection even if the final report a teacher sees shows only a numeric score.
What Doesn't Trigger COPPA (So Districts Don't Over-Restrict)
Not every data flow inside an AI tool counts as "collection" from a child. Knowing the boundary matters as much as knowing the trigger, since treating everything as COPPA-covered can stall useful tools for no legal reason.
- Fully de-identified, aggregate usage data, like "62% of the class answered question three correctly," with no path back to an individual student.
- A teacher's own account activity, since COPPA applies to collection from children, not from the adult educator operating the tool.
- Content a teacher generates for the class, such as a worksheet or quiz built from a class profile, where no student ever interacts with the AI system directly.
- Anonymized model-improvement data stripped of any persistent identifier, though this exemption depends entirely on the stripping actually being irreversible, not just unlabeled.
The safest posture is still to ask the vendor to confirm which category a given data flow falls into, in writing, rather than assuming it lands on the "doesn't trigger COPPA" side by default.
Checklist 3: Data Retention Limits for Young Learners
COPPA's 2025 amendments end the era of "we keep data as long as necessary" as an acceptable retention answer. A vendor must now retain a child's personal information only as long as reasonably necessary to fulfill the specific purpose it was collected for, and must maintain a written retention policy that says so explicitly.
| Retention policy element | What the 2025 amendment requires | Question to ask the vendor |
|---|---|---|
| Purpose statement | The policy must name the specific purpose data is being kept for | "What exact purpose does this data serve after the assignment is graded?" |
| Timeframe | A defined window, not an open-ended "as needed" | "Is it 30 days, end of term, end of enrollment, or something else?" |
| Deletion trigger | Automatic deletion once the purpose is fulfilled, not indefinite storage | "Does deletion happen automatically, or does our district have to request it?" |
| Publication | The policy itself must be written down and available for review | "Can you send us the actual written retention policy, not a summary sentence?" |
The amended rule also expanded what counts as personal information in the first place, adding biometric identifiers, government-issued identification numbers, and mobile phone numbers to the list already covering names, addresses, and persistent identifiers (FTC, 2025). A retention policy written before this expansion may not account for newer AI-specific data types, like a voice sample an AI reading-fluency tool captures from a second grader.
A retention answer worth accepting names a specific number: 30 days after a session ends, through the end of the school year, or until the student's enrollment closes. An answer that stays vague under direct questioning is the same gap the FTC cited in its 2023 action against Edmodo.
Putting It Together: A Model Workflow for Under-13 AI Tools
Say you're a curriculum coordinator piloting an AI reading-comprehension tool with a Grade 3 class, where the tool listens to a student read aloud and generates a fluency score. Before it leaves the pilot classroom, walk it through all three checklists in sequence.
- Consent: Confirm the school is providing consent as the parent's agent, that the tool's use is strictly educational, and that families have been notified in writing.
- Collection: Confirm whether the tool retains the actual audio recording, a transcript, or only an aggregate score, since each of those is a different "collection" question with a different answer.
- Retention: Get the specific retention window for whichever of those three the vendor actually keeps, and confirm deletion happens automatically at that point.
Notice what the sequence actually surfaces: a vague vendor answer to any single item, not just consent, is enough to pause the pilot. A vendor that confirms school-as-agent consent but can't say whether the raw audio is stored, or for how long, hasn't actually cleared the checklist just because the consent question looked fine on its own. Treat all three as one gate, not three independent gates a tool only needs to clear one of.
For content-generation workflows that don't require a student to speak, type, or log in directly at all, an alternative worth weighing is a teacher-managed structure from the outset. EduGenius, for instance, is built around a teacher setting up a class profile, grade level, subject, and ability range, then generating materials from that profile rather than students interacting with the model themselves.
That design is intended to keep the tool outside most of COPPA's direct-collection triggers in the first place, though it's a structural choice to evaluate alongside the checklist above, not a substitute for actually running it.
For how this compares across other classroom AI platforms, see SchoolAI vs Khanmigo: Which Is Better for Teachers?
Pro Tips for Getting COPPA Right on the First Pass
- Ask for the retention policy in writing before the pilot starts, not after a parent asks a question the district can't answer.
- Treat "we don't sell data" as a non-answer. COPPA's third-party disclosure rules cover far more than sales; ask specifically about analytics partners, model providers, and any embedded widgets.
- Re-verify age-gating annually. A tool adopted for a 5th-grade pilot that quietly expands to a 3rd-grade classroom the following year can cross COPPA's threshold without anyone updating the paperwork.
- Keep the school-as-agent notification separate from a general "we use AI tools" letter. COPPA's pathway depends on families actually being told what's collected, not just that AI exists in the classroom somewhere.
What to Avoid
- Assuming a "teacher-only" tool is automatically COPPA-exempt. Embedded third-party scripts and persistent identifiers can still trigger collection even when no student ever logs in.
- Accepting a vague retention answer like "as long as necessary." That phrase is exactly what the 2025 amendments were written to eliminate; press for a specific number.
- Treating a signed permission slip from years ago as ongoing consent. COPPA consent applies to the current tool and current data practices, not a blanket approval collected once.
- Ignoring the Edmodo precedent. A $6 million settlement and a court order to delete AI models built on improperly collected children's data is the clearest signal available that the FTC treats ed-tech COPPA violations as a real enforcement priority, not a formality (FTC, 2023).
Key Takeaways
- COPPA binds the vendor directly, and applies to any AI tool collecting personal information from a child under 13, whether or not the child ever creates a formal account.
- A school can consent on a family's behalf only when the tool's use is strictly educational, non-commercial, and families have been notified, per longstanding FTC guidance.
- The FTC's 2025 amendments added three new verifiable parental consent methods: knowledge-based authentication, facial recognition matched to a government ID, and the text-plus method (FTC, 2025).
- "Collection" is broader than a name or email address; it includes persistent identifiers, prompted disclosures, and third-party trackers embedded in a page students use.
- Indefinite retention is no longer an acceptable answer. Vendors must maintain a written, purpose-limited retention policy with a specific deletion trigger.
- The FTC's 2023 Edmodo settlement, a $6 million penalty plus a court-ordered deletion of AI models trained on improperly collected data, is the direct precedent behind every item on this checklist.
- A teacher-mediated workflow, rather than individual student accounts, sidesteps most direct-collection triggers by design, though it doesn't eliminate the need to check embedded trackers and analytics.
Frequently Asked Questions
Does COPPA apply if students never create their own account?
Often not directly, since COPPA's collection triggers usually require the service itself to gather personal information from the child. But an embedded third-party script, analytics tool, or persistent identifier on a page students view can still trigger collection even in a teacher-managed workflow, so the underlying tool still needs review.
Can a school consent to an AI tool on behalf of all parents at once?
Yes, longstanding FTC guidance allows a school to act as the parent's agent for consent, but only when the tool's use is strictly educational, the data isn't used commercially, and families are notified of what's collected. That pathway depends entirely on the vendor's actual practices matching what it permits.
What's new about verifiable parental consent under the 2025 COPPA amendments?
The FTC added three methods: knowledge-based authentication using dynamic questions, facial recognition matched against a government-issued photo ID with prompt deletion afterward, and a text-plus method confirmed by a follow-up text, letter, or call. These supplement older methods like signed forms and video verification (FTC, 2025).
How long can an AI vendor keep a child's data under COPPA?
Only as long as reasonably necessary for the specific purpose it was collected for, under a written retention policy the 2025 amendments now require. Indefinite retention, or a vague "as long as necessary" answer, no longer satisfies COPPA; districts should get a specific timeframe in writing.
What happened in the FTC's COPPA case against Edmodo?
In 2023, the FTC fined ed-tech platform Edmodo $6 million for using student data, including persistent identifiers, for advertising without verifiable parental consent, and for improperly shifting compliance responsibility onto teachers. The order also required deleting AI models built from the improperly collected data.
Does a voice recording count as personal information under COPPA?
Yes. The FTC's 2025 amendments explicitly classify biometric identifiers, which include voice samples, as personal information in their own right. An AI reading-fluency or pronunciation tool that captures a child's voice needs the same consent, collection, and retention answers as one collecting a name or photo, even if the final report a teacher sees is just a numeric score.
Related Reading
- AI, FERPA & COPPA: The Complete School Data-Privacy Guide (2026)
- Diffit and Student Data Privacy: What Teachers Should Know
- How Schools Can Use AI Without Violating SOC 2
- FERPA and AI in Education: A Guide for Administrators
- Google Classroom and Student Data Privacy: What Teachers Should Know
- SchoolAI vs Khanmigo: Which Is Better for Teachers?