Child Data Privacy Standards in Educational Apps
New COPPA rules tighten data safeguards, but leave AI training practices unresolved.
For parents choosing a personalized AI tutor for reading and math, privacy is part of the buying decision. The 2025–2026 COPPA amendments raised the standard for consent, data storage, security, and deletion in educational apps. Those protections give parents concrete ways to judge an app, but they do not settle whether a child’s answers or voice recordings can be used to train its AI.
What the 2025 COPPA amendments actually changed, and why 2026 is the year they took effect
The Federal Trade Commission finalized the first substantial changes to the Children’s Online Privacy Protection Rule since 2013 in 2025. The amendments took effect that year, and apps had to meet all the rules by April 22, 2026. That deadline has passed, so these are live requirements. Educational apps covered by COPPA must now meet a higher standard, rather than promise to reach it in a future update.
The changes include separate parental consent for certain third-party sharing, explicit coverage of biometric identifiers, written retention and security policies, and new transparency obligations. The FTC dropped proposed EdTech-specific clarifications from the final rule, leaving educational app operators under the general framework without the extra clarity they had expected. There is no special path around the rules. For parents, the practical question is what those rules allow an app to do with a child’s information.
What "personal information" means under the updated rule — and why it reaches further than most parents expect
A child does not have to enter a name for an app to collect personal information. COPPA also covers persistent identifiers, including cookies, IP addresses, and device IDs, as well as precise geolocation and files containing a child’s image or voice. An advertising ID can be enough on its own. If it tracks a child across services, COPPA covers the data it collects even when the name field is blank.
The updated definition explicitly adds biometric identifiers, including fingerprints, voiceprints, facial templates, and gait patterns, as well as government-issued identifiers beyond Social Security numbers. A reading app may record a child as they sound out words, read a passage, or speak to an AI tutor. Those recordings are not merely lesson activity. Audio containing a child’s voice is covered personal information, while a voiceprint is also explicitly covered as a biometric identifier.
Third-party software development kits, commonly called SDKs, can provide analytics, crash reporting, or advertising functions inside an app. They can collect identifiers without any obvious sign on the screen, and an unintended data flow can still create a violation. The app’s visible features tell only part of the story. Once parents know what information is covered, the next question is what permission the operator needs to collect and share it.
The consent requirements that changed most: what a parent must now be asked to approve, separately
The most visible change at sign-up is separate, verifiable parental consent for sharing children’s personal information with third parties for targeted advertising or other purposes not integral to the service. Previously, one bundled consent could cover both an operator’s own use and third-party disclosures. That bundle no longer suffices for these disclosures. A parent must be able to distinguish permission to use the educational service from permission to send a child’s data to an advertising partner.
Verifiable consent also means more than a checkbox. Operators must use a reliable verification method and keep records of who consented, when, for which child’s account, and for which uses. They must also be able to honor withdrawal of consent and deletion requests across their systems and vendors. For parents, the distinction should be visible in the approval process. A single “I agree” covering learning functions and advertising disclosures is a red flag.
The important exception is sharing integral to the service. A speech-to-text provider that processes a child’s voice only to give reading feedback may not need separate consent, while an advertising partner does. When an app shows ads, parents should look closely at what data it shares and what it asks them to approve. The advertising disclosure, rather than the mere presence of an ad, is the key issue. Even with proper consent, an operator must take care of the data it collects.
Retention, security, and deletion: the obligations that go beyond the consent screen
The amendments require a written information security program that fits the kind of data an operator collects and how much it collects. They also require a written retention policy tying the length of storage to a stated purpose. Children’s information cannot be kept indefinitely. A broad promise to protect privacy does not answer how long an app keeps voice recordings, device identifiers, or other personal information.
For parents, the useful question is what the policy says about each kind of data. A specific retention period gives a parent something concrete to assess, while “as long as necessary” leaves the timing unclear. The purpose of keeping the information should also be stated. An app may need data for a learning function, but that need does not give it a reason to keep the data forever. Its retention policy should explain where that use ends.
Deletion must reach beyond the operator’s own storage. When a parent requests deletion, or a retention period expires, the obligation extends to third-party vendors and cloud storage providers that received the information. Parents should be able to ask how that reach is handled, rather than accept an answer limited to the child’s account. The financial consequences are substantial, with aggregate COPPA penalties reaching tens of millions of dollars. For AI-powered apps, storage raises another question because a child’s inputs may be used not just during a lesson, but to train the model behind it.
The gap COPPA does not close: using children's data to train AI
COPPA governs collection, use, and sharing of children’s data under a consent framework that leaves separate approval solely for retraining or improving the underlying model without an explicit requirement. That is a significant unresolved gap. Permission to provide tutoring and permission to turn a child’s work into model-training material are different questions, even when a policy does not clearly separate them.
A child’s typed answers, reading recordings, and behavioral data can be personal information when they are linked to who the child is. That link is common in school services and apps with individual accounts. Yet knowing the information is covered does not establish that model training is prohibited. Parents evaluating an adaptive reading and math tutor therefore need an explicit answer about secondary use. A claim that an app follows COPPA is not, by itself, a promise that children’s data never enters its training process.
Canada’s federal, provincial, and territorial privacy commissioners issued a joint resolution calling on vendors to avoid secondary uses of students’ personal information, including product improvement and AI training, without specific, informed consent. State legislatures are also moving to address the gap, creating a patchwork in which the family’s location and the laws applying to the vendor influence the protections available. The practical question for parents is direct. Does the policy explicitly state that children’s data is never used to train its AI models? If the answer is unclear, parents cannot assume it is yes.
What enforcement cases reveal about how educational apps actually handle children's data
A BYU investigation prepared for the Utah State Board of Education in August 2025 found that 36% of EdTech companies with data privacy agreements were sharing data with advertisers. Unique identifiers supported digital profiling, apparently in conflict with those agreements. The investigation led to Utah H.B.
The Apitor Technology settlement in September 2025 shows how third-party code can turn that risk into an enforcement case. An SDK embedded in the app collected children’s geolocation information without parental consent. The collection happened through code the developer did not write. Parents cannot see how an app handles data just by looking at the lesson screen, and an operator needs to know what the tools built into its product do.
A NYU audit of EdTech platforms found that organizations often defer privacy considerations while prioritizing functionality, growth, funding, and immediate educational outcomes. The finding shows a weakness in how these organizations work, but it does not prove they meant to do harm. A product can be built for learning and still mishandle children’s information. Enforcement and penalties that add up to large sums make those failures costly, but parents also need protection before a case is brought. School approval is one possible safeguard, though its scope is narrower than many families expect.
How school authorization works, where it ends, and what it does not protect parents from
Under the existing school-authorization exception, schools can give consent for parents when children’s information is collected for educational purposes. The FTC said it would continue applying its guidance even though the final amendments did not codify that exception. The permission remains limited to collection integral to the educational service and excludes advertising, behavioral profiling, or other secondary uses.
The PlayOn Sports settlement illustrates the limits of treating school authorization as permission for noneducational data uses. COPPA governs online collection of personal information from children under 13, while FERPA governs student education records held by schools and parties acting on their behalf. A platform used by a school usually has to follow both laws. Meeting COPPA’s requirements does not automatically establish compliance with FERPA.
The way an app reaches the classroom also affects the protection parents can expect. An individual teacher’s informal adoption may bypass district procurement review and expose student data without district knowledge or legal protection. Teachers may not have detailed knowledge of either law. By contrast, New York requires EdTech contracts to include a “Parents’ Bill of Rights” explaining collection, use, access, and ways parents can review or challenge records. School procurement can provide a baseline, but home apps chosen by parents sit outside school authorization and require direct scrutiny.
What parents can check in any educational app's privacy policy before their child uses it
For parents choosing an educational app, the policy is a screening tool. Parents should first check whether the sign-up flow requests distinct approval for targeted-advertising disclosures or other non-integral third-party sharing. One general agreement is not enough for those uses. Parents should next check whether the policy gives specific retention periods for different data types and explains deletion when those periods end. A statement about keeping information “as long as necessary” does not give parents that clarity.
Does the policy explain how recordings and any voiceprint data are classified, protected, and deleted? The distinction is especially relevant when a child reads aloud for feedback or speaks with a tutor. Parents should also ask whether they can review the information collected about their child and request deletion through a clear, usable process. A right buried in legal language does little good if the app makes it hard for parents to use it.
For a personalized AI tutor, another question stands apart from basic collection consent. Does the policy explicitly say whether text, voice, and behavioral data are used to train the app’s models? Silence leaves the training question open for parents. It is also reasonable to ask whether the model is purpose-built for teaching or adapted from a general-purpose training pipeline, and whether the privacy policy clearly explains its data uses.
The amended rule gives parents stronger protections and concrete terms against which to read an app’s promises. Its compliance deadline is no longer ahead. An app in use today should reflect the current consent, retention, security, and deletion requirements, while answering honestly about AI training where federal protection remains incomplete. Parents who understand that distinction can separate a meaningful privacy commitment from a reassuring phrase.
