Is SchoolAI COPPA Compliant?
SchoolAI states that it is COPPA compliant, but that specific phrase is a self-attestation, not enrollment in an FTC-approved Safe Harbor program. Under-13 students can still use SchoolAI lawfully when a district consents on families' behalf for a strictly educational purpose, the pathway COPPA allows through the school. The open question for a teacher is not whether the badge exists, but what backs it.
Quick Answer: SchoolAI describes itself as COPPA compliant based on internal legal review and contractual commitments, which is a legitimate but self-reported basis. It is not currently listed in an FTC-approved COPPA Safe Harbor program (iKeepSafe, PRIVO, or kidSAFE), unlike MagicSchool, which iKeepSafe lists. For grades below 7, the practical requirement is a district acting as the parent's agent under a signed agreement, not a seal on a webpage.
This article stays narrowly on the COPPA question for children under 13. The broader combined legal picture, covering both FERPA and COPPA claims side by side, along with SchoolAI's SOC 2 Type II audit and its full list of stated certifications, already lives in Is SchoolAI Safe for FERPA and COPPA?. Rather than re-walk that ground, this piece drills into one thing: the under-13 consent mechanics, and why "self-attested" and "Safe Harbor certified" are two genuinely different answers to the same question.
What COPPA Actually Triggers On, and Why Age 13 Is the Line
COPPA (the Children's Online Privacy Protection Act, 16 CFR Part 312) regulates the online collection of personal information from a child under 13, and requires verifiable parental consent before that collection happens. The Federal Trade Commission enforces it directly against the operator, not through a school's funding. The age line is exactly 13: a Grade 7 or Grade 8 classroom often sits right on top of it, which is why middle-school teachers hit this question more than anyone.
Two facts about that trigger matter for a tool like SchoolAI:
- The trigger is a collection event, not a product's mere existence. COPPA duties attach when personal information is actually collected from a known child under 13, so what SchoolAI collects during a chat session is the thing under scrutiny, not the branding.
- "Personal information" is broad. It includes a name, an email, a persistent identifier like a device ID, and content a child types that is tied back to them, which a conversational tool naturally generates.
RAND's 2025 survey of U.S. principals found that 70% cited data privacy concerns as a major or minor factor shaping their AI purchasing decisions (RAND, 2025). That concern lands hardest on tools where students type directly into a chat interface, because that is precisely where a collection event from an under-13 child can occur.
The School-Consent Pathway That Makes Under-13 Use Legal
Longstanding FTC guidance lets a school act as the parent's agent and provide COPPA consent on a family's behalf, but only under narrow conditions. This is the mechanism that allows a Grade 5 class to use a tool like SchoolAI without collecting a signed form from every household. It is not a loophole; it is a specific, conditional pathway.
The school-consent pathway holds only when all of the following are true:
- The tool is used strictly for an educational purpose the school has authorized.
- The data is not used for a commercial purpose such as targeted advertising.
- The school has been given notice of what is collected and how it is handled.
If any of those conditions fails, the school-consent pathway does not cover the use, and the operator would need direct verifiable parental consent instead. That is why a district-provisioned SchoolAI account under a signed agreement is structurally different from a teacher's personal signup: the agreement is what documents the educational purpose and the notice the pathway requires.
Self-Attestation vs. Safe Harbor: The Distinction That Decides the Answer
COPPA has exactly one government-recognized vendor mechanism, and it is the FTC-approved Safe Harbor program, not a "COPPA certified" badge a company writes for itself. This is the crux of the whole question. When SchoolAI states it is COPPA compliant, it is making a self-attestation, which is common, legal, and not inherently suspect, but it is a weaker tier of evidence than an independent review.
Here is how the tiers actually rank for COPPA specifically:
| Evidence tier | What it means | How independently verified |
|---|---|---|
| Self-attestation | The vendor reviews its own practices against COPPA and declares compliance | Not verified by any outside body; the vendor is grading its own work |
| Signed Data Processing Agreement | A binding contract with a specific district locking in use and consent terms | Enforceable, but only for the signing district, and only as strong as its language |
| FTC-approved Safe Harbor | An FTC-sanctioned organization reviews the vendor under 16 CFR § 312.11 | Strongest available signal; an outside body checked the practices, subject to FTC oversight |
The FTC currently approves a small set of Safe Harbor organizations, including iKeepSafe, PRIVO, and kidSAFE (with CARU, ESRB, and TRUSTe also on the list). A vendor that joins one has its data practices audited by that organization rather than simply asserting compliance. As of the FTC's 2025 rule changes, these programs must publicly disclose their member lists, which means a district can now look a vendor up rather than take a claim on faith (FTC, 2025).
Where SchoolAI Sits, and Why the MagicSchool Contrast Is Instructive
SchoolAI is not currently listed as a participant in any FTC-approved COPPA Safe Harbor program, while MagicSchool is listed by iKeepSafe. That is not an accusation against SchoolAI; a company can be entirely truthful in calling itself COPPA compliant without ever enrolling in Safe Harbor. It is simply a different, less independently verified path.
The contrast is useful precisely because both tools say "COPPA compliant" on their materials:
- MagicSchool appears on iKeepSafe's published product list, meaning an FTC-approved organization reviewed its practices against COPPA standards.
- SchoolAI describes its COPPA posture as internal and contractual, backed by its own legal review rather than a named third-party program.
Both can be legitimate. The point for a teacher or a district is to know which one you are relying on, because the two phrases sit two tiers apart on the evidence ladder above. If a district has assumed the phrases mean the same thing, that assumption is the actual risk, not either vendor's honesty.
What SchoolAI States About Under-13 Data Specifically
SchoolAI states that student data is never sold, shared with advertisers, or used to train AI models, and that its subprocessor contracts prohibit pretraining or fine-tuning on that data. Those are the company's own stated commitments, and they are the substance behind the self-attestation. A district's job is to confirm they hold up in writing, not to assume they do.
The table below narrows to the COPPA-relevant claims only, and is a smaller, purpose-built version of the fuller breakdown in the Is SchoolAI Safe for FERPA and COPPA? companion article.
| COPPA-relevant question | What SchoolAI states | What actually backs it |
|---|---|---|
| Verifiable consent for under-13 users | Operates under the school-as-agent educational pathway | The district's signed agreement, not a vendor badge |
| No training on student data | Contracts bar subprocessors from training on it | Contractual and self-reported; confirm in the DPA |
| No commercial use of children's data | Data not sold or shared with advertisers | Self-reported; the school-consent pathway depends on this being true |
| Independent COPPA review | Described as internal and contractual | No Safe Harbor listing found; MagicSchool contrasts here |
Reading down that last column, the pattern is consistent: the strength of SchoolAI's COPPA position rests on a district-level contract and the vendor's own word, not on an FTC-approved reviewer having signed off. That is a workable posture, but it puts more verification work on the school.
How the FTC's 2025 COPPA Amendments Change the Under-13 Question
The FTC published its first COPPA Rule amendments since 2013 on April 22, 2025, with most substantive provisions requiring compliance by April 22, 2026 (FTC, 2025). For a conversational tool used by under-13 students, three of those changes raise the bar on exactly the questions a district should be asking SchoolAI.
- Separate consent for third-party sharing. A single bundled consent no longer covers disclosure to third parties; that now needs its own standalone verifiable consent, which matters because most classroom AI tools pass data to an underlying model provider.
- Written, published data-retention limits. Children's data may be kept only as long as reasonably necessary for its original purpose, under a written policy, rather than indefinitely.
- Documented subprocessor security vetting. Operators must take documented steps to confirm that third parties receiving children's data can protect it, with written assurances.
The volume of tools makes this hard to police informally. Districts have access to an average of nearly 3,000 distinct edtech tools in a given year, according to Instructure's LearnPlatform data (Instructure, 2025), far more than any privacy office can vet line by line. A tool whose COPPA posture rests on self-attestation, rather than a Safe Harbor listing a reviewer can pull up, simply needs more of that scarce attention per rollout.
The Under-13 Line Runs Straight Through Middle School
COPPA's cutoff is a birthday, not a grade, and in a typical middle school that line runs right through the building. A Grade 6 class is almost entirely under 13; a Grade 7 class is a mix; a Grade 8 class is mostly over. That patchwork is exactly where a self-attested COPPA claim gets tested in practice, because a tool's obligations can shift student by student within one roster.
Two situations create most of the confusion:
- Mixed-age classes. When some students in a Space are 12 and others are 13, the under-13 protections still have to cover the younger ones, so a district cannot treat a whole class as exempt just because most students have already turned 13.
- The "actual knowledge" trigger. COPPA covers a general-audience service the moment it has actual knowledge that a specific user is under 13. A district roster carrying birthdates can supply exactly that knowledge, which is one reason the school-consent pathway and a documented educational purpose matter even for a tool marketed to older grades.
When a Younger Class Borrows an Older Grade's Tool
A quiet failure worth watching for: a tool approved for Grade 8 gets adopted by a Grade 5 teacher who saw a colleague using it, without anyone re-checking the age assumptions. The moment under-13 students start typing into it, the COPPA analysis resets, and a district approval scoped to older students may not actually cover the younger ones. Age-banding a tool at adoption, and revisiting that band each year, closes the gap before it opens rather than after.
A Teacher's Practical Steps to Confirm SchoolAI's COPPA Posture
Before a class of under-13 students uses SchoolAI regularly, confirm the consent basis in writing rather than assuming the marketing page settles it. None of these steps require a law degree; they require asking specific questions and getting specific answers.
- Confirm your account is district-provisioned, not a personal signup. The school-consent pathway depends on a district-level agreement documenting the educational purpose; a personal account sits outside that structure.
- Ask directly whether SchoolAI participates in an FTC-approved Safe Harbor program. If the answer is no, that is not disqualifying, but it tells you the COPPA claim is self-attested and warrants closer contract review.
- Get the no-training commitment in writing, extended to the model provider. A promise that stops at SchoolAI's own layer leaves a gap where the underlying model calls happen.
- Confirm the written retention and deletion timeline meets the 2025 amendment's requirement for a specific, published policy.
- Check your state's student-privacy statute, since laws like Illinois's SOPPA and California's SOPIPA can impose duties that do not track COPPA's federal collection trigger.
Say you teach Grade 6 science and want students to use a SchoolAI Space for guided review before a unit test. A ten-minute conversation with your technology office, confirming the district agreement exists and asking the Safe Harbor question directly, either turns the vendor's claim into something enforceable or surfaces a gap worth knowing about before thirty students start typing.
For a teacher whose goal is differentiated review content rather than live student chat, a content-generation tool sidesteps the under-13 collection question entirely. EduGenius can generate quizzes, worksheets, flashcards, and revision notes from a class profile a teacher configures with grade level, subject, and ability range, so students receive prepared materials without ever creating an account or typing into a model. That is a structurally different design, not a claim that one tool is universally better than the other.
Expert Advice for Pressure-Testing a Self-Attested COPPA Claim
Because the COPPA posture here is self-attested, the useful move is to ask the questions a Safe Harbor reviewer would ask, and see whether the vendor can answer them in writing. These are the questions that separate a real internal compliance program from a marketing sentence.
- Ask which specific fields the system stores for a student. A precise, itemized answer signals a real data map; a vague one signals the claim has not been stress-tested internally.
- Ask for the subprocessor list by name, then confirm each one's own training and retention terms rather than accepting a summary of them.
- Ask when the retention clock starts and stops, since the 2025 amendments require a specific, published timeline rather than "as long as necessary."
- Ask whether the no-commercial-use promise is contractual, because the school-consent pathway collapses if children's data is ever used for advertising.
- Put the answers in the DPA, not an email thread. A promise that lives only in correspondence is far harder to enforce than one written into the signed agreement.
Getting written answers to these five turns "SchoolAI states it is COPPA compliant" into something a district can actually stand behind, which is the entire point of the exercise.
What to Avoid When Judging SchoolAI's COPPA Claim
- Treating "COPPA compliant" and "Safe Harbor certified" as the same statement. They sit two evidence tiers apart; MagicSchool's iKeepSafe listing versus SchoolAI's self-attestation is the clearest illustration of the gap.
- Assuming a free teacher account inherits the district's consent basis. The school-consent pathway needs a district agreement behind it; a personal signup with a class roster does not have one.
- Skipping the subprocessor question because the chat feels self-contained. A no-training promise is only as strong as whether it reaches the foundation-model provider behind the product, in writing.
- Reading a SOC 2 report as a COPPA answer. SOC 2 verifies security controls, not children's-privacy consent practices; the two are different audits, and one does not substitute for the other.
Key Takeaways
- SchoolAI's COPPA claim is a self-attestation, legitimate but self-reported, and not the same as enrollment in an FTC-approved Safe Harbor program.
- SchoolAI is not currently listed in a Safe Harbor program (iKeepSafe, PRIVO, kidSAFE), whereas MagicSchool is listed by iKeepSafe, which is the sharpest available contrast on independent verification.
- Under-13 students can use SchoolAI lawfully through the school-consent pathway, but only when the use is strictly educational, non-commercial, and covered by a district agreement with proper notice.
- The FTC's 2025 COPPA amendments added separate third-party consent, written retention limits, and documented subprocessor vetting, raising the bar for tools serving children under 13.
- A district-provisioned account, not a personal teacher signup, is what actually documents the consent basis the school-as-agent pathway requires.
- A self-attested COPPA posture demands more verification per rollout, since no FTC-approved reviewer has independently checked it the way a Safe Harbor listing implies.
Frequently Asked Questions
Is SchoolAI COPPA certified by the FTC?
No. There is no government "COPPA certified" seal, and SchoolAI is not currently listed in an FTC-approved Safe Harbor program such as iKeepSafe, PRIVO, or kidSAFE. SchoolAI states it is COPPA compliant based on internal legal review and contractual commitments, which is a self-attestation rather than independent third-party certification.
Can students under 13 use SchoolAI legally?
Often yes, through COPPA's school-consent pathway, where a district acts as the parent's agent for a strictly educational, non-commercial purpose and receives notice of what is collected. That pathway depends on a district-level agreement being in place and on SchoolAI's actual data practices matching what the pathway permits, which a district should confirm before rollout.
How is SchoolAI's COPPA claim different from MagicSchool's?
Both state they are COPPA compliant, but MagicSchool appears on iKeepSafe's published Safe Harbor product list, meaning an FTC-approved organization reviewed its practices. SchoolAI describes its COPPA compliance as internal and contractual, with no Safe Harbor listing found. That is a two-tier difference in independent verification behind the same phrase.
Does SchoolAI's SOC 2 audit prove it is COPPA compliant?
No. A SOC 2 Type II audit verifies security controls like encryption, access management, and monitoring; it does not evaluate COPPA-specific consent or children's-privacy practices. A tool can hold a genuine SOC 2 report and still have a purely self-attested COPPA posture, which is why the two questions need separate answers during procurement.
What should a district confirm before under-13 students use SchoolAI?
Confirm a district-provisioned account and signed agreement exist, ask directly whether SchoolAI participates in an FTC Safe Harbor program, get the no-training commitment extended to the model provider in writing, verify the published retention timeline, and check your state's student-privacy law. See the complete school data-privacy guide for the full framework.