EdLaw nat/us/coppa/README.md

language: en · status: in-force · last checked: 2026-09-04

Children's Online Privacy Protection Act (COPPA)

US federal law (the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§6501–6506) regulating online collection of personal information from children under 13, implemented and enforced by the Federal Trade Commission through the COPPA Rule (16 CFR Part 312). Unlike FERPA it binds the operator (the vendor) directly.

The Rule was substantially amended by the FTC's 2025 final rule (published 2025-04-22, Federal Register doc 2025-05904): among other changes, biometric identifiers enter the definition of personal information, a written information security program is required (§312.8(b)), and retention/deletion duties are tightened (§312.10). The text reproduced in this folder is the current amended text.

Applicability to EdTech

Applies to operators of websites/online services directed to children under 13, and to operators with actual knowledge they are collecting personal information from under-13s (§312.3) — which describes most K-12 EdTech. Core duties: notice, verifiable parental consent before collection, parental review/deletion rights, no conditioning participation on excessive collection, reasonable security, limited retention.

School-authorised consent: the Rule text itself contains no school-consent provision. The mechanism by which a school consents in place of parents in the educational context is FTC guidance — the "COPPA and Schools" section (Section N) of the FTC's COPPA FAQs — reinforced by the FTC's 2022 EdTech policy statement (which also states that lacking reasonable security violates COPPA even absent a breach). District RFI language about "allowing the school to provide consent on a parent's behalf" rests on this guidance, not on the Rule text.

Contents

Document Covers
SCOPE-AND-DEFINITIONS.md 16 CFR §§312.1–312.3 — scope, definitions (incl. biometric identifiers), general prohibition
NOTICE-AND-CONSENT.md 16 CFR §§312.4–312.7 — notice, verifiable parental consent, review rights, conditioning
SECURITY-AND-RETENTION.md 16 CFR §§312.8, 312.10 — security (written program), retention and deletion

Licence

The corpus reproduces 16 CFR §§ 312.1–312.8 and 312.10 (Federal Trade Commission) verbatim from the eCFR, published by the Office of the Federal Register and the Government Publishing Office. The statute and the FTC guidance listed in Sources are linked, not reproduced. It is a work of the United States Government. 17 U.S.C. § 105(a) (govinfo, United States Code 2024 edition, title 17 § 105, read 2026-10-01) provides: "Copyright protection under this title is not available for any work of the United States Government, but the United States Government is not precluded from receiving and holding copyrights transferred to it by assignment, bequest, or otherwise."

The Government Publishing Office's Public Domain & Copyright Notice (govinfo.gov/about/policies, read 2026-10-01) adds: "By virtue of the foregoing, public documents can generally be reprinted without legal restriction. However, Government publications may contain copyrighted material which was used with permission of the copyright owner." It also says that "whenever a work is published consisting predominantly of work of the U.S. Government, the copyright notice (if any) must identify those parts of the work in which copyright is claimed per 17 U.S.C. § 403."

Conditions: none attach to the text itself. The one formal point is § 403: if the public pages ever carry a copyright notice, it must identify the parts in which copyright is claimed (the corpus's own curation) and not cover the reproduced federal text. The corpus names the source in its Sources section and in each fact document's {.meta} provenance lines, and its Meta section describes what it changed (anchors added, nothing reworded).

Sources