Policy Statement of the Federal Trade Commission on Education Technology 

and the Children’s Online Privacy Protection Act

The Federal Trade Commission (“Commission”) is committed to ensuring that education 

technology (“ed tech”) tools and their attendant benefits do not become an excuse to ignore 

critical privacy protections for children. When Congress enacted the Children’s Online Privacy

Protection Act1 (“COPPA”), it empowered the Commission with tools beyond administering 

compliance with notice and consent regimes. The Commission’s COPPA authority demands 

enforcement of meaningful substantive limitations on operators’ ability to collect, use, and retain 

children’s data, and requirements to keep that data secure. The Commission intends to fully 

enforce these requirements—including in school and learning settings where parents may feel 

they lack alternatives. 

Protecting children’s privacy online has been a priority for the Commission since 1998, 

when the Commission recommended “that Congress develop legislation placing parents in 

control of the online collection and use of personal information from their children.”2 Thereafter, 

Congress enacted COPPA and charged the Commission with enforcing the law, entrusting the 

FTC to take the lead in protecting children’s privacy just as the country was entering the Internet 

age. To implement COPPA, the Commission issued the COPPA Rule, which became effective in 

2000.3 

In the decades since COPPA’s enactment, there has been a steady proliferation of 

technologies that allow, and business models that depend on, the online collection and 

monetization of consumers’ personal information. The development of ever more sophisticated 

targeting practices, in some cases based on comprehensive collection of users’ activities across 

the Internet, has raised concerns that businesses might engage in harmful conduct and led to calls 

for strengthening children’s privacy protections. Partly in response to these concerns, the 

Commission revised the COPPA Rule4 in 2013, including to hold third parties such as 

advertising networks liable for collection of children’s personal information from child-directed 

sites in violation of the Rule5 and to expand the definition of personal information to include 

1 15 U.S.C. §§ 6501–6505. 2 FED. TRADE COMM’N, PRIVACY ONLINE: A REPORT TO CONGRESS, at 42 (June 1998). See also Complaint, In re 

Liberty Fin. Cos., Inc., FTC File No. 982-3522 (Aug. 12, 1999)(alleging that website operator falsely represented 

that personal information collected from children in a survey would be maintained anonymously and that 

participants would be sent an e-mail newsletter and prizes); Complaint, In re GeoCities, FTC File No. 982-3015 

(Feb. 5, 1999) (alleging that website operator misrepresented which entity collected and maintained personal 

identifying information collected from children). 3 16 C.F.R. Part 312. As discussed below, the Commission strengthened the COPPA Rule through amendments that 

became effective in 2013. See Children’s Online Privacy Protection Rule, 78 Fed. Reg. 3,972 (Jan. 17, 2013) (Final 

Rule amendments codified at 16 C.F.R. Part 312). 4 See id. 5 See id. at 4,010. See also Complaint, United States v. OpenX Techs., Inc., Case No. 2:21-cv-09693 (C.D. Cal. Dec. 

15, 2021) (alleging that online advertising platform collected and transmitted location information and persistent 

identifiers from users of child-directed apps without complying with COPPA); Complaint, FTC and the State of 

New York v. Google LLC and YouTube, LLC, Case No. 1:19-cv-2642 (D.D.C. Sept. 4, 2019) (alleging that YouTube 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

persistent identifiers used to target advertising to children.

6 Since that time, companies’ 

information collection practices have continued to become more extensive, and concerns remain 

that children’s information may be used to target them. 

Concerns about data collection are particularly acute in the school context, where 

children and parents often have to engage with ed tech tools in order to participate in a variety of 

school-related activities. School-issued personal computing devices and online learning services 

have provided substantial benefits to students, particularly as the COVID-19 pandemic closed 

schools and forced families to switch from in-person to remote learning for their children. At the 

same time, parents may have reasonable questions and concerns about the personal information 

that ed tech providers collect and how they use and potentially share that information with third 

parties, including for marketing purposes. And parent groups, among others, have expressed 

concern that children are a captive audience in the school setting and should not be targeted with 

advertising as they pursue their educations.7 School-issued devices and applications also enter 

families’ homes, potentially allowing for even more private information to be collected and 

shared. Commission staff has provided extensive guidance8 on COPPA’s application to ed tech 

providers to address these concerns. 

In investigating potential violations of COPPA by providers of ed tech and other covered 

online services, the Commission intends to scrutinize compliance with the full breadth of the 

substantive prohibitions and requirements of the COPPA Rule and statutory language. In 

particular, the Commission will focus on: 

• Prohibition Against Mandatory Collection: COPPA-covered companies, including ed 

tech providers, must not condition participation in any activity on a child disclosing more 

information than is reasonably necessary for the child to participate in that activity.

9 

These businesses cannot stop students from engaging in an ed tech activity if they do not 

provide information beyond what is reasonably needed to administer the students’ 

collected persistent identifiers used for targeted advertising from users of child-directed channels without complying 

with COPPA); Complaint, United States v. InMobi Pte Ltd., Case No. 3:16-cv-3474 (N.D. Cal. June 22, 2016) 

(alleging that mobile advertising network collected geolocation information from users of apps directed to children 

under the age of 13 without complying with COPPA). 6 78 Fed. Reg. 3,972, 4,009. See also Complaint, United States v. HyperBeard, Inc., Case No. 3:20-cv-3683 (N.D. 

Cal. June 3, 2020) (alleging that app developer allowed third-party ad networks to use persistent identifiers to track 

users of its child-directed apps without complying with COPPA); Complaint, FTC and the State of New York v. 

Google LLC and YouTube, LLC, Case No. 1:19-cv-2642 (D.D.C. Sept. 4, 2019); Complaint, United States v. Retro 

Dreamer, Case No. 5:15-cv-2569 (C.D. Cal. Dec. 17, 2015) (alleging that app developer allowed third-party 

advertisers to collect persistent identifiers through its child-directed apps without complying with COPPA); 

Complaint, United States v. LAI Sys., LLC, Case No. 2:15-cv-9691 (C.D. Cal. Dec. 17, 2015). 7 See, e.g., COPPA Rule Review, FTC-2019-0054 (Project No. P195404), Comments of Campaign for a 

Commercial-Free Childhood, et al., Comment No. 117343, at 8 (Dec. 11, 2019) (“In many cases, parents and

students are not even aware of what data is being collected, why it is being collected, who is collecting it, or where it 

is being stored. This data is often used to build behavioral profiles that allow third parties to create more effective 

marketing campaigns, targeted advertisements, and, ultimately, psychological manipulation of other children.”). 8 See Complying with COPPA: Frequently Asked Questions, FED. TRADE COMM’N (July 2020) § N, 

https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-askedquestions#N.%20COPPA%20AND%20SCHOOLS. 9 16 C.F.R. § 312.7. See also Complaint, United States v. Looksmart Ltd., Civ. Action No. 01-606-A (E.D. Va. Apr. 

19, 2001); Complaint, United States v. BigMailbox.com, Inc., Civ. Action No. 01-605-A (E.D. Va. Apr. 19, 2001). 

2 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

participation in the activity.

10 For example, if an ed tech provider does not reasonably 

need to be able to email students, it cannot condition the student’s access to schoolwork 

on students providing their email addresses.

11 Students must not be required to submit to 

unnecessary data collection in order to do their schoolwork. 

• Use Prohibitions: COPPA-covered companies, including ed tech providers, are strictly 

limited in how they can use the personal information they collect from children. For 

example, operators of ed tech that collect personal information pursuant to school 

authorization12 may use such information only to provide the requested online education 

service. In this context, ed tech companies are prohibited from using such information for 

any commercial purpose, including marketing, advertising, or other commercial purposes 

unrelated to the provision of the school-requested online service.

13 

• Retention Prohibitions: COPPA-covered companies, including ed tech providers, must 

not retain personal information collected from a child longer than reasonably necessary to 

fulfill the purpose for which it was collected.

14 It is unreasonable, for example, for an ed 

tech provider to retain children’s data for speculative future potential uses.

• Security Requirements: COPPA-covered companies, including ed tech providers, must 

have procedures to maintain the confidentiality, security, and integrity of children’s 

personal information.15 For example, even absent a breach, COPPA-covered ed tech 

providers violate COPPA if they lack reasonable security.16 

Such limitations on collection, use, and retention, along with security requirements, place 

significant responsibility on COPPA-covered businesses to implement strong privacy 

protections, in addition to the notice and consent requirements of the COPPA Rule. The 

responsibility for COPPA compliance is on businesses, not schools or parents—and agreements 

must reflect that. 

10 The text of the COPPA Rule addressing prohibitions against conditioning access (16 C.F.R. § 312.7), which is 

described here, restates nearly verbatim the text of the statutory language (15 U.S.C. § 6502(b)(1)(C)). As part of its 

ongoing rule review, the Commission is carefully analyzing this provision to ensure that operators are aware of their 

obligations. See Request for Public Comment on the Federal Trade Commission’s Implementation of the Children’s

Online Privacy Protection Rule, 64 Fed. Reg. 35,842, 35,846 (July 25, 2019). 11 See Children’s Online Privacy Protection Rule, 64 Fed. Reg. 22,750, 22,758 (proposed Apr. 27, 1999) (codified at 

16 C.F.R. § 312) (discussing email address example). 12 Children’s Online Privacy Protection Rule, 64 Fed. Reg. 59,888, 59,903 (Final Rule released Nov. 3, 1999) 

(codified at 16 C.F.R. § 312). 13 Complying with COPPA: Frequently Asked Questions, FED. TRADE COMM’N § N, https://www.ftc.gov/businessguidance/resources/complying-coppa-frequently-asked-questions#N.%20COPPA%20AND%20SCHOOLS (last 

visited May 18, 2022). 14 16 C.F.R. § 312.10. See also Complaint, United States v. Kurbo, Inc. and WW Int’l, Inc., No. 3:22-cv-00946 (N.D. 

Cal. Feb. 16, 2022). Complaint, United States v. Musical.ly, Case No. 2:19-cv-1439 (C.D. Cal. Feb. 27, 2019). 15 15 U.S.C. § 6502(b)(1)(D); 16 C.F.R. § 312.8. See also Complaint, In re Retina-X Studios, LLC, FTC File No. 

1723118 (Mar. 26, 2020). Complaint, United States v. Unixiz, Inc. d/b/a/ iDressup.com, No. 5:19-cv-02222-NC 

(N.D. Cal. April 24, 2019); Complaint, United States v. VTech Elecs. Ltd., Case No. 1:18-cv-114 (N.D. Ill. Jan. 8, 

2018); Complaint, United States v. RockYou, Inc., No 3:12-cv-01487-SI (N.D. Cal. Mar. 26, 2012). 16 16 C.F.R. § 312.10. 

3 
Children should not have to needlessly hand over their data and forfeit their privacy in 

order to do their schoolwork or participate in remote learning, especially given the wide and 

increasing adoption of ed tech tools. Going forward, the Commission will closely scrutinize the 

providers of these services and will not hesitate to act where providers fail to meet their legal 

obligations with respect to children’s privacy. 

4