Is Grammarly COPPA Compliant?
Grammarly states that it does not knowingly collect personal information from children under 13 on a standard consumer account, but that protection changes once the account is provisioned through a Grammarly for Education team. Grammarly's own Terms of Service set the baseline consumer age at 13 under US law (16 under EU law), and the company's privacy materials describe a separate institutional consent model for schools.
As with any vendor, "COPPA compliant" is Grammarly's own description of its practices, not a government-issued badge, so the details of that institutional model matter more than the label.
Quick Answer: Grammarly's consumer product is built for users 13 and older; Grammarly for Education is the pathway schools use to bring younger students on, with the district providing consent on families' behalf and administrators holding account-level controls. There is no evidence in Grammarly's public compliance materials that it participates in an FTC-approved COPPA Safe Harbor program (iKeepSafe, PRIVO, or kidSAFE). A district that wants that specific assurance should ask Grammarly directly and confirm current terms before rolling the tool out to students under 13.
This article breaks down what Grammarly actually says about age, consent, and data handling, why the answer differs so sharply between a personal Grammarly account and a Grammarly for Education seat, and what a teacher or administrator should check before assigning it to an elementary or middle school class.
Grammarly is an assistive writing tool a student uses directly, which raises different questions than an AI detector like GPTZero, where the student's writing is scanned rather than actively used. If that distinction matters for your district's policy, whether GPTZero is safe for students covers the detector side of that comparison.
What COPPA Actually Requires From a Tool Like Grammarly
COPPA regulates the vendor directly, not the school, whenever an online service knowingly collects personal information from a child under 13. For a writing-assistant tool that processes typed text, that requirement centers on notice, verifiable parental consent, and limits on how the data collected can be used.
Schools have a narrow, well-established way around collecting consent from every family individually. Longstanding FTC guidance lets a school act as the parent's agent and consent to data collection on a family's behalf, but only when three conditions hold:
- The tool is used strictly for an educational purpose the school has authorized, not a general-purpose consumer use.
- The data is not used for commercial purposes, like targeted advertising or building a marketing profile.
- Families are notified of what the school has approved and what data the tool collects.
For more on how this school-as-agent pathway works alongside FERPA, see this complete school data-privacy guide, which walks through both laws side by side. The short version for Grammarly specifically: whether that pathway actually protects a district depends entirely on which Grammarly product the students are using.
Grammarly's Stated Age Requirements
Grammarly's own Terms of Service require a consumer user to be at least 13 years old under US law, or 16 under EU law, to create an account. That age floor applies to the product most people think of when they hear "Grammarly": the free browser extension and web editor an individual signs up for directly.
The consumer product (individual accounts)
Grammarly's privacy documentation states it does not knowingly collect personal information from anyone under 13 on a standard individual account. If the company determines it has done so anyway, it says it will take reasonable steps to remove that information. That is a fairly standard consumer-app COPPA posture, and it is also why a personal Grammarly sign-up is not the right way to bring a Grade 4 or Grade 5 class onto the tool.
Grammarly for Education (institutional accounts)
The age floor changes once an account sits inside a Grammarly for Education team. Grammarly's own materials describe this as a different consent model: the institution, not each individual family, sets up the account, and Grammarly for Education is explicitly marketed to K-12 schools working with students younger than 13. That only functions as real COPPA protection if the district's own consent and notification practices satisfy the school-as-agent conditions above, because Grammarly for Education itself does not replace that district-level responsibility.
| Dimension | Consumer Grammarly (individual account) | Grammarly for Education (institutional account) |
|---|---|---|
| Stated minimum age | 13 (US) / 16 (EU) per Grammarly's Terms of Service | No individual minimum; access is provisioned by the school for a class or cohort |
| Who consents | The individual user, by accepting the Terms directly | The district or school, acting as consent-giver under the COPPA school-as-agent pathway |
| Account oversight | User controls their own account | School administrators can access account-related information and manage or restrict access |
| Default AI training setting | Product Improvement and Training setting varies by user choice | Off by default, per Grammarly's own Education account documentation |
| Typical audience | General public, professionals, older students | K-12 and higher-ed institutions, including elementary-age cohorts |
The practical takeaway: a school that wants to use Grammarly with students under 13 should be doing so through Grammarly for Education specifically, with a signed agreement in place, not through individual student sign-ups on the consumer product.
What Grammarly Says About Handling Student Data
Grammarly for Education's own account documentation states that the Product Improvement and Training setting is off by default for education accounts, meaning student writing is not used to train Grammarly's models unless that setting is deliberately changed. That default matters more for younger students, whose writing samples carry more identifying detail (names, family references, home addresses in a personal narrative assignment) than a college essay might.
A few other features shape what a district is actually agreeing to:
- Authorship, Grammarly's writing-process tracking feature, records keystroke-level activity (typing, pasting, editing patterns) so a teacher can review how a piece of writing was produced. That is a meaningfully different data footprint than spell-check alone, since it captures process data, not just a finished document.
- Admin-level AI controls let a Grammarly for Education administrator manage which AI-assisted features (like generative rewriting or tone suggestions) are available to a given group of students, rather than leaving that choice to each individual account.
- Account access and deletion rights sit with the school administrator for Grammarly for Education accounts, which is part of what makes the school-as-agent consent model workable in the first place; a family or eligible student generally routes a request through the school, not directly through Grammarly's consumer support channel.
None of these are COPPA "certifications." They are product design choices Grammarly states it has made, and a district's actual protection still comes from the signed agreement it has with Grammarly, not from a feature list on a marketing page.
Retention and deletion are worth asking about directly, too. A district evaluating any writing tool, not just Grammarly, should get a specific answer to "how long is a submitted draft kept, and what happens to it when a student leaves the district," in writing, rather than a general statement that data is "securely stored." A vague answer on retention is exactly the kind of gap a data security compliance checklist for AI tools in schools is built to catch across any AI vendor, not just this one.
Is There a COPPA Certification Grammarly Holds?
No FTC-approved Safe Harbor organization is named in Grammarly's public compliance materials as having reviewed its practices. COPPA's one real, government-recognized vendor mechanism is the voluntary Safe Harbor program under 16 CFR § 312.11, administered by independent organizations like iKeepSafe, PRIVO, and kidSAFE. A search of Grammarly's own privacy and terms pages does not surface a Safe Harbor participation claim.
That absence is not itself evidence of wrongdoing; participation is entirely voluntary, and many legitimate edtech vendors operate without it, relying instead on the DPA-and-contract model described throughout this guide. But it does mean a district cannot point to third-party Safe Harbor review as its evidence when justifying Grammarly's use with under-13 students. The actual evidence has to be the signed agreement itself, whatever data-processing terms it contains, and Grammarly's stated defaults like the Product Improvement and Training setting described above.
State Laws Can Add Requirements Federal COPPA Doesn't Cover
COPPA is a federal floor, not a ceiling, and more than a dozen states layer their own student-data-privacy statutes on top of it. A Grammarly for Education agreement that satisfies federal COPPA is not automatically enough in a state with a stricter law of its own.
California's Student Online Personal Information Protection Act (SOPIPA, 2014) and Illinois's Student Online Personal Protection Act (SOPPA, 2021) both restrict how a vendor may use student data more tightly than COPPA alone requires, including limits on profiling and advertising that go beyond the federal standard. A district in either state, or any state with a similar law, needs its Grammarly agreement reviewed against that specific statute, not just against COPPA and FERPA.
This guide to GDPR and AI in education covers a parallel version of this same layering problem for districts with international students or EU-based staff, where GDPR sits on top of the US federal framework in much the same way a state statute does.
A Practical Checklist Before Assigning Grammarly to Younger Students
Work through these questions before rolling Grammarly out below middle school, and get written answers rather than a general "yes, we're compliant" from a sales conversation. This same five-question structure works for evaluating almost any AI tool a district is considering; Diffit and student data privacy: what teachers should know walks through the same kind of institutional-versus-individual account question for a differentiation tool instead of a writing assistant.
- Is the account provisioned through Grammarly for Education, not a personal sign-up? This is the single most important gate, since the consumer product's own age floor is 13.
- Has the district signed a data processing agreement with Grammarly, and does it name the specific retention and deletion terms?
- Is the Product Improvement and Training setting confirmed off for the district's education accounts, or does someone need to verify and lock that setting?
- Does the district's Grammarly for Education deployment include Authorship, and if so, has the added keystroke-level data collection been communicated to families?
- Who at the district reviews and signs off on the agreement: legal, a student-data-privacy officer, or procurement alone?
| Vendor statement you'll hear | What it actually tells you | Follow-up question to ask |
|---|---|---|
| "Grammarly is COPPA compliant" | A self-description; not a government or Safe Harbor certification | "Is that based on a signed DPA with our district, and can we see it?" |
| "We don't train on student writing" | A Grammarly for Education default setting, confirmed off, not a law | "Is this setting locked at the admin level, or can it be changed per user?" |
| "Grammarly for Education is built for K-12" | Accurate positioning, but the institution still holds the consent responsibility | "What specifically does the district need to do to satisfy the school-as-agent consent pathway?" |
| "Our data is encrypted and secure" | A security claim, separate from a training or retention claim | "Does that same protection apply to Authorship's keystroke-level data specifically?" |
A Grade 5 Classroom Scenario, Walked Through
Say you teach a Grade 5 writing workshop and want your class of ten-year-olds drafting personal narratives with Grammarly's suggestions turned on to catch grammar and punctuation issues before peer review. Here's how the age and consent questions actually play out in that situation, step by step.
- Check the account type first. If students would sign up individually on grammarly.com, that violates the consumer product's own 13-and-up Terms of Service; the class needs Grammarly for Education accounts provisioned by your school or district IT.
- Confirm the district already has an agreement in place, or start that conversation with your student-data-privacy office before the unit begins, not after students have already started drafting.
- Decide whether Authorship is turned on for this class. If your goal is just grammar suggestions, you may not need the writing-process tracking feature at all, which keeps the data footprint smaller for a ten-year-old's account.
- Tell families what's happening, even if your district's consent process is satisfied on paper. A short note home about which tool students are using and why closes the same communication gap Common Sense Media's 2025 research flagged nationally, where a large share of parents reported schools hadn't told them anything about classroom AI tool use at all (Common Sense Media, 2025).
None of this requires becoming a compliance expert personally. It requires knowing which two or three questions to route to the people at your district who already own that answer, and not assuming a tool is fine for a 10-year-old just because it's fine for a staff member's own writing.
Pricing Context: Why the Free Tier Isn't Automatically the Safer Choice
Say a district is weighing whether to pay for Grammarly for Education or let individual teachers use the free consumer tier informally. Cost and COPPA exposure are separate questions, and conflating them is a common mistake. Grammarly's paid Premium (sometimes marketed as Pro) plan runs around $12 per month on an annual billing cycle, while the free tier caps out at a smaller set of suggestions and a lower usage ceiling.
The free consumer tier is not the lower-risk option for younger students, because it is governed by the 13-and-up consumer Terms of Service, not the institutional consent model. A district that wants to use Grammarly with a Grade 3 or Grade 4 class needs the paid, institutional Grammarly for Education product specifically, regardless of budget, because that is the only version of the tool built around a consent pathway a school can actually rely on.
For teachers building differentiated writing assignments alongside a grammar tool like this, a platform like EduGenius can generate the leveled writing prompts, rubrics, and worksheets a class works from, while a grammar assistant handles line-level feedback on the finished draft; the two are complementary rather than overlapping tools.
Pro Tips for Administrators
- Separate "used by staff" from "assigned to students under 13" in your review. A teacher using Grammarly personally to polish a newsletter carries essentially none of the COPPA exposure that assigning it to a class of 9-year-olds does.
- Ask for the Grammarly for Education agreement in writing before a pilot expands district-wide. A verbal assurance from a sales rep is not the document that protects the district if a question comes up later.
- Re-check the Authorship feature's settings specifically, since it collects more than a typical spell-checker and is easy to overlook in a general privacy review focused on the writing suggestions themselves.
- Loop in your student-data-privacy officer or legal team, not just the classroom teacher who first found the tool useful, before it becomes a standard part of the writing curriculum.
- Review Grammarly alongside the rest of your AI tool stack, not in isolation. A district weighing several AI products at once, the way SchoolAI vs Khanmigo: which is better for teachers? evaluates two classroom AI assistants side by side, gets more consistent answers by applying one written checklist across every vendor than by reviewing each tool ad hoc as it comes up.
What to Avoid
- Don't let elementary students sign up for the consumer Grammarly product directly. The 13-and-up Terms of Service means those accounts sit outside the age range Grammarly's own consumer terms are built for.
- Don't treat "Grammarly for Education" as a compliance guarantee on its own. It is the correct product category for younger students, but the district's consent and notification practices still have to satisfy the COPPA school-as-agent conditions.
- Don't skip the DPA because a teacher already started using the free tool informally. Shadow adoption, where a class is already using a personal-account version of a tool before IT has reviewed it, is one of the most common ways student writing ends up somewhere no agreement covers.
- Don't assume a security certification like SOC 2 answers a COPPA question. Security controls and data-training/consent practices are different claims, and a vendor can be strong on one without the other being resolved.
Key Takeaways
- Grammarly's consumer Terms of Service set a 13-and-up age floor (16 in the EU); students younger than that need to be on Grammarly for Education, not a personal account.
- Grammarly for Education uses an institutional consent model, where the school provisions accounts and holds administrative oversight, aligning with COPPA's school-as-agent pathway when the district's own practices satisfy its conditions.
- The Product Improvement and Training setting is off by default for Grammarly for Education accounts, per Grammarly's own documentation, meaning student writing isn't used for model training unless that default is changed.
- No FTC-approved COPPA Safe Harbor participation is named in Grammarly's public materials, so a signed data processing agreement, not a Safe Harbor badge, is the real evidence a district can point to.
- Authorship's keystroke-level tracking is a distinct data category worth reviewing separately from ordinary grammar-suggestion data when evaluating what a district is actually consenting to.
- Cost and compliance are separate decisions; the free consumer tier is not a lower-risk option for under-13 students, because it operates under the 13-and-up Terms of Service rather than the institutional model.
- A written checklist beats a sales conversation: confirm the DPA, the training-data default, the Authorship settings, and who at the district actually signs off.
Frequently Asked Questions
Can a 10-year-old legally use Grammarly?
Not on the consumer product, which requires users to be at least 13 under Grammarly's own Terms of Service. A 10-year-old can use Grammarly through a Grammarly for Education account, provisioned by the school, which is the pathway Grammarly markets specifically for K-12 students younger than 13.
Does Grammarly sell or use student data for advertising?
Grammarly's own materials describe the Product Improvement and Training setting as off by default for Grammarly for Education accounts, meaning student input is not used to train its models by default. A district should confirm this setting directly in its agreement rather than relying on general marketing language alone.
Is Grammarly for Education the same product as free Grammarly?
No. Grammarly for Education is a separate, institutionally provisioned product with school-level administrative controls, different default privacy settings, and features like Authorship that the free consumer tier does not include. The free consumer product remains governed by the 13-and-up Terms of Service.
What should a district ask for before approving Grammarly for elementary students?
Ask for a signed data processing agreement, written confirmation that the Product Improvement and Training setting is off, details on what Authorship collects if it's enabled, and whether any FTC-approved Safe Harbor organization has reviewed the product. A verbal compliance claim alone isn't sufficient documentation for a privacy file.
Does Grammarly participate in a COPPA Safe Harbor program?
Grammarly's public compliance and privacy materials do not name participation in an FTC-approved Safe Harbor program such as iKeepSafe, PRIVO, or kidSAFE. Districts that specifically need that third-party review as part of their vendor approval process should confirm current status directly with Grammarly rather than assuming either way.
Related Reading
- AI, FERPA & COPPA: The Complete School Data-Privacy Guide (2026)
- Diffit and Student Data Privacy: What Teachers Should Know
- GDPR and AI in Education: A Guide for Administrators
- Is GPTZero Safe for Students?
- A Data Security Compliance Checklist for AI Tools in Schools
- SchoolAI vs Khanmigo: Which Is Better for Teachers?