COPPA governs the online collection of personal information from children under thirteen in the United States. It requires verifiable parental consent before collection, limits retention, requires disclosure of what is collected and why, and gives parents the right to review and delete. In education it operates alongside FERPA, and schools may consent on a parent's behalf in defined circumstances.
COPPA
Statute United States
COPPA is the strictest consent regime reaching any market in this research, because the subject cannot give consent themselves. Every K-12 EdTech product in the United States operates inside it, and the mechanism it depends on — verifiable parental consent, sometimes exercised by the school — is a delegation chain with at least three parties in it.
- Verifiable parental consent - Not a checkbox: the standard requires a method reasonably calculated to confirm a parent gave it.
- School-based consent - In an educational context a school may consent on the parent’s behalf for school purposes, which moves the delegation.
- Data minimisation and retention limits - Collect what the activity needs, keep it no longer than necessary.
- Parental review and deletion - Rights that have to be honoured across every downstream system the data reached.
- FTC enforcement - Civil penalties per violation, and an active enforcement record against EdTech.
COPPA makes the education market’s consent gap concrete. A parent consents, a school sometimes consents on their behalf, a vendor relies on that consent, and a subprocessor relies on the vendor — and at no point in The State of Education & EdTech APIs’s 814-organization cohort is that chain expressed as anything a machine can read. The K-12 segment carrying the heaviest COPPA exposure scores 17.3 and publishes a machine-readable contract 15.9% of the time.
Referenced in API Evangelist papers
This regulation shows up in my published research. These reports read the machine-readable evidence provider by provider — and put this regulation in the context of a real sector.
The State of Education & EdTech APIs
Verifiable parental consent, sometimes exercised by a school — a three-party delegation chain expressed nowhere machine-readable, in the K-12 segment scoring 17.3.
