FTC COPPA FAQs N.1-N.3 - Assess school authorization
Assess the limited FTC school-authorization guidance before relying on it; school use alone does not authorize collection or other commercial reuse
Where this comes from
Provision: FTC COPPA FAQs N.1-N.3 - Assess school authorization
Instrument: Children's Online Privacy Protection Act (COPPA)
Citation: FTC COPPA FAQs N.1-N.3 (staff guidance); FTC Education Technology Policy Statement, 19 May 2022; 90 FR 16918, 16919, Part I.A. (22 April 2025)
Text version: FTC COPPA FAQs section N (staff guidance); 19 May 2022 Commission edtech policy; 90 FR 16918, 16919 (22 April 2025) retains guidance and does not codify school authorization; checked 6 September 2026
Checked against the source: 6 September 2026
Who it applies to
It applies when all of these are true:
- COPPA assessed activity Q_COPPA_COVERED_ACTIVITY: YES
- COPPA assessed activity Q_COPPA_SCHOOL_PATH: YES
What engineering work it implies
Sample acceptance criteria Landfall generates for this obligation:
- Identify the school-requested educational service, actual authorizing institution and covered activity; a school label alone does not establish consent.
- Verify the school using a method reasonably calculated to prevent child impersonation; school/district selection is guidance best practice, not a universal statutory signatory rule.
- Provide direct collection/use/disclosure notice and school review, deletion and prevention-of-further-use/collection controls.
- Document the limited educational authority and assess direct parental consent separately for other commercial use; preserve operator responsibility.
- Label the source as FTC guidance and enforcement policy, not a codified 312.5(c)(4) school exception or a verified eligibility finding.
Evidence an auditor expects
- Assessment documentDocument review
Source-linked COPPA activity, authority and control assessment
Identify the school-requested educational service, actual authorizing institution and covered activity; a school label alone does not establish consent. Verify the school using a method reasonably calculated to prevent child impersonation; school/district selection is guidance best practice, not a universal statutory signatory rule. Provide direct collection/use/disclosure notice and school review, deletion and prevention-of-further-use/collection controls. Document the limited educational authority and assess direct parental consent separately for other commercial use; preserve operator responsibility. Label the source as FTC guidance and enforcement policy, not a codified 312.5(c)(4) school exception or a verified eligibility finding. Record the exact source version, reviewer, activity and evidence limits. A template or seed is not consent or qualified legal approval.
Questions people ask
- Does FTC COPPA FAQs N.1-N.3 - Assess school authorization apply to my service?
- It applies when COPPA assessed activity Q_COPPA_COVERED_ACTIVITY: YES; COPPA assessed activity Q_COPPA_SCHOOL_PATH: YES.
- From when does this apply?
- FTC COPPA FAQs N.1-N.3 - Assess school authorization applies from 19 May 2022. Its current status is: in force.
- What evidence does an auditor expect?
- Source-linked COPPA activity, authority and control assessment.
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.