Is Quizlet COPPA Compliant?

Quizlet states it is COPPA compliant, and unlike many "compliant" claims in edtech, this one has a real third party behind it: Quizlet's own privacy policy identifies Quizlet, Inc. as a member of PRIVO's Kids Privacy Assured program, an FTC-approved COPPA Safe Harbor. Quizlet also gates any account for a user under 13 behind a parent's email address through a separate "Child Account" flow.

Quick Answer: Yes, with real backing. Quizlet's privacy policy states it participates in PRIVO's FTC-approved COPPA Safe Harbor program, a stronger form of evidence than the self-declared compliance claims common across edtech. Under-13 users get a restricted "Child Account" that requires a parent's email, and Quizlet says it does not sell Child Account data. Verify the current details directly with Quizlet before a district-wide rollout.

Two out of three U.S. high schoolers and roughly one in two college students use Quizlet in a given month, according to figures Quizlet has published about its own reach. A tool at that scale, used heavily by middle schoolers as young as 11 or 12, is exactly the kind of product COPPA was written to govern.

This article walks through what Quizlet actually does for users under 13, what "PRIVO Safe Harbor" really means, and what a teacher or district should still check before assigning it to a class with students under the age cutoff.

Flashcard and study apps rarely get the same privacy scrutiny as an open-ended AI chat tool, mostly because they feel closer to a digital index card than a conversational agent. That framing is outdated.

Districts now have access to an average of nearly 3,000 distinct edtech tools in a given year, according to Instructure's LearnPlatform usage data (Instructure, 2025). A study app used daily by an entire grade level carries a meaningfully larger data footprint than its low-key reputation suggests, especially once AI features get layered on top of it.

Why COPPA Applies to a Flashcard App at All

COPPA doesn't distinguish between a chat tool and a study app; it applies to any operator that collects personal information from a user it knows is under 13, regardless of what the product looks like. A flashcard set tied to a real name, a class roster synced through a school account, or a voice recording used for a pronunciation feature all count as personal information under the law's broad definition.

The FTC's 2025 amendments added a narrow, useful carve-out for services that serve a mixed audience of adults and children, sometimes called age-screening. Under that provision, an operator can collect limited information for the sole purpose of determining a user's age before applying full COPPA protections, but only if that data isn't used for anything else.

Full protections kick in the moment the system identifies a child. That mechanic is effectively what happens when Quizlet's signup flow asks for a birth date and routes anyone under 13 into a Child Account rather than the standard product.

What COPPA Requires, in Brief

COPPA requires verifiable parental consent before an online service collects personal information from a child under 13. The Federal Trade Commission enforces the law directly against the operator, in this case Quizlet, rather than through the school the way FERPA does.

The FTC finalized its first COPPA Rule amendments since 2013 on April 22, 2025, with most provisions requiring compliance by April 22, 2026 (FTC, 2025). Those changes added stricter rules around consent for third-party data sharing and required operators to publish specific data-retention timelines rather than vague policies.

For the full legal breakdown of FERPA and COPPA, including how the "school official" exception and the FTC's Safe Harbor program actually work, see the pillar guide: AI, FERPA & COPPA: The Complete School Data-Privacy Guide (2026). This article focuses specifically on what Quizlet does, not the underlying law.

The One Distinction That Matters Most

Most vendors describe themselves as "COPPA compliant" through self-attestation, meaning their own legal team decided their practices satisfy the law, with no outside party checking the claim. A smaller group of vendors instead join an FTC-approved Safe Harbor program, run by an independent organization the FTC has specifically authorized to certify COPPA compliance.

• Self-attestation: the weakest, most common form of "compliant." Easy to write regardless of actual practice.
• FTC-approved Safe Harbor membership: independent review by a body like PRIVO, iKeepSafe, or kidSAFE, with periodic audits and a public dispute-resolution process.

Quizlet falls into the second category, which is worth sitting with before anything else in this article.

How Quizlet Handles a Student Under 13

Quizlet's terms describe the main product as intended for users 13 and older, but the service is open to all ages through a separate account type. Anyone who signs up and indicates they're under 13, or under 16 in jurisdictions where local law sets a higher age, gets routed into what Quizlet calls a Child Account.

Setting one up looks different from a normal signup:

1. The student provides a date of birth, a username, and a password.
2. Instead of the student's own email, Quizlet requires a parent or guardian's email address.
3. Quizlet sends that parent a message confirming the account was created and explaining the privacy choices available.
4. In certain locations, the parent must actively confirm consent through that email before the child can create or edit flashcard sets, or access written practice-test questions.

That fourth step is the actual verifiable-parental-consent mechanism COPPA requires, though Quizlet's own materials note it applies "in certain locations" rather than uniformly, which is a detail worth confirming directly if consent-gating specifics matter to your district's own documentation.

What a Parent Can Do After Setup

Once a Child Account exists, a parent retains ongoing rights over it. According to Quizlet's help documentation, a parent can sign into the child's account at any time to review, edit, or delete the account's content, or delete the account entirely. Quizlet also states it does not sell information collected from Child Accounts.

What's Actually Different in a Child Account

A Child Account isn't the same experience with a label attached; specific features are removed. Quizlet's own description characterizes it as "a limited feature set and restricted experience" compared with a standard account, though the company's public materials don't itemize every feature difference in one place.

Because of that gap in public documentation, a district piloting Quizlet with a class under 13 should click through an actual Child Account itself, rather than relying on marketing copy, to confirm exactly what's available versus what's gated behind the confirmation step above. A ten-minute walkthrough by one teacher before rollout catches surprises a policy document alone won't.

Quizlet's COPPA Certification: The PRIVO Safe Harbor

This is the fact that separates Quizlet's COPPA claim from most competitors' claims. PRIVO has operated as an FTC-approved COPPA Safe Harbor since 2004, one of a small number of organizations, alongside iKeepSafe and kidSAFE, that the FTC has authorized to independently certify COPPA compliance under 16 CFR § 312.11.

Quizlet's privacy policy states that Quizlet, Inc. is a member of PRIVO's Kids Privacy Assured program, and that the PRIVO seal posted on Quizlet's own privacy page indicates the company has agreed to submit to PRIVO's ongoing oversight and consumer dispute-resolution process. Safe Harbor membership under PRIVO's program typically includes an initial audit, six-month and yearly reviews, and continuous monitoring rather than a one-time signoff.

Two caveats keep this from being an unqualified green light. First, Safe Harbor membership certifies COPPA practices specifically; it says nothing about FERPA, which still runs through a district-level agreement the way it does for any vendor. Second, a Safe Harbor seal reflects the practices reviewed at the time of certification, not a real-time guarantee, so a district relying on it for a formal procurement decision should still confirm current membership status directly with PRIVO or Quizlet rather than only trusting the badge on a webpage.

What's Free, What's Paywalled, and Why That Matters for COPPA

Quizlet's free tier includes flashcard creation, the Match game, and a capped number of daily Learn and Test rounds per set, alongside ads. Quizlet Plus removes the ads and unlocks fuller AI-powered features, currently priced at $7.99 per month billed monthly, or $2.99 per month ($35.99 per year) billed annually, both with a 7-day free trial.

The COPPA-relevant detail sits in that ad row. Quizlet's own materials state that Quizlet and its third-party advertising partners may track users and serve more relevant ads based on collected information, but the publicly available policy language doesn't spell out, in one clear sentence, whether Child Accounts are excluded from that targeted-ad tracking the way COPPA's restrictions on advertising to known children under 13 would generally require. That's a specific, answerable question worth putting directly to Quizlet, or to your district's ed-tech privacy officer, rather than assuming either way.

The AI features sitting behind the paywall (Q-Chat and Magic Notes) matter for a different reason: any AI feature that processes what a student types raises the same "does the underlying model provider train on this input" question covered in the pillar guide. A district evaluating Quizlet Plus for a class with under-13 students should ask specifically whether the no-training and data-handling commitments extend to Q-Chat and Magic Notes, not just to the core flashcard product.

A Teacher's Practical Checklist Before Assigning Quizlet to a Class Under 13

Say you teach 6th-grade Spanish and want to assign vocabulary review sets for homework. Before rostering the whole class, a few concrete checks take less time than the assignment itself:

1. Confirm whether your district already has student accounts provisioned through a rostering system, versus students self-signing up. A district-provisioned account changes who's actually responsible for confirming consent.
2. Check each student's account type. A Child Account should already be in place for anyone under 13; if a student instead entered a birth date that skipped that flow, the account isn't gated the way it should be.
3. Ask your district's technology office whether a Data Processing Agreement with Quizlet already exists, rather than relying on the public terms of service.
4. Avoid putting identifying details in publicly visible study-set titles or descriptions, since flashcard sets can be shared or discovered depending on privacy settings a student (or their parent) controls.
5. Confirm whether AI features are enabled for your class if you're on a Plus plan, and ask specifically how Q-Chat and Magic Notes handle student input.

How Quizlet Stacks Up Against Other Vendors on This Specific Point

This is a factual comparison of publicly stated compliance mechanisms, not a ranking of overall product quality.

For a full look at how SchoolAI's own compliance claims break down, including why it currently sits in the self-attested category, see Is SchoolAI Safe for Students?

Districts weighing a study tool like Quizlet against an instructional content generator should apply the same test either way. EduGenius, for instance, is built around teacher-managed class profiles rather than individual student logins, since a teacher can generate a differentiated vocabulary quiz or flashcard set for the whole class without any student typing into the platform directly, which changes the COPPA exposure surface in the first place regardless of a vendor's certification status.