Is Khanmigo COPPA Compliant?

Khan Academy holds no third-party COPPA Safe Harbor certification, its compliance claim is self-attested the same way nearly every AI vendor's is, but it is one of the few vendors in this space that has actually built two separate, real consent mechanisms for under-13 access rather than simply excluding that age group. That distinction matters, because it separates Khan Academy from a vendor whose "COPPA compliant" claim is only a sentence on a pricing page.

Quick Answer: No government or FTC-approved Safe Harbor organization (iKeepSafe, PRIVO, or kidSAFE) currently lists Khan Academy as a certified participant, so its FERPA, COPPA, and PPRA compliance claims are self-attestations, made in its own privacy materials and in Data Protection Agreements signed with individual districts. What sets Khan Academy apart from most vendors this guide covers is that it has built a real school-as-agent pathway for classroom use and a separate parent-controlled account structure for direct, at-home access, rather than simply barring anyone under 13 the way OpenAI does with consumer ChatGPT. Neither pathway carries independent certification, but both are genuine mechanisms, not marketing language. Practical account setup lives in Khanmigo and Student Data Privacy: What Teachers Should Know, and the content-moderation safety question has its own guide in Is Khanmigo Safe for Students?.

That difference, built consent mechanisms versus a hard age exclusion, is the actual story here, and it's worth reading past the headline "self-attested, not certified" framing to see why. This guide walks through what COPPA requires, whether Khan Academy holds any real third-party verification, how its two consent pathways actually work, and where the honest limits of a self-attested claim still sit.

COPPA's Actual Test, Applied Here

The Children's Online Privacy Protection Act, enforced by the Federal Trade Commission under 16 CFR Part 312, requires an operator to obtain verifiable parental consent before collecting personal information from a child under 13, unless a specific exception applies. AI, FERPA & COPPA: The Complete School Data-Privacy Guide (2026) covers the full legal framework; this article applies that framework specifically to Khan Academy and Khanmigo.

The relevant exception for schools is longstanding FTC guidance letting a school consent on a family's behalf, but only when data is collected solely for the use and benefit of the school, for an educational purpose the school authorized, with no other use layered on top. Whether Khan Academy's actual practices fit that narrow test, and what happens outside a school context entirely, is the question the rest of this guide answers.

It's worth noting upfront why this particular vendor deserves a closer look than most. A tool that only ever touches a 15-year-old's data raises COPPA questions rarely, since COPPA's trigger is age, not subject matter. Khan Academy Kids markets directly to preschoolers, Khan Academy's core academic platform serves elementary students by the millions, and Khanmigo itself is used across that same young range. Few AI vendors in this space have as much direct, structural exposure to the under-13 population as Khan Academy does, which makes the strength of its actual consent mechanism, not just the presence of a compliance sentence, a genuinely higher-stakes question here than it is for a tool mostly used by high schoolers.

Does Khan Academy Hold a COPPA Safe Harbor Certification?

No. Based on the FTC's own list of approved Safe Harbor programs, Khan Academy does not currently appear as a certified participant in any of the three active COPPA Safe Harbor organizations.

That means Khan Academy's compliance claims, including the FERPA, COPPA, and PPRA assertions in its Data Protection Agreements, are self-attestations rather than independently reviewed certifications. It's worth being precise about what that word means in practice: self-attested is not the same as false, and it is not unusual. The overwhelming majority of AI-in-education vendors in this space operate exactly the same way, since Safe Harbor participation is voluntary and expensive, and most vendors, this includes EduGenius, rely on contractual assurance rather than third-party certification.

The Two Real Consent Pathways Khan Academy Has Built

Where Khan Academy diverges from most vendors is not the certification question, it's that it has built two distinct, functioning consent mechanisms for under-13 users, rather than only relying on one. Most classroom AI tools in this corpus lean on the school-as-agent pathway alone. Khan Academy layers a second, direct pathway on top of it.

Pathway One: School-as-Agent, Through a Signed District Agreement

A child under 13 cannot create their own Khan Academy account independently. According to Khan Academy's own Terms of Service and Privacy Policy, a teacher or authorized school employee can create an account for a student, and doing so assumes the school has already obtained the parent or guardian's consent (Khan Academy, Terms of Service and Privacy Policy). School personnel are described as solely responsible for providing the notices and obtaining the consents COPPA and similar laws require.

That responsibility gets formalized in writing through Data Protection Agreements Khan Academy signs with individual districts, agreements filed with organizations like the Student Data Privacy Consortium that assert FERPA, COPPA, and PPRA compliance and specify how the district authorizes data collection from students under 13 (Student Data Privacy Consortium, Khan Academy Data Privacy Agreement, 2024). This is the same school-official mechanism that underlies most classroom AI tools; nothing about it is unique to Khan Academy on its own.

Pathway Two: Direct Parent Consent, Through a Parent-Held Account

The second pathway is where Khan Academy's design differs from a tool like ChatGPT, which offers no under-13 access at all outside a school. A parent can create a Khan Academy account for their own child directly, or link a child's account to their own, entirely outside any school relationship (Khan Academy Help Center, "If my child is younger than age 13, what login options are there?").

That structure means a parent, not just a school, can be the entity actually granting and controlling a young child's access, which functions as a form of direct parental gatekeeping even without a formal document labeled "verifiable parental consent" in the FTC's strictest technical sense. It is a genuinely different design decision than simply setting an age floor and stopping there.

How Khanmigo Itself Handles the Under-13 Account Question

Khanmigo, the AI tutor specifically, adds a third layer on top of both pathways above: the account holder who can open Khanmigo at all must be 18 or older, and a younger student gets access only when that adult explicitly enables it through their own account settings. A parent or teacher, once granted Khanmigo access themselves, can turn on access for a linked child account; a child cannot independently sign up for Khanmigo the way an adult can.

Placed next to how other major AI vendors in this space have approached the same under-13 problem, the three approaches look genuinely different:

One-sentence takeaway: Khan Academy is the only one of these three that has built a working, direct-to-parent access mechanism in addition to the school pathway, even though none of the three carries independent Safe Harbor certification.

Don't Confuse Khanmigo With Khan Academy Kids

Khanmigo and Khan Academy Kids are two different products, and conflating them muddies an otherwise clear picture. Khan Academy Kids is a separate, standalone app aimed at children roughly ages two through eight, built around early literacy and math content rather than the AI-tutoring chat interface Khanmigo provides.

Khan Academy Kids' own privacy policy describes a narrow data-collection footprint: a parent's email address to set up the account, plus the child's first name and age, along with basic usage and progress data (Khan Academy Kids Privacy Policy). It states it does not collect photos, precise location, or contact information from children, and does not use collected data for advertising or marketing purposes.

That narrower app is not the same product as the AI tutor this guide is about, and a district or parent evaluating "Khan Academy and young children" should be clear about which product is actually in question, since the account structure, data footprint, and AI-interaction design differ between them.

Is a Self-Attested Claim Actually Worth Anything Here?

A self-attested compliance claim is weaker evidence than independent certification, but it is not meaningless, and treating every self-attestation as equally thin misses real differences between vendors. Three things are worth weighing separately when judging Khan Academy's specific claim.

1. A signed, filed Data Protection Agreement is a real, enforceable contract, distinct from a general privacy policy a company can rewrite unilaterally. A district holding one has an actual legal document to point to, even without a third-party seal behind it.
2. Khan Academy's nonprofit status removes one common incentive problem. A company selling targeted advertising against children's data has a structural reason to interpret consent loosely; a nonprofit funded primarily through philanthropy and grants has a weaker version of that same incentive, according to its own public statements about its funding model.
3. Common Sense Media's independent 2025 AI ratings scored Khanmigo in the four-to-five-star range for privacy specifically (Common Sense Media, 2025). That is a genuine third-party signal worth citing, but it is important not to overstate what it is: a nonprofit's quality rating is not the same instrument as an FTC-approved COPPA Safe Harbor certification, and the two shouldn't be described interchangeably.

None of that adds up to "certified compliant." It adds up to a self-attested claim with more supporting structure behind it than a bare marketing sentence, which is a meaningfully different thing to hand to a district's legal reviewer.

A Practical Scenario: Piloting Khanmigo With a Young Grade Band

Say you teach a 4th grade math class and your school's curriculum coordinator is considering a small Khanmigo pilot for guided fraction practice. Working through the consent question concretely, rather than assuming it's already handled, looks like this in practice.

• Check which pathway applies first. If the pilot rolls out through your school's IT department with district-issued logins, that's the school-as-agent pathway, and the real question is whether your district's Data Protection Agreement with Khan Academy is actually signed and covers this specific use, not just whether the login screen works.
• Don't assume a working login means consent is settled. A student account can technically function while the underlying agreement is still in legal review, expired, or was never actually executed for your building specifically.
• Ask who enabled Khanmigo access for each account, since a district-created account and a family's separately purchased parent plan are two different consent pathways that shouldn't get treated as interchangeable in your pilot notes.
• Document the answer, in writing, before students start using it, rather than relying on an assumption that "someone in the office handled the paperwork."

None of that requires you to become a privacy officer. It requires treating "is this actually authorized" as a real question with a real answer, the same way you'd confirm a field-trip permission slip was actually returned before the bus leaves.

A Practical Checklist for Districts Evaluating Khanmigo's COPPA Posture

Work through these questions in order before rostering students under 13 into any Khan Academy product.

1. Request the actual signed Data Protection Agreement, not just a link to the general privacy policy, and confirm it specifically addresses students under 13.
2. Confirm which product is actually being deployed: Khanmigo the AI tutor, Khan Academy's broader academic platform, or the separate Khan Academy Kids app, since each has a different data footprint.
3. Verify whether accounts for younger students will be teacher-created, parent-created, or both, and document which consent pathway applies to which group of students.
4. Ask whether any FTC-approved Safe Harbor organization has reviewed the specific product, and treat a "no" honestly rather than assuming a nonprofit's mission substitutes for third-party verification.
5. Check your state's own student-privacy statute, since a Khan Academy DPA satisfying federal COPPA and FERPA does not automatically satisfy a stricter state law layered on top.
6. Route the final decision through legal or your student-data-privacy officer, the same standard this guide applies to every AI vendor, nonprofit or not.

Where a Content-Generation Platform Sidesteps the Question

For districts wanting to avoid the account-based consent question entirely for a specific category of classroom material, it's worth knowing there's a structurally different option available. EduGenius can generate quizzes, worksheets, and review materials directly from a class profile a teacher configures with grade level and subject, with no student holding an account or typing into the product at all. That doesn't answer the COPPA question for an interactive AI tutor like Khanmigo, which is built specifically around a live, ongoing student conversation, but for the subset of classroom tasks that don't require that interaction, it removes the under-13 account question from the equation by design rather than by consent mechanism.

Related Reading

• AI, FERPA & COPPA: The Complete School Data-Privacy Guide (2026)
• Khanmigo and Student Data Privacy: What Teachers Should Know
• Is Khanmigo Safe for Students?
• Diffit and Student Data Privacy: What Teachers Should Know
• Newsela and Student Data Privacy: What Teachers Should Know
• Is Grammarly Safe for Students?
• Is Quizizz Safe for Students?
• SchoolAI vs Khanmigo: Which Is Better for Teachers?