Published On: October 22, 2026Categories: Education

If your tutoring franchise or school network runs an app, parent portal or learning platform directed to children under 13, or knowingly collects personal information from them, the FTC’s updated COPPA Rule now applies in full. The amended Rule took effect on June 23, 2025, and most operators had until April 22, 2026 to achieve full compliance. Platforms built before then may have gaps.

What Has Changed?

The amendments add obligations that many education platforms were never designed around:

  • A written children’s personal information security program

  • Written data retention policies that set a time period, so children’s data isn’t kept indefinitely

  • Separate parental consent for sharing data with third parties, distinct from consent to use the service, unless the sharing is integral to the service

  • Separate opt-in consent for targeted advertising, which can’t be bundled into general consent

  • Three new accepted methods for verifying parental consent: knowledge-based questions, government ID matched to the parent’s face, and, in some cases, text messages

A Note For Schools and EdTech

The FTC chose not to finalize its proposed rules on schools consenting on behalf of parents. Platforms relying on school authorization should review whether their approach still holds up under existing FTC guidance.

Who This Affects In Education

Education institutions often run student apps, gamified practice tools and progress dashboards that collect data directly from children. Many of these were built years ago and have been extended feature by feature since.

Charter and multi-location school networks face a layered picture. COPPA sits alongside FERPA and state student privacy laws. Any vendor they bring in is expected to meet all of them.

Lessons From Building For Under – 13s

We recently built an MVP for a California edtech startup creating a safe social learning space for girls aged 8 to 12. The app combines peer groups, avatars, chat rooms and daily quizzes. A few design decisions shaped it from the start:

  • The app runs on the parent’s device. Parents stay in control of access from day one.

  • Consent happens at registration. A parent consents during sign-up, before the child’s profile exists.

  • Purchases need parental approval. Optional in-app purchases go through the parent.

  • Third-party services are deliberate choices. The chat feature uses an external provider to keep costs down. Under the new rules, every provider like this has to be accounted for in privacy disclosures and consent.

  • Lean scope means less data. Building only the core features meant collecting only the data those features needed.

None of this was added after launch. It was decided in the first scoping conversations.

A Practical Starting Checklist

  • 1

    Map every piece of personal information your platform collects from children, and where it goes.

  • 2

    Review your consent flow against the expanded verification methods.

  • 3

    List every third-party service that touches student data, including analytics, chat and AI tools.

  • 4

    Write a retention policy with defined time periods, and make sure the platform enforces it.

  • 5

    Document your security program and name who owns it.

  • 6

    Before adding AI features, decide what children’s data the AI can access and how long it is kept.

How Azend Can Help

Azend Technologies has spent years building education technology for US clients, from large franchise networks to early-stage startups. We help education businesses audit existing platforms, close compliance gaps in consent and data handling, and build new products with privacy designed in from the first sprint.

If you’re unsure where your platform stands, we’re happy to talk it through.

This post is general information and not legal advice. Consult qualified counsel about your specific obligations.

about Azend Technologies

Azend Technologies empowers businesses to scale and innovate through expert digital transformation services