Is Microsoft Copilot COPPA Compliant?

Microsoft Copilot does not hold a COPPA certification, because no such government certificate exists for any vendor. What Microsoft has instead is an age-gating design: consumer Copilot sets a 13-year minimum, Microsoft 365 Copilot Chat in schools requires a student to be marked 13-or-older in the district's identity system, and children under 13 are excluded from the product rather than routed through a parental-consent flow.

Quick Answer: Microsoft Copilot is not "COPPA certified" because COPPA has no vendor certification program at all. Microsoft's actual approach is exclusion by age: consumer Copilot requires a minimum age of 13 (higher in some regions), Microsoft 365 Copilot Chat in K-12 depends on a student's Entra ID ageGroup attribute being set to NotAdult and enabled by the district, and students under 13 have no eligible pathway into the product. Microsoft's FERPA commitment runs through a signed Data Protection Agreement, not a public claim, and no COPPA Safe Harbor seal (iKeepSafe, PRIVO, kidSAFE) currently covers Copilot specifically.

If you have ever typed "is Microsoft Copilot COPPA compliant" into a search bar between grading stacks, you already know the honest answer is more nuanced than a yes or no. This article walks through exactly how Microsoft handles age eligibility, what its education contracts actually promise, and how that compares to the handful of AI and edtech tools that do carry an FTC-approved Safe Harbor seal.

Why "COPPA Compliant" Is the Wrong Question to Ask

COPPA does not issue compliance certificates to software companies, so asking whether Copilot is "COPPA compliant" is really three separate questions bundled into one. Untangling them is the fastest way to get a useful answer instead of a marketing slogan.

The three questions worth separating are:

1. Does the product avoid collecting data from children under 13 in the first place? (Copilot's answer: mostly, via age-gating.)
2. Has an outside, FTC-approved organization reviewed its practices under COPPA's Safe Harbor program? (Copilot's answer, as of this writing: no public listing found for Copilot specifically.)
3. Does the vendor's contract with a school satisfy FERPA's "school official" exception for any student data it does touch? (Copilot's answer: yes, through Microsoft's Online Services Data Protection Addendum.)

A vendor can answer "yes" to the third question while still not being able to answer "yes" to the second, and that gap is exactly where most confusion about AI tools and student privacy lives. The complete FERPA and COPPA guide for schools walks through this distinction in more depth if you want the full legal picture before going further here.

The three tiers of "compliant" claims

How Microsoft Actually Handles the Under-13 Problem

Microsoft's real answer to COPPA is architectural, not contractual: it keeps children under 13 out of Copilot rather than building a verifiable-parental-consent flow to let them in. That single design choice explains almost everything else in this article.

Consumer Copilot, the version at copilot.microsoft.com and in the Copilot app, sets a minimum age of 13 by default, with some countries setting the bar higher depending on local law. Full personalization and certain features remain restricted for users under 18 even once they clear that first gate, according to Microsoft's own support documentation on Copilot age limits.

Microsoft 365 Copilot Chat in K-12 schools

Inside a school's Microsoft 365 Education tenant, eligibility runs through a different mechanism: the ageGroup attribute in Microsoft Entra ID (the identity system that manages student accounts). A student account marked NotAdult, meaning 13 or older but under 18, becomes eligible for Copilot Chat once the district's IT admin turns the feature on. Microsoft announced this expansion to students aged 13 and up in 2025, framing it explicitly as a COPPA- and FERPA-driven design decision.

• Under 13: No eligible path into Copilot Chat at all inside a school tenant, regardless of parental consent, because Microsoft has not built a verifiable-consent flow for that age band in this product.
• 13 to 17 (NotAdult): Eligible for Copilot Chat once a district admin enables it; data handling differs from adult accounts, and Microsoft states it does not use young people's data to train its foundation models.
• 18 and older, including higher-ed students, faculty, and staff: Eligible for both Copilot Chat and full Microsoft 365 Copilot, the version with access to a user's own organizational files through Microsoft Graph.

That gating is precisely why a Grade 4 or Grade 6 classroom cannot legally put Copilot directly in students' hands as a chat partner today, even with a signed permission slip from every family. If you are weighing Copilot specifically for a K-9 setting, the safety-focused companion piece on whether Copilot is safe for students covers the day-to-day classroom risk side of that same age boundary.

What Microsoft's Education Contracts Actually Promise

A district's real protection with Copilot comes from its Microsoft 365 Education agreement, specifically the Online Services Terms and its Data Protection Addendum (DPA), not from a badge on a marketing page. That contract is where FERPA obligations become enforceable.

In the DPA, Microsoft agrees to be treated as a "school official" with a legitimate educational interest in customer data, the exact designation FERPA's regulations require at 34 CFR § 99.33(a) before a vendor can touch education records without individual parental consent for every disclosure. Microsoft also states that customer data is processed only as the institution directs, not scanned for advertising, and not used for purposes outside the contracted service.

A few specific commitments worth knowing before a rollout conversation:

• No advertising use. Microsoft states it does not mine Office 365 or Copilot content for ad targeting.
• Foundation-model training exclusion for minors. Microsoft's support documentation states Copilot does not use data from users under 18 to train its underlying AI models.
• Permission inheritance, not new access. Full Microsoft 365 Copilot only surfaces content a user could already see through existing SharePoint and file permissions; it does not grant new access on its own, though that also means a district's existing permission hygiene becomes Copilot's privacy boundary too.

None of that is a COPPA certificate. It is a contract, and contracts are enforceable exactly to the extent a district's own legal or IT team reviewed the specific terms rather than assuming "Microsoft" as a brand name settles the question. Other AI tutoring products aimed at K-12, including Khanmigo, face the same underlying question of how a no-training promise for minors gets documented, so it is worth reviewing more than one vendor's DPA side by side rather than assuming they are interchangeable.

Where Copilot Sits Next to Actual COPPA Safe Harbor Programs

COPPA does have one real, government-recognized vendor mechanism: the FTC-approved Safe Harbor program, run by independent organizations like iKeepSafe, PRIVO, and kidSAFE under 16 CFR § 312.11. As of this writing, no public Safe Harbor listing specifically names Microsoft Copilot, which is worth knowing before assuming every major AI vendor has cleared that bar.

That is not automatically a red flag. Plenty of large, well-governed platforms rely on contract-based compliance (the DPA route) rather than a third-party Safe Harbor review, and age-gating under-13 users out entirely sidesteps a large share of COPPA's collection-and-consent requirements by design. But it does mean a district evaluating Copilot should ask for the DPA directly rather than assuming a certification badge is sitting somewhere on Microsoft's trust site. A comparison like SchoolAI vs Khanmigo is a useful reference point for how differently two AI tutoring products in the same K-12 space can document their age and consent handling, even when both target the same grade bands.

State Laws Add a Fourth Layer on Top of COPPA

Even a district that has fully verified Microsoft's DPA and age-gating setup is not automatically done, because COPPA and FERPA are the federal floor, not the ceiling. More than a dozen states layer their own student-data statutes on top, and several were written with exactly the kind of enterprise AI feature Copilot represents in mind.

• California's Student Online Personal Information Protection Act (SOPIPA, 2014) restricts a vendor's use of student data more tightly than COPPA alone, including a ban on using covered information for targeted advertising regardless of a student's age.
• Illinois's Student Online Personal Protection Act (SOPPA, 2021) requires a specific data-sharing agreement structure between a district and any vendor touching "covered information," a category broader than FERPA's "education record" definition.
• New York's Education Law § 2-d imposes its own parental-notification and data-security-plan requirements that exist independently of whatever a vendor's federal-law posture looks like.

A Copilot rollout that clears COPPA and FERPA can still fall short of a specific state's statute, which is exactly why the practical checklist in the FERPA and COPPA guide treats "check your state law" as its own separate step rather than folding it into the federal analysis.

A Practical Scenario: A Grade 6 Teacher Weighing Copilot Chat

Say you teach a Grade 6 class and your district has just enabled Microsoft 365 Copilot Chat tenant-wide. Before assigning it to students, you would want to confirm three things, in this order.

1. Check actual ages, not just the grade level. A Grade 6 roster can include students who turned 13 over the summer and students who will not turn 13 until spring; Entra ID's ageGroup attribute should already reflect that per student, but it is worth confirming with IT rather than assuming.
2. Ask whether Copilot Chat is enabled at all for your building. District-level enablement and building-level enablement are not always the same toggle, and a teacher assuming access without confirming can create an accidental under-13 exposure if a roster mix-up occurs.
3. Decide what task actually needs a chat interface versus a teacher-directed content generator. For a differentiated reading-comprehension worksheet or a vocabulary quiz tied to a specific class profile, a teacher-controlled generator can produce the material directly from a grade level and subject without requiring any student to hold an account or type into a chat window at all, which sidesteps the age question for that specific task entirely.

That third point matters more than it sounds. A meaningful share of "AI in the classroom" use cases, quizzes, worksheets, flashcards, study guides, do not actually require student-facing AI access; they require a teacher generating differentiated material in advance. EduGenius is built around that workflow specifically, letting a teacher configure a class profile once (grade, subject, ability range) and generate content without ever putting a chat interface in front of a student who may not clear an age gate.

The same logic extends past Grade 6. A Grade 3 teacher planning a unit on states of matter, for instance, has no realistic path to putting Copilot Chat directly in front of eight-year-olds under Microsoft's current age gate, full stop. What that teacher can do is use a teacher-facing generator to build the differentiated worksheets, vocabulary flashcards, and exit-ticket quizzes for that unit ahead of time, then deliver them the way any other classroom handout would be delivered, no student account, no chat window, no age question to resolve at all.

Comparing the two access models side by side

Neither model is universally "better", a student-facing chat tool has real pedagogical value for older students practicing inquiry and research skills, while a teacher-directed generator suits younger grades and standardized-material needs. The point is that the COPPA question changes shape entirely depending on which model a specific task actually calls for.