Policy Watch for Parents: Child Data Privacy Laws That Actually Affect Your Family

What “child data privacy” really means (and why parents feel stuck)

If you’ve ever clicked “I agree” on a school app at 10:47 p.m. just to stop the reminder emails, you’re not alone. Most families don’t have time to read privacy policies—yet kids’ data is collected constantly: names, birthdays, location, device IDs, browsing behavior, learning progress, voice recordings, and sometimes even biometrics.

Here’s the parent reality: the laws that protect kids online are real, but they don’t cover everything. Some rules apply to companies, some apply to schools, and some depend on your child’s age and where you live.

This policy watch breaks down the child data privacy laws parents should know, the kids online privacy regulations that come up most often, and the school app privacy rules that affect day-to-day life—plus exactly how to protect children’s data legally with practical steps.

The “big 4” laws most likely to impact your family

These are the policies that come up over and over for parents in the U.S. (even if you’ve never heard their names). Think of them as the rules that shape what apps can ask for, what schools can share, and what rights you can request.

1) COPPA (Children’s Online Privacy Protection Act)

Who it’s for: Children under 13 in the U.S.

What it does: COPPA limits how websites and apps can collect personal information from kids under 13. In many cases, companies must get verifiable parental consent before collecting or using a child’s data.

What parents should know:

• COPPA is triggered when a service is directed to kids under 13 or knowingly collects data from them.
• Schools can sometimes consent on a parent’s behalf for tools used only for education—but that consent is supposed to be limited to school purposes.
• COPPA doesn’t automatically mean “no data collection.” It means guardrails: notice, consent, reasonable security, and limits on use.

Real-life example: A math game that asks for a child’s full name + voice recording + location should raise your eyebrows. Under COPPA, a kid-directed app should be extremely careful with that kind of data.

2) FERPA (Family Educational Rights and Privacy Act)

Who it’s for: Students in schools that receive U.S. Department of Education funds (most public schools)

What it does: FERPA gives parents rights over education records—what the school keeps about your child and who it shares it with.

What parents should know:

• You can generally request to inspect and review your child’s education records.
• Schools must follow rules about disclosing records, with certain exceptions.
• Once a student turns 18 (or attends certain postsecondary programs), rights usually transfer to the student.

Important nuance: FERPA covers education records, not every piece of data created by an app. This is where confusion happens. A school platform may generate lots of data that isn’t clearly treated the same way in practice.

3) State student data privacy laws (school-focused)

Who it’s for: Students and families in states with specific student data privacy statutes

What they do: Many states now restrict education technology (“edtech”) vendors from using student data for targeted advertising, selling data, or building profiles unrelated to school.

What parents should know:

• These laws often apply to vendors contracting with schools—not necessarily every consumer app your child downloads.
• Protections vary a lot by state, but many follow the same themes: data minimization, security, limited use, and deletion requirements.

How to use this: Ask your district if they have a student data privacy agreement (sometimes called a Data Privacy Agreement, DPA) with the vendor. If they do, that’s a signal the district has at least reviewed terms.

4) State consumer privacy laws (family-focused)

Who it’s for: Residents of certain states (varies)

What they do: Some state privacy laws give people rights to access, delete, or opt out of certain data uses. Several treat kids’ data as “sensitive” or add extra protections for minors.

What parents should know:

• Your rights depend on where you live and the company’s size/coverage.
• These laws can be useful for consumer apps (social, games, streaming, shopping) that are not “school tools.”

If you’re thinking, “This is a lot,” you’re right. The key is to translate laws into a home checklist you can actually use.

School app privacy rules: what to ask before you click “Approve”

Schools increasingly rely on digital tools, and parents are often asked to approve them quickly. Here’s a practical lens: What data is collected, why, and where does it go next?

Use the table below as a set of scripts you can copy/paste into an email to a teacher, principal, or tech coordinator.

What to check	Why it matters	What to ask the school/vendor	“Good” answer sounds like	Red flags
Data collected (minimum needed?)	More data = more risk	“What student data does this app collect (name, email, location, voice, photos)?”	“Name + school email only; no location; no biometric data.”	Requires DOB, phone, precise location, or microphone access without a clear learning need
Purpose limitation	Prevents repurposing	“Is data used only for instruction, not ads or product development?”	“Used only to provide the service; no targeted ads; no selling.”	“We may use data to improve services” without clear limits
Ads and tracking	Kids shouldn’t be tracked for marketing	“Is there targeted advertising or third-party tracking?”	“No ads; analytics are limited and de-identified.”	Behavioral ads, SDKs that track across apps/sites
Data sharing	Protects against onward sharing	“Who else gets access (subprocessors)? Is there a list?”	“Only vetted subprocessors under contract; list available.”	No list; vague “partners” language
Security basics	Reduces breach risk	“Is data encrypted in transit/at rest? What’s your breach response plan?”	“Yes; documented security program; prompt notification.”	Won’t answer; no clear security contact
Retention & deletion	Keeps data from lingering forever	“When is student data deleted after the class ends?”	“Deleted within X days; school can request deletion anytime.”	“We keep data as long as needed” with no timeline
Parent/student rights	Turns policy into action	“How do parents access, correct, or delete data?”	“Portal or email process; responses within a timeframe.”	No process; only “contact your school” with no follow-through

A quick tip: you don’t have to interrogate every tool. Start with the apps that collect the most sensitive data (voice, video, location, behavioral tracking) or that your child uses the most.

The parent playbook: how to protect children’s data legally (without becoming a lawyer)

Below are specific moves that reliably improve privacy outcomes at home and in school—while staying realistic about time and attention.

At home (consumer apps, games, devices)

• Use age-appropriate accounts. If a platform offers a child/teen experience, use it. These versions often reduce ad tracking and tighten messaging defaults.
• Turn off “precise location” for everything that doesn’t truly need it. Maps: yes. Puzzle games: no.
• Limit microphone/camera permissions. Set to “Ask Every Time” when possible.
• Delete old apps and accounts twice a year. If your child doesn’t use it, it shouldn’t keep collecting data.
• Know your “data rights” email. Use one consistent email address for privacy requests so you can track responses.

With schools (edtech tools)

• Ask for the vendor list. Many districts have a page listing approved apps. If they don’t, request it.
• Request the district’s privacy process. Ask: “Who reviews apps for privacy/security before classroom use?”
• Ask whether the app is optional. If it’s not optional, ask what alternatives exist and how data is protected.
• Push for single sign-on (SSO) through the school. It reduces password reuse and can limit what data the vendor receives.

What to do if something feels off

• Start with a calm, written question. Keep it factual: what data, why, retention, ads, sharing.
• Escalate inside the system first. Teacher → principal → district IT/data privacy contact.
• Document everything. Screenshot permission prompts, consent forms, and privacy policy sections.

Here are a few ready-to-send questions:

• “Is this tool covered by a district agreement that prohibits selling data or targeted advertising?”
• “Can you confirm whether students must create accounts with personal emails or if it uses school-managed sign-in?”
• “What’s the data deletion timeline after the semester ends?”

Next Steps: a 20-minute plan for this week

You don’t need a perfect privacy setup. You need momentum—and a few high-leverage habits.

1. Pick your top 3 apps to review (one school app, one game, one social/video app).
2. Do a permission sweep on your child’s device:
   • Location: off unless needed
   • Microphone/camera: ask every time
   • Contacts/photos: only if required
3. Send one school privacy email using the table prompts:
   • Ask what data is collected
   • Ask whether ads/tracking are used
   • Ask the retention/deletion timeline
4. Create a simple family rule: “We don’t install new apps without a 2-minute check.”
5. Set a calendar reminder for a twice-yearly “data clean-out” (delete unused apps, request account deletion when possible).

If you want an easy guiding principle: kids’ data should be collected only for a clear reason, kept only as long as needed, and shared only with true service providers—not the entire internet economy. The laws help, but your questions and choices are what make the protections real in daily life.