How COPPA and FERPA actually protect your teen's data at school and online

What to take away

What COPPA covers, and the under-13 line that leaves most teens outside it

The Children's Online Privacy Protection Act governs how operators of websites and online services handle personal information from children under 13. That age is written into the COPPA Rule, not left to the operator's judgment.

A service counts as covered in two main ways. It may be directed to children, judged by subject matter, visuals, music and advertising. Or it may have actual knowledge that it is collecting information from a child under 13. Either trigger brings the rule into play.

The COPPA Rule defines personal information broadly. It reaches a first and last name, a home address, an email address and a phone number. It also covers a Social Security number, a photo or video containing a child's image, and geolocation precise enough to identify a street.

Persistent identifiers used to track a child across sites count too. So does information the operator collects and combines with any of these. The scope of the COPPA Rule and what counts as personal information from children under 13 is set out in full by the Federal Trade Commission.

Once a service is covered, it must give notice and obtain verifiable parental consent under 16 CFR Part 312 before collecting, using or disclosing a child's personal information. Consent has to be reasonably calculated to ensure the person giving it is the parent, which is why operators use signed forms, credit card verification, government ID checks or video calls.

Here is the part that surprises most parents. A 14-year-old is outside COPPA entirely. So is a 16-year-old. The law protects younger children from data collection, and it leaves teenagers to a patchwork of state laws, platform terms of service and whatever the school district negotiates.

That patchwork is why reading teen social media use laws with a sceptical eye matters more each year.

Note what the table does not show. Neither law gives a parent a general right to see everything a platform knows about a teenager, and neither one bans targeted advertising to teens.

Where FERPA begins: education records, schools, and the consent parents hold

The Family Educational Rights and Privacy Act applies to schools that receive funds under a program administered by the U.S. Department of Education. That covers essentially every public school district, most private schools that take federal money, and colleges that enroll students receiving federal aid.

FERPA protects education records. Those are records directly related to a student and maintained by the school or by a party acting for the school. Grades, attendance, discipline files, counseling notes, special education plans and transcripts all qualify.

So does a class roster in a learning management system, and so does a report an outside reading app sends back to the teacher.

The statutory text of the FERPA statute that underlies school data privacy protections is short, but the regulations built on it run long.

The core rights are these. Parents may inspect and review their child's education records. They may ask the school to correct records they believe are inaccurate or misleading.

Schools must also obtain written consent before disclosing personally identifiable information from those records, except in the situations the law lists.

Those exceptions matter. Schools may share records with school officials who have a legitimate educational interest, with another school where the student transfers, and in health and safety emergencies. Directory information, such as a student's name, address and school activities, can be released unless the parent opts out in writing. Districts must tell parents annually how to opt out.

Parents hold these rights until the student turns 18 or attends a postsecondary institution, at which point the rights transfer to the student. What FERPA protects in education records and how it applies to school-held student data is explained by the Department of Education's student privacy office.

One limit is worth stating plainly. FERPA is a funding condition, not a criminal statute. A school that mishandles records risks losing federal funds, and the department can require it to fix the problem. There is no private right of action, so a parent cannot sue a district for damages under FERPA alone.

The gap between the two laws, and the edtech apps that sit in it

Picture a 15-year-old assigned a free vocabulary app in English class. The app collects her name, her school email, her practice history and her device identifier. She is over 13, so COPPA does not apply. The app company is not a school, so FERPA does not apply to the company either.

What FERPA does reach is the copy of the data the school holds. If the app sends results back to a teacher dashboard, that dashboard record is an education record. The district is responsible for it, and the parent can ask to see it.

Schools and vendors typically bridge the gap with contracts. Districts sign data privacy agreements that restrict the vendor to educational purposes, ban selling the data, and require deletion when the contract ends. Many states now require those agreements by statute. The strength of the agreement depends on the district that negotiated it and the staff who monitor it.

This is where school guidance tools become hard to judge. A district may run a dozen apps, each with its own terms, and no single office tracking all of them. Ask which apps are approved, who reviews them, and how long student data is kept. School guidance on that question is often thinner than parents expect.

The practical result for families is a split responsibility. The school answers for what it holds. The platform answers for what the teenager signed up for on her own phone, under terms of service nobody in the household read.

How the FTC enforces COPPA: rulemaking, warning letters and penalty offense notices

The Federal Trade Commission writes the COPPA Rule and brings enforcement actions against operators that break it. The commission can seek civil penalties for violations, and it has used that authority against large platforms and small app makers alike.

The FTC's cases and proceedings show how children's privacy enforcement works in practice. Actions have turned on collecting data from children without consent, on retaining it longer than allowed, and on misrepresenting what a service does with a child's information. Settlements have included deletion orders, compliance reporting and monetary payments.

The commission also uses notices of penalty offenses, which put companies on warning that a practice is unlawful. If the company repeats the practice after receiving notice, the FTC can seek civil penalties for each violation.

Notices of penalty offenses used in FTC child privacy enforcement are published by the commission, and they function as a public signal to an entire industry rather than a case against one firm.

Warning letters are the lighter tool. The FTC has sent letters to operators of apps and sites that appear to fall within the rule, telling them to review their practices. A letter is not a finding of guilt, but it is a documented warning that a company ignored at its peril.

What the FTC cannot do is extend COPPA to teenagers. Only Congress or the commission through a new rule can move the age line, and the commission has not done so.

States have filled part of that space with their own statutes, which is why families looking for pipeda teen social media parent rights now find state consumer protection offices listed alongside federal ones.

If you want to report a problem, the FTC accepts complaints about children's privacy and about deceptive practices. The FBI's Internet Crime Complaint Center takes reports of online crimes against minors, and the National Center for Missing & Exploited Children runs the CyberTipline for suspected exploitation.

What a parent can actually request from a school district under FERPA

FERPA gives you a right to inspect and review your child's education records, and schools must comply within 45 days of your request. You do not need to explain why you want them, and you do not need a lawyer.

Put the request in writing and send it to the district's records custodian, usually the registrar or the student services office. Keep a copy. Name your child, the school, and the records you want. Ask for the district's data privacy policy and its list of approved apps if that is what you are after.

A school records request letter does not need legal language. Two paragraphs will do: who you are, what you want, and the law you are relying on.

Expect some resistance on two categories. Counseling and therapy notes may be kept outside the education record if they are in the sole possession of the maker. Law enforcement records held by school police may also sit outside FERPA. Ask the district to identify the specific exemption it is using.

State attorneys general and school data: where federal rules stop

State attorneys general have become active enforcers in this area. Several have brought actions under state consumer protection statutes over children's privacy, and a group of states has coordinated investigations into platform practices affecting minors.

State legislatures have moved faster than Congress. California, Colorado, Illinois and Washington have passed laws on student data and age-appropriate design. Texas, New York, Florida and Massachusetts have moved on children's privacy as well. The details differ enough that a family in one state has rights a family in another does not.

Age-by-age guidance laws are the newest wrinkle. Some states now require platforms to treat minors differently by age band, which creates obligations that COPPA and FERPA never imposed. The rules vary on what counts as a minor and what platforms must do about it.

For parents, the state layer is where the room to act often is. A state attorney general can act on a complaint about a platform's treatment of teenagers in a way the FTC cannot under COPPA. Filing with both is reasonable.

School districts answer to state education agencies as well as the federal government. If a district ignores a records request, a complaint to the state agency or the Department of Education's Student Privacy Policy Office is a real option.

A social media safety for parents and teens checklist for data requests

Use this before you sign a district consent form or hand a teenager a new app.

Two habits carry most of the weight. Keep a folder of every consent form and records request, with dates. And revisit the app list each fall, because districts change vendors quietly and last year's agreement may not cover this year's tool.

Common questions