.png)
Key takeaways:
- COPPA protects the personal information of children under the age of 13 online.
- COPPA is applicable to certain websites, apps, online services, and educational platforms.
- Organizations that COPPA applies to must obtain parental consent before collecting children’s personal information, with limited exceptions.
- Parents have the right to review and request the deletion of their child’s information.
- The FTC updated the COPPA Rule in 2025 to strengthen children’s online privacy protections.
COPPA, or the Children’s Online Privacy Protection Act, is a federal law in the United States that protects the online privacy of children under the age of 13. It is enforced by the Federal Trade Commission (FTC). It dictates how different digital platforms and websites collect, use, and share children’s personal information.
COPPA primarily applies to the operators of websites and online services that are directed toward children under 13-years old. However, it also applies to operators of general-audience services that know they are collecting personal information from children in this age group.
In practice, this means that COPPA applies to different digital entities like educational apps, virtual classroom platforms, games, and other online learning tools.
The law requires COPPA-covered organizations to be transparent about the kinds of information they collect. It also requires said organizations to:
- Obtain explicit parental consent before collecting a child’s personal information (except in limited circumstances)
- Give parents full control over the retention or deletion of their children’s data
- Take reasonable steps to protect that information
In June of 2025, the Federal Trade Commission (FTC), which enforces COPPA, finalized updates to the COPPA Rule. These amendments served to strengthen children’s online privacy protections by means of introducing stricter requirements regarding parental consent, data sharing, and data retention.
What information does COPPA protect?
COPPA has a relatively broad definition of what counts as personal information. Over and above obvious identifiers like names and email addresses, the law also covers many other types of information that could potentially be linked to or used to identify a child.
This includes information such as their:
- Home or physical address
- Telephone number
- Photos, videos, or audio recordings containing a child’s voice or face
- Exact geolocation data
- Persistent identifiers that recognize a user across websites or services (e.g., cookies, device IDs, etc.)
- Biometric identifiers (e.g., fingerprints, facial recognition data, etc.)
For those who deliver educational services online, the importance of choosing an online learning platform that prioritizes children’s privacy cannot be overstated.
Pencil Spaces is a COPPA-compliant, all-in-one virtual classroom that was built specifically for online teaching and learning. It helps educators deliver lessons without having to worry about the protection of their students’ data.
COPPA vs. FERPA
COPPA and FERPA are very often mentioned in the same contexts, but legally, they serve highly different purposes.
The Children’s Online Privacy Protection Act (COPPA) focuses on the online collection and use of personal information from children under the age of 13. It sets specific rules for websites, apps, and online services, and it gives parents greater control over how their children’s information is collected and used.
The Family Educational Rights and Privacy Act (FERPA), on the other hand, serves to protect students’ educational records. It governs how schools and certain educational institutions access, share, and protect those records. The rule applies regardless of a student’s age.
In many cases for schools and EdTech providers, both COPPA and FERPA laws can apply simultaneously. An online learning platform that collects information from children under 13 while also handling student education records will most likely have to comply with both COPPA and FERPA at the same time.
Pencil Spaces is designed with education-focused privacy in mind and is compliant with both COPPA and FERPA. If you’re interested in learning more about FERPA and how it differs from COPPA, read our guide to FERPA.
Does COPPA apply to online tutors?
Whether or not COPPA applies to an online tutor specifically is dependent on two major factors:
- How the tutor delivers their educational services to their students, and
- Whether or not they collect personal information from students under 13-years old.
For example, a tutor who uses their own website, a tutoring platform, or an online service and collects personal information directly from young students will most likely have responsibilities under COPPA. By contrast, a tutor who works with older students, or who doesn’t collect any personal information from children under 13, may not fall within the law's scope.
The rules can also differ slightly when tutoring takes place through a school. In some educational settings, per the guidance of the FTC, schools are allowed to give consent on behalf of parents for the use of online educational services. However, this is provided that those services are used solely for educational purposes and meet the requirements that are set out by the FTC.
This exception was made to help schools safely use digital learning tools in the classroom while still protecting students’ privacy.
Overall, regardless of whether you’re an independent tutor or part of a larger educational organization, it’s always good practice to choose teaching platforms that prioritize privacy, security, and responsible data handling, like Pencil Spaces.
Questions fréquemment posées
Does COPPA apply to every website, or only ones that are made for kids?
Both. COPPA applies to services specifically directed at children under 13. However, the act also extends to general-audience services that have knowledge that they’re collecting data from children under that age, even if the service isn’t specifically catered toward children.
What happens if an educational organization violates COPPA?
The FTC can bring enforcement actions resulting in fines and required changes to a company’s data practices. Past cases (such as the EdTech company Edmodo) have specifically targeted companies that crossed from educational use into commercial use of student data without proper consent.
Does COPPA compliance mean that a website is “kid-safe”?
Not necessarily. COPPA compliance specifically addresses data collection and parental consent. Although these are very important for a tool to be considered appropriate for children, they aren’t the only factors that matter. Parents should still consider content appropriateness, accessibility, and other safety considerations before allowing their children to peruse websites.
Pencil Spaces is certified COPPA, FERPA, SOC2, and GDPR-compliant. It never sells user data, and it maintains the level of accountability schools and parents expect from any platform young students use. Visit our Privacy page to learn more, or sign up for a free demo today.
This article is for general informational purposes and isn’t legal advice. Schools and EdTech vendors should consult an attorney to confirm their specific COPPA obligations.
