Is Google Gemini COPPA Compliant?

Google states that Gemini inside Google Workspace for Education is built to support COPPA compliance, and it enforces that promise through a signed institutional contract and age-gated features rather than through an FTC-approved COPPA Safe Harbor certification, which Google does not appear to hold for Gemini. That distinction, contractual support versus third-party certification, is the entire answer, and it is worth understanding before a district treats "supports compliance" as a settled legal fact.

Quick Answer: Gemini's COPPA posture rests on three legs: Google's Workspace for Education Terms of Service (the binding contract a district signs), age-based restrictions that limit which features under-18 accounts can reach, and a school-consent model where the district, not individual parents, authorizes use for an educational purpose. Google has not published evidence of joining an FTC-approved Safe Harbor program (iKeepSafe, PRIVO, kidSAFE, or CARU) for Gemini specifically. That puts Google's compliance claim in the same category as most large first-party vendors: real, contractually enforceable, and self-attested rather than independently certified.

If you've read a Google Workspace trust page and come away with more badges than answers, this article sorts out what actually backs the COPPA claim, what a Safe Harbor certification would add that a contract alone doesn't, and what a district should ask for before rolling Gemini out to a class of 10-year-olds.

Why "COPPA Compliant" Isn't One Answer for Gemini

Gemini isn't a single product with a single consent model; it's three different offerings layered inside Google Workspace for Education, and each one carries a different COPPA exposure. Treating "is Gemini COPPA compliant" as one yes-or-no question skips over that structure entirely.

Three Products, Three Exposure Levels

• The Gemini app as a Core Service. Since Google turned Gemini and NotebookLM into Core Services on August 13, 2025, the app sits inside the same contractual category as Gmail and Docs for most Workspace for Education domains, covered by the same Terms of Service a district already signed.
• The Gemini Education Add-on, now Google AI Pro for Education. This paid tier, consolidated from the earlier Gemini Education and Gemini Education Premium products effective August 28, 2025, is restricted to staff and adult students only, not assigned to under-18 learners at all.
• Consumer Gemini, accessed outside a school account. A student using a personal Google account off a district's managed domain sits entirely outside whatever protections a Workspace for Education contract provides, a gap that has nothing to do with how Gemini is designed for a school setting and everything to do with which account touched it.

That third category is the one districts most often overlook. A signed Workspace for Education agreement protects activity inside the managed domain; it says nothing about a student who opens Gemini on a personal phone using a personal Google account. For the fuller mechanics of how age gates, content filters, and admin controls interact across these three products, Is Google Gemini Safe for Students? covers that ground in detail; this article stays on the legal consent question specifically.

How Google's Consent Mechanism Actually Works

Google doesn't collect parental consent from individual families for Gemini inside Workspace for Education; it relies on the school acting as the parent's agent, a pathway the FTC has permitted since 2014 for tools used strictly for an authorized educational purpose. That's the same mechanism most classroom AI vendors lean on, not something unique to Google.

The School-as-Agent Pathway

Under longstanding FTC guidance, a school can consent to a vendor's data collection on behalf of its students' parents, provided the tool is used only for a school-authorized educational purpose, the data isn't used for commercial purposes like targeted advertising, and families are notified of what's collected. The full legal mechanics of that pathway, including where it can break down, are covered in AI, FERPA & COPPA: The Complete School Data-Privacy Guide (2026).

For Google specifically, this means the actual legal weight sits in the signed Workspace for Education agreement between the district and Google, not in a public claim on a marketing page.

What the Workspace for Education Terms Actually Commit To

Google's published position states that Workspace for Education Core Services, which now include the Gemini app, can be used in compliance with COPPA, and that the company contractually requires participating schools to meet the parental consent conditions the law sets out. Google also states that Core Services carry no advertising and that data collected through them isn't used to train Gemini's underlying models.

Three things worth confirming in your own district's agreement rather than assuming from Google's general statements:

1. Does the agreement explicitly name Gemini and NotebookLM, or does it predate their addition as Core Services and need an update?
2. Does the no-training commitment extend to Gemini prompts and responses specifically, not just to Docs, Gmail, and older Core Services?
3. Is there a documented data-retention and deletion timeline matching the specificity the FTC's 2025 COPPA amendments now expect of vendors?

Does Google Participate in an FTC-Approved COPPA Safe Harbor Program?

Based on the FTC's published list of approved Safe Harbor operators, iKeepSafe, PRIVO, kidSAFE, and CARU, Google does not appear as a participant for Gemini or Workspace for Education. That's a meaningfully different posture than a vendor like Edpuzzle, which holds an actual iKeepSafe COPPA Safe Harbor certification, reviewed independently rather than self-described.

Why a Company Like Google Usually Skips Safe Harbor

Safe Harbor programs exist mainly to give smaller or mid-size companies a structured, third-party-reviewed path to COPPA compliance, useful when a company doesn't have the in-house legal apparatus to negotiate individual district contracts at scale. Google, by contrast, negotiates its own enterprise-grade Workspace for Education Terms of Service directly with every district, backed by its own extensive legal and compliance infrastructure.

That doesn't make the contractual route weaker as a legal matter, a signed agreement is fully enforceable, but it does mean the evidence type is different from a Safe Harbor badge. The table below, adapted from the claim-strength framework in the pillar guide, applies it specifically to Gemini.

A district shouldn't read the missing Safe Harbor row as a red flag on its own. It means Google's compliance case rests entirely on the contract, which makes reading that contract, not skimming the trust page, the actual due-diligence step.

Age Gates: The Practical Enforcement Layer

Google backs its COPPA posture with real, structural age restrictions, not just contract language: users under 18 get a restricted Gemini app experience with stricter content filters, and Classroom's content-generation tools are limited to users an institution has designated as 18 or older. Google AI Pro for Education, the paid add-on, isn't assigned to under-18 learners at all.

These age gates matter to the COPPA analysis because they narrow exactly what kind of personal information a younger student's Gemini session can generate in the first place, fewer generative features available means a smaller footprint of prompts and outputs tied to a child's account. The full breakdown of how these gates work by age band, and how a district's admin console controls them, lives in Is Google Gemini Safe for Students?, since that mechanism is fundamentally a product-safety design question rather than a legal one.

Data Collection, Model Training, and the 2025 COPPA Amendments

A Gemini session inside a managed education account generates the prompt a student typed, the response Gemini generated, and account-level metadata, the same broad categories any Core Service collects. Google states that data isn't reviewed by people or used to train its models, a commitment that matters more than it might sound given how the FTC's 2025 amendments changed the rules around retention and disclosure.

The Training Question, Specifically

A "we don't train on your data" statement needs to be read as a promise about model updates, not a claim that the data is never processed at all, since generating any response requires processing the input. Google's public position is that Workspace for Education data isn't used to train Gemini, but a district relying on that promise for a COPPA-sensitive rollout should confirm the commitment appears in the signed agreement itself, not only on a public FAQ page that can change without notice.

What Changes Under the 2025 Amendments

The FTC published its first COPPA Rule amendments since 2013 in April 2025, effective June 23, 2025, with most substantive provisions requiring compliance by April 22, 2026 (FTC, 2025). Three changes bear directly on any vendor handling student prompts:

• Separate consent for third-party disclosure. A single bundled consent no longer covers both collection and sharing with third parties; those now require standalone verifiable consent.
• A published, specific retention policy. Data can only be kept as long as reasonably necessary for its original purpose, under a written policy, not indefinitely by default.
• Documented subprocessor security vetting. Operators must take and document steps verifying that any third party receiving children's data, including a model provider a vendor relies on, maintains adequate security.

A district's Gemini agreement predating April 2025 is worth revisiting specifically against these three points before the 2026 compliance deadline, rather than assuming an older contract automatically covers the newer requirements.

How Gemini's COPPA Posture Compares to Other Classroom AI Tools

Lining Gemini up against two other tools in the same compliance category shows why "compliant" needs a specific evidence type attached rather than a single checkmark. No ranking is implied here; each vendor is solving the same legal problem with a different mix of evidence.

Reading across that row for Edpuzzle is useful context: it's covered in full in Is Edpuzzle Safe for Students?, which walks through what an actual, independently reviewed Safe Harbor certification looks like in practice, a genuinely different evidence type than the contract-only model Gemini and most large first-party AI vendors use. A district evaluating a broader roster of tools, including something like Turnitin, Gradescope, or a narrower text-adaptation tool like Diffit, will find the same three-part evidence question applies every time: self-attestation, signed contract, or independent Safe Harbor review.

A District Verification Checklist Before Rolling Out Gemini

Work through these in order rather than treating any single answer as sufficient on its own:

1. Confirm your Workspace for Education Terms of Service explicitly cover Gemini and NotebookLM as Core Services, not just the older suite of apps.
2. Ask whether the no-training commitment for Gemini prompts is documented in writing, separate from the general Workspace no-advertising commitment.
3. Check which organizational units have Gemini enabled, and whether under-13 and 13-17 access matches your district's intended policy rather than the post-August-2025 default.
4. Confirm the Google AI Pro for Education add-on, if purchased, is restricted to staff and designated adult students in your admin console, not accidentally open to younger accounts.
5. Document who at the district formally authorized Gemini for educational use, satisfying the school-consent recordkeeping the 2025 COPPA amendments increasingly expect.
6. Set a review date tied to your contract renewal to re-check Google's subprocessor list and feature set, since Google changed Gemini's education access model three separate times across 2025 and into 2026.

Say you're a technology director evaluating Gemini for a district that already runs Workspace for Education broadly. The practical work isn't re-litigating whether Google is "COPPA compliant" in the abstract; it's confirming your specific signed terms actually name Gemini, checking your admin console's age-based access groups match your intended policy, and getting the no-training commitment in writing rather than assuming a general Workspace promise automatically covers a newer product.

Related Reading

• AI, FERPA & COPPA: The Complete School Data-Privacy Guide (2026)
• Diffit and Student Data Privacy: What Teachers Should Know
• Gradescope and Student Data Privacy: What Teachers Should Know
• Is Edpuzzle Safe for Students?
• Is Turnitin Safe for Students?
• SchoolAI vs Khanmigo: Which Is Better for Teachers?