FERPA, COPPA, and CIPA Together: The School Privacy Stack

Sort by trigger. FERPA: any disclosure of personally identifiable information from education records by a federally funded school, grades, rosters, IDs, behavioral data, to anyone including vendors; governs through consent requirements and exceptions. COPPA: online collection of personal information from children under 13 by commercial operators, the edtech app itself, not the school (COPPA does not bind schools); governs notice and verifiable parental consent. CIPA: schools and libraries taking E-Rate discounts for internet access; governs technology protection measures (filtering), an internet safety policy adopted after a public hearing, monitoring of minors' online activities, and, per the Protecting Children in the 21st Century Act amendment, educating minors about appropriate online behavior. PPRA adds survey consent rules for sensitive topics. One classroom Chromebook session can implicate all four.

FTC guidance (longstanding, reaffirmed in the 2025 amendment process) permits schools to authorize collection in loco parentis where the operator collects children's personal information solely for the use and benefit of the school and for no other commercial purpose. The conditions carry weight: the operator must give the school full COPPA-style notice; data cannot feed targeted advertising, non-educational profiling, or unrelated product development; and the school should make notices available to parents. Where collection serves the operator's own commercial ends beyond the educational service, school consent fails and actual parental consent is required. Operationally, districts centralize this: an approved-app process where the district reviews the vendor's practices and signs the consent, because teacher-by-teacher click-wrap adoption creates both a COPPA gap and a FERPA direct-control failure at once.

For E-Rate internet/internal-connections discounts: a technology protection measure (filter) on all internet-connected devices blocking visual depictions that are obscene, child sexual abuse material, or harmful to minors (for minor-accessible devices); an internet safety policy addressing minors' online safety, adopted with reasonable public notice and at least one public hearing; monitoring of minors' online activity; and online-safety education for minors. Adults may have filters disabled for bona fide research or lawful use. What CIPA does not require: tracking individual students' every click, retaining browsing histories indefinitely, or surveilling personal devices off-network, districts routinely exceed CIPA in the name of CIPA, and the over-collection becomes a FERPA and state-law problem of its own. Filtering vendors' monitoring dashboards generate education records; treat their retention and access accordingly.

Age boundaries gap: COPPA stops at 13, FERPA runs to the eligible student at 18, CIPA's 'minor' is under 17, so a 14-year-old's app data is FERPA-and-state-law territory with no COPPA hook. Consent authority differs: FERPA consent belongs to parents then eligible students; COPPA consent can be the school's within limits; CIPA needs no individual consent at all. Monitoring tension: CIPA-driven monitoring creates records FERPA then protects, and state laws may restrict, the surveillance mandate and the privacy mandate share a filing cabinet. Vendor obligations diverge: a vendor can be FERPA-compliant (school official, direct control) while violating COPPA (ad SDK on under-13 users), or COPPA-clean while breaching state law (de-identified data resale). The gaps close only at the contract layer: districts and vendors papering all regimes at once, which is why the consolidated DPA became the industry's central artifact.

Districts: the approved-app governance process (no ungoverned adoption); the FERPA annual notice designating school officials; the COPPA consent decision per app with documentation that collection is education-only; the CIPA policy, hearing record, filter, and education program; PPRA notices for surveys; parent communication channels; and retention schedules for the monitoring data their own tools generate. Vendors: a signed DPA meeting FERPA direct control; COPPA-compliant under-13 handling (or honest audience exclusions), including the 2025 rule's retention and unbundled-consent requirements; no ads, sale, or out-of-scope use per state law; security programs with breach notice; and transparent subprocessor chains. Shared: incident response (the district owns parent notification, the vendor owes the district speed and facts) and annual re-review, because app updates change data practices faster than contracts do. The failure mode in nearly every K-12 incident is an owner gap, each side assuming the other had it.