COPPA and AI in Education: A Guide for Administrators

COPPA binds AI vendors directly, not districts, which is exactly why an administrator's real job isn't reading the statute; it's writing board policy that controls which consent pathway the district relies on, which Safe Harbor evidence counts as sufficient vendor vetting, and how the annual family notification stays current as tools change. Get the policy layer wrong and every downstream classroom approval inherits the gap.

Quick Answer: COPPA (16 CFR Part 312) requires verifiable parental consent before an online service collects personal information from a child under 13, but longstanding FTC guidance lets a district consent on a family's behalf when a tool is used strictly for an educational purpose. Administrators are responsible for three governance layers this guide covers: which consent pathway and verification method the district's policy actually authorizes, how Safe Harbor program participation factors into vendor procurement, and how staff training and family notification keep pace as the FTC's 2025 amendments phase in through the April 22, 2026 compliance deadline.

This is a governance companion, not a procurement checklist. For the itemized, tool-by-tool consent and retention review a teacher or purchasing lead would run before a pilot, see A COPPA Compliance Checklist for AI Tools in Schools. This guide is written one level up: for the administrator deciding what the district's board policy, consent-delegation criteria, and vendor-vetting standard should say before any checklist gets run against a specific tool. For how COPPA's consent-and-collection rules fit into the fuller data lifecycle, collection, minimization, retention, sharing, and deletion, across every grade band, see A Student Data Privacy Compliance Checklist for AI Tools in Schools, which this guide's policy recommendations are meant to feed directly into.

Why COPPA Needs a Different Answer at the Policy Level

A teacher running a checklist on one tool and an administrator setting district policy are answering two different questions, even though both involve the same law. The checklist asks "does this specific tool comply?" Policy asks "what standard does every tool in this district have to meet, and who decided that?"

That distinction matters because COPPA, unlike FERPA, binds the vendor directly rather than the school. A district's exposure isn't primarily about whether it personally mishandled data; it's about whether the district's own consent, procurement, and training decisions created the conditions for a vendor to mishandle it. Federal regulators have signaled this remains an active enforcement area: FTC leadership has repeatedly described children's online safety as a continuing priority since the 2025 COPPA amendments took effect, with additional enforcement actions expected as the rule's compliance deadlines land (FTC, 2025).

Notably, the FTC's 2025 rulemaking process considered, and then declined, education-technology-specific amendments. The agency cited concerns about creating obligations that might conflict with parallel updates the U.S. Department of Education is expected to make to FERPA's own regulations (FTC, 2025). For administrators, that's a direct signal: COPPA's general-purpose rule, not a school-specific carve-out, is what governs every AI vendor a district contracts with, and district policy has to fill the gap the rule itself leaves open for schools.

The COPPA Rule Mechanics an Administrator Needs to Know

Three mechanics sit underneath every district-level COPPA decision: what counts as "collection," how verifiable parental consent works, and what the 2025 amendments changed. Understanding these precisely is what lets an administrator write policy instead of just forwarding a vendor's compliance claim.

What Counts as "Collection"

"Collection" under COPPA is broader than a name or an account signup, and getting this definition wrong is the most common way a district underestimates its own exposure. The FTC's rule counts a request for personal information, a persistent identifier that could re-identify a child across sessions, and even a passive tracking script embedded on a page a child views, regardless of whether the child ever types anything in.

For AI tools specifically, this definition now explicitly reaches further than text. The 2025 amendments expanded "personal information" to include biometric identifiers, meaning a voice sample captured by a reading-fluency tool, or a handwriting image captured by a worksheet scanner, counts as collection in its own right, separate from whatever score or transcript a teacher ultimately sees (FTC, 2025).

This is also where policy should distinguish a tool that collects from a child directly from one that collects almost nothing at all. A text-leveling tool like Diffit, when used the way most districts deploy it, a teacher pastes in a passage and the tool adjusts the reading level, never asks a student to type or speak anything, which keeps that specific use case largely outside COPPA's direct-collection triggers. (See Diffit and Student Data Privacy for how that distinction holds up across the tool's different features.) An administrator's policy should ask this "who's actually typing" question of every tool under review, since the answer changes whether the consent conditions below even come into play.

Verifiable Parental Consent and the School-as-Agent Doctrine

A district can consent on behalf of its families instead of requiring individual parental sign-off, but only when specific conditions hold, and an administrator's policy should say so explicitly rather than assume it. Longstanding FTC guidance permits this "school-as-agent" pathway when four conditions are met simultaneously:

1. The tool is used strictly for an educational purpose the school has authorized.
2. The data collected is not used for commercial purposes, including targeted advertising.
3. Families have been clearly notified of what the vendor collects and why.
4. The vendor doesn't use the data for any purpose beyond what the school authorized.

When any of those four breaks down, for instance a tool that markets directly to families outside the classroom, individual parental verifiable consent is back on the table, and the district's policy needs a defined fallback method for that scenario rather than discovering the gap mid-deployment.

The 2025 Amendments and the April 22, 2026 Deadline

The FTC published its amended COPPA Rule in the Federal Register on April 22, 2025, with the rule effective June 23, 2025, and full compliance required by April 22, 2026 (FTC, 2025). Three changes matter most at the policy level, beyond the consent-method updates already covered in EduGenius's tool-level checklist.

An administrator's policy should require evidence of all three, in writing, as a condition of any AI vendor contract, rather than leaving individual buildings to interpret "COPPA compliant" on a case-by-case basis.

Safe Harbor Programs: The Only Real Vendor-Vetting Mechanism COPPA Offers

COPPA has no government certification a vendor can earn, but it does have one real, government-recognized mechanism: the FTC-approved Safe Harbor program, and an administrator's procurement policy should treat it as meaningfully stronger evidence than a vendor's own self-description. Six organizations currently operate FTC-approved Safe Harbor programs under 16 CFR § 312.11, each independently reviewing member operators' COPPA practices rather than relying on the FTC to review every vendor directly (FTC).

A seventh program, Aristotle, was approved in 2012 but withdrew from the Safe Harbor program in 2021 after the FTC raised concerns about its enforcement of member guidelines, which is why the current active roster is six, not seven.

Participation is voluntary on the vendor's part, and a vendor that has joined one has agreed to abide by that program's guidelines, which the FTC requires to provide "the same or greater" protections than the COPPA Rule itself, backed by the program's own disciplinary authority over members and periodic reporting to the FTC (FTC, 2025). A vendor's Safe Harbor membership doesn't eliminate the need for a signed DPA specific to the district, but it does mean an outside party, not just the vendor, has reviewed the underlying practices.

Written into procurement policy, this becomes a simple two-part standard: ask every AI vendor whether it participates in an FTC-approved Safe Harbor program, and if not, require the same specificity, named consent method, written retention window, security program, that a Safe Harbor program would otherwise verify independently.

Writing District Policy Around COPPA

A board policy that says "AI tools must comply with COPPA" leaves every real decision to whoever happens to be reviewing a given tool that week. A policy built to actually operate should name specific mechanisms, not just cite the law.

1. A named consent-delegation standard, stating explicitly that the district relies on the school-as-agent pathway for strictly educational tools, and defining what "strictly educational" means for approval purposes.
2. A required Safe Harbor or equivalent-evidence standard, so procurement has a consistent bar rather than accepting whatever a vendor's sales page claims.
3. A written retention and security-program requirement, mirroring the 2025 amendments, built into every AI vendor contract regardless of the vendor's own compliance timeline.
4. An age-banding review step, since a tool approved for a fifth-grade pilot can silently cross COPPA's under-13 threshold if a third-grade class adopts it the following year without anyone re-checking.
5. A designated policy owner, a student-data-privacy officer or equivalent role, responsible for keeping the district's COPPA posture current as the FTC's own compliance deadlines land.

Several states have begun publishing grade-banded AI guidance that districts can fold directly into this kind of policy; Vermont's 2026 state guidance, for instance, recommends against open-ended AI chatbot use in the earliest grades specifically, a useful reference point when a board is deciding how tightly to scope its own under-13 approval criteria.

Staff Training and Family Communication Obligations

Policy that staff have never been trained on operates the same as no policy at all, and COPPA adds a family-facing obligation FERPA-focused training often misses. Training should specifically cover what makes the school-as-agent consent pathway valid in the first place, since it depends on families actually being notified, not just on the district internally deciding a tool qualifies.

• What counts as collection, including voice and handwriting capture, so staff don't assume a "typing-free" tool is automatically outside COPPA's reach.
• How to verify a tool has cleared the district's Safe Harbor or equivalent-evidence standard before using it with a class under 13, not after a parent asks.
• The difference between the district's approved notification letter and a generic "we use AI" communication, since COPPA's school-as-agent pathway depends on families being told specifically what's collected and why.
• Who to notify if a tool's actual behavior doesn't match what was approved, for instance an update that adds a new data-sharing partner without the district being informed first.

Family notification deserves its own cadence, separate from a general annual letter. A notification that lists every currently approved AI tool by name, refreshed whenever the approved list changes rather than once a year, gives families a specific, current answer instead of a vague assurance that "AI tools are used responsibly."

Training also needs a trigger, not just a calendar date. A new hire joining mid-year, a new AI tool added to the approved list, or a vendor update that changes what a tool collects should each prompt a short refresher, rather than waiting for the next scheduled annual session. Districts that train once at rollout and never again tend to see the gap between policy and practice widen quietly as staff turn over, a pattern that shows up during an audit far more often than during any single incident.

Documenting the Decision, Not Just the Policy

A board policy establishes the standard; a dated, tool-by-tool record is what proves the standard was actually applied. When a parent, an auditor, or the FTC itself asks how a specific tool was approved, "our policy requires Safe Harbor evidence" is a weaker answer than a record showing which evidence was reviewed, by whom, and on what date.

At minimum, the record for each approved AI tool should note the consent pathway relied on, whether Safe Harbor participation was confirmed or substitute evidence was required instead, the retention window in the signed contract, and the date of the next scheduled re-verification. Keeping that record in one shared, searchable place, rather than scattered across individual reviewers' email, is what turns a well-written policy into a defensible practice.

A Policy Scenario: Reviewing a New Early-Reading AI Tool

Say you're a director of curriculum and technology reviewing a new AI tool that listens to Kindergarten and Grade 1 students read aloud and generates a fluency score for the teacher. A building principal has already piloted it informally with one class, and it's now under review for a K-1 recommendation districtwide.

Run it through the policy layers, not just the tool-level checklist:

• Consent pathway: confirm the tool is used strictly for the educational fluency assessment, not shared for any commercial purpose, and that it fits the district's existing school-as-agent notification, or requires an update to it.
• Collection scope: confirm whether the tool retains the raw audio, a transcript, or only the numeric score, since the 2025 amendments treat a retained voice sample as personal information requiring its own retention answer.
• Vendor vetting: confirm whether the vendor participates in an FTC-approved Safe Harbor program, and if not, require the written security-program and retention evidence the policy above demands as a substitute.
• Family notification: confirm families of the youngest students specifically, the age band most likely to trigger COPPA in the first place, have been notified before the tool moves past pilot status.

Content-generation tools that keep students out of a direct conversational interface with a model narrow this review considerably. EduGenius, for example, is built around a teacher configuring a class profile by grade level and subject and generating materials from it, rather than a young student typing or speaking directly into the system, which is a structural choice worth weighing during procurement even though it doesn't replace running the review above.

For how a comparable tutoring-style AI platform is built when students do interact directly, see SchoolAI vs Khanmigo: Which Is Better for Teachers? For a specific example of how a widely used reading platform handles its own COPPA posture, see Is Newsela COPPA Compliant?

Related Reading

• AI, FERPA & COPPA: The Complete School Data-Privacy Guide (2026)
• Diffit and Student Data Privacy: What Teachers Should Know
• A Student Data Privacy Compliance Checklist for AI Tools in Schools
• Is Newsela COPPA Compliant?
• How Schools Can Use AI Without Violating Data Security
• SchoolAI vs Khanmigo: Which Is Better for Teachers?