COPPA FTC, Complying with COPPA: FAQ section N (retrieved 5 October 2026)
Schools and EdTech: FTC guidance. A school may consent for parents only where the operator collects students' personal information for the use and benefit of the school and for no other commercial purpose; the operator must give the school direct notice and cannot shift COPPA responsibility to the school
Where this comes from
Provision: FTC, Complying with COPPA: FAQ section N (retrieved 5 October 2026); FTC Policy Statement on Education Technology and COPPA
Instrument: Children's Online Privacy Protection Act (COPPA)
Citation: FTC, Complying with COPPA: Frequently Asked Questions, section N (staff guidance), https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions, retrieved 5 October 2026; FTC, Policy Statement of the Federal Trade Commission on Education Technology and the Children's Online Privacy Protection Act (no date shown in the retrieved text), https://www.ftc.gov/system/files/ftc_gov/pdf/Policy%20Statement%20of%20the%20Federal%20Trade%20Commission%20on%20Education%20Technology.pdf; 16 CFR 312.7, 312.8 and 312.10; 90 FR 16918, 16919 (22 April 2025)
Text version: FTC, Complying with COPPA: Frequently Asked Questions, section N (staff guidance), retrieved 5 October 2026; FTC Policy Statement on Education Technology and COPPA (PDF; no date shown in the retrieved text); 90 FR 16918, 16919 (22 April 2025) does not codify school authorization
Checked against the source: 5 October 2026
Who it applies to
It applies when all of these are true:
- COPPA assessed activity Q_COPPA_COVERED_ACTIVITY: YES
- COPPA assessed activity Q_COPPA_SCHOOL_PATH: YES
What engineering work it implies
Sample acceptance criteria Landfall generates for this obligation:
- Trace the school-requested purpose through collection, processors, use, sharing and deletion; deny unrelated commercial reuse of school-authorized data.
- Test that advertising, unrelated commercial profiling, sale and speculative future use cannot consume these data; a paid educational service is not excluded merely because it is commercial.
- Verify collection necessity, an assessed retention schedule and reasonable security separately from the school's authorization.
- Exercise the school's review, deletion and prevention controls and keep the operator's responsibility explicit in agreements.
- Preserve a minimized record of purpose and authorization; do not copy child payloads into general audit logs.
Evidence an auditor expects
- Assessment documentDocument review
Source-linked COPPA activity, authority and control assessment
Trace the school-requested purpose through collection, processors, use, sharing and deletion; deny unrelated commercial reuse of school-authorized data. Test that advertising, unrelated commercial profiling, sale and speculative future use cannot consume these data; a paid educational service is not excluded merely because it is commercial. Verify collection necessity, an assessed retention schedule and reasonable security separately from the school's authorization. Exercise the school's review, deletion and prevention controls and keep the operator's responsibility explicit in agreements. Preserve a minimized record of purpose and authorization; do not copy child payloads into general audit logs. Record the exact source version, reviewer, activity and evidence limits. A template or seed is not consent or qualified legal approval.
Questions people ask
- Does COPPA FTC, Complying with COPPA: FAQ section N (retrieved 5 October 2026) apply to my service?
- It applies when COPPA assessed activity Q_COPPA_COVERED_ACTIVITY: YES; COPPA assessed activity Q_COPPA_SCHOOL_PATH: YES.
- From when does this apply?
- COPPA FTC, Complying with COPPA: FAQ section N (retrieved 5 October 2026) applies from 19 May 2022. Its current status is: in force.
- What evidence does an auditor expect?
- Source-linked COPPA activity, authority and control assessment.
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.