Protecting students’ privacy and personal information is a crucial responsibility for schools. Many school staff members and administrators are familiar with laws like FERPA, CIPA, and other local data privacy regulations which govern the handling of student data. But have you heard of COPPA? The Children’s Online Privacy Protection Act (COPPA) is a federal law in the United States that specifically addresses how schools use online services and apps with students under 13 years old.
In this article, we’ll explain what COPPA is, how it applies to schools, and what you need to know to comply with it.
What is COPPA?
COPPA is a federal law that was passed by the United States Congress in 1998; it was added as a rule by the Federal Trade Commission (FTC) and updated in 2013 to keep up with changing technology. The law is designed to give parents control over the personal information collected from their children by websites, online services, and mobile apps. COPPA requires operators of these services to:
- Provide notice and obtain parental consent before collecting, using, or disclosing any personal information from children under 13
- Maintain a clear and comprehensive privacy policy explaining how children’s information is collected, used, and protected
- Limit the collection of personal information to what is necessary for the service or app
- Ensure that personal information is kept secure and deleted when no longer needed
- Provide parents and/or legal guardians the ability to access, review, delete, and prevent further collection of their children’s data
Personal information under COPPA includes anything that can be used to identify a child, such as their full name, address, online contact info, phone number, social security number, persistent identifiers (IPs, cookies, device serial number, etc) photos, videos, audio recordings, geolocation, and any other information that when combined with this information can be used to identify the child.
Source: FTC – Children’s Policy
How does COPPA Apply to Schools?
Although COPPA directly regulates online service providers, schools are often the intermediaries between these services and parents. Schools frequently use educational websites, learning platforms, and other online tools that collect students’ personal information. In some cases, schools can provide consent on behalf of parents for students under 13 to use these services. However, this is only allowed under specific conditions:
- The service or app is used strictly for educational purposes, not for commercial reasons
- The school has a contract or agreement that limits the use and disclosure of personal information to educational purposes
- The school provides parents with notice about the service or app, allowing them to review and delete their children’s information
However, schools cannot provide consent on behalf of parents and/or legal caregivers for the collection of personal information from students under 13 for non-educational purposes, such as marketing, advertising or behavior profiling. In these cases, schools must ensure that direct and verifiable consent is obtained from parents or legal caregivers.
What do Schools and their Staff Need to Know to Comply with COPPA?
Complying with COPPA can be challenging for schools, but it is vital to ensure student data is protected. Here are some tips to help:
- Know Your School’s Policies: Familiarize yourself with your school or district’s policies on using online services and apps. Most schools have a pre-approved list of tools (websites, apps, etc) that comply with COPPA and other privacy regulations, as well as a process to review new services before they’re used.
- Choose Services Wisely: Look for services designed specifically for educational use that have clear, transparent privacy policies and are COPPA-compliant. Resources like Common Sense Education and the Student Data Privacy Consortium (SDPC) can help you evaluate potential websites, platforms and apps.
- Communicate with Operators of Services and Apps: Before using any online service or app with students under 13, reach out to your school’s data privacy coordinator or the operator to understand how they collect, use, and protect student data. If they require parental or legal guardian consent, inquire about their process for obtaining it and ask for a contract outlining the limitations on data use.
- Communicate with Parents: If your school provides consent on behalf of parents or legal guardians, it’s essential to inform them about the app or service being used, its privacy practices, and their rights to review or delete their child’s information. Many schools include a notification on how this is accomplished within their Acceptable/Responsible Use of Technology policy.
In Conclusion
COPPA is an important law that protects children’s online privacy and gives parents more control over what information is collected from their children online. Schools play a key role in complying with COPPA, as they often use online services and apps that collect personal information from students under 13 for educational purposes. Schools need to be aware of the requirements and responsibilities of COPPA, and follow the best practices to ensure that they use online services and apps safely and responsibly with students. By doing so, schools can enhance the learning experience of students, while protecting their privacy and personal information.
