Regulation Cheat Sheet: COPPA, FERPA, and State Privacy Laws for Kids’ AI

The 60‑second overview: what laws protect kids’ online data

If your child is using AI—whether it’s a chatbot, a homework helper, or an app that “listens” to reading—there are a few big rules that determine what companies and schools can do with your child’s data.

Here’s the simplest mental model:

• COPPA = rules for commercial apps/sites collecting data from kids under 13.
• FERPA = rules for schools handling education records (and the vendors schools use).
• State privacy laws = a growing set of rules that may give extra rights (like deletion or limits on targeted ads), and some states have special student data privacy laws.

Parents often ask: “So… what laws protect kids online data?” The answer is “some do, but it depends on where the tool is used (home vs. school), who provides it (app company vs. school district), your child’s age, and your state.”

This cheat sheet will help you quickly spot which rulebook applies—and what to do next.

COPPA: what to know about AI apps for kids (especially under 13)

COPPA (the Children’s Online Privacy Protection Act) is the law most people mean when they talk about children’s data privacy laws explained in plain English.

When COPPA kicks in

COPPA generally applies when:

• An app, website, or online service is directed to children under 13, or
• The service has actual knowledge it’s collecting personal information from a child under 13.

With coppa ai apps for kids, this matters because many AI tools collect or infer data such as:

• Voice recordings (speech-to-text)
• Photos or avatars
• Location data
• Persistent identifiers (device IDs, cookies)
• Free‑text prompts (which might include names, school, or sensitive details)

What COPPA typically requires (in parent terms)

COPPA’s “big three” for parents:

• Notice: The company should clearly say what it collects and why.
• Verifiable parental consent (in many cases): For collecting personal info from under‑13 users.
• Data minimization & security: Collect only what’s needed, keep it secure, and retain it only as long as necessary.

COPPA red flags to look for in AI apps

If you’re evaluating an AI app at home, watch for:

• A vague privacy policy that doesn’t mention children or COPPA.
• Open-ended data use, like “we use data to improve our services” without specifics.
• Sharing with advertisers or “marketing partners.”
• Unlimited retention (“we keep data as long as needed” without defining limits).
• No parental controls or no way to delete data.

Quick parent reality check

COPPA is helpful, but it’s not magic:

• It doesn’t automatically mean “no data is collected.” It means collection is supposed to be disclosed, limited, and consented.
• Many general-audience AI tools try to avoid COPPA by saying “not for under 13” in their terms. If an app is 13+, COPPA may not apply—even if younger kids can technically access it.

FERPA: student data + AI tools used through school

FERPA (the Family Educational Rights and Privacy Act) is the key U.S. education privacy law. It governs education records maintained by schools that receive federal funds.

Parents searching for ferpa student data ai tools usually want to know: “If the school uses an AI platform, can that company do whatever it wants with my child’s data?”

What counts as a FERPA “education record”

In everyday terms, it’s information that is:

• Directly related to a student, and
• Maintained by the school (or a party acting for the school)

Examples often include grades, attendance, discipline records, IEP-related documents, and sometimes communications within school systems.

Where AI complicates things

AI tools used at school can blur lines:

• A writing assistant may process student essays (which can reveal identity, opinions, or sensitive topics).
• A tutoring tool may generate learning profiles (strengths, weaknesses, pace).
• A classroom platform may log behavior and engagement.

FERPA generally gives parents (and eligible students) rights such as:

• Access to education records
• Requesting corrections of inaccurate records
• Control over disclosures of records (with important exceptions)

The “school official” / vendor question (the part parents should ask about)

Schools often use vendors under a “school official” arrangement. Practically, that means:

• The vendor may access student data to provide a service the school would otherwise do itself.
• The vendor should be under the school’s direct control regarding use and maintenance of the data.

When an AI vendor contract is strong, it typically:

• Limits data use to providing the school service
• Prohibits selling data or using it for targeted advertising
• Sets retention/deletion timelines
• Requires security measures and breach notification

What FERPA doesn’t always cover

FERPA may not clearly cover:

• Data a student shares in a non-school, direct-to-consumer app at home
• Certain “metadata” or analytics depending on how it’s maintained and by whom
• Everything that feels like “data about my child” (which is why state laws and district contracts matter)

State privacy laws: the extra layer parents can actually use

Beyond federal laws, states are increasingly passing privacy rules. Parents often ask for children data privacy laws explained at the state level because these rules can add practical rights like deletion, opt-outs, and stronger limits on sensitive data.

There are two major buckets:

• General consumer privacy laws (often give rights to access/delete/opt out of sale or targeted ads)
• Student data privacy laws (often restrict how edtech vendors handle student information)

Because state laws vary, the best parent approach is to use them as a question checklist: “Do we have deletion rights? Can we opt out of targeted ads? Is sensitive data limited?”

A parent-friendly table: what to ask, and what “good” looks like

Below is a practical cheat sheet you can use when reviewing an AI app or asking your school about an AI tool.

Situation	Which rule usually applies?	What to ask (copy/paste)	What a good answer sounds like
Child under 13 using an AI app at home	COPPA (+ state laws)	“Do you collect any personal info from under-13 users, and how do you get parental consent?”	Clear COPPA notice, verifiable consent, parent dashboard, limited collection
Student uses an AI tool assigned by school	FERPA + district contract + state student privacy laws	“Is the vendor under a school agreement that restricts data use to school purposes only?”	Written contract; no sale/ads; deletion timelines; security requirements
AI tool uses voice, face, or biometrics	State laws may add restrictions	“Do you collect voiceprints/face templates? Can we opt out and still use the tool?”	Minimization, opt-out option, no biometric templates stored, short retention
App offers “free” AI homework help with ads	State laws + platform policies; COPPA if under 13	“Do you share data for targeted advertising or profiling?”	No targeted ads to kids; no sharing/sale; contextual ads only (or none)
Teen (13–17) uses a general chatbot	State laws may provide opt-outs	“Can my teen delete conversation history and stop data from training models?”	Easy deletion, training opt-out, short retention, clear controls

Practical tip: focus on four data rights

Regardless of your state, these four questions are consistently useful:

• Access: Can I see what data you have?
• Delete: Can I delete it easily?
• Opt out: Can I stop targeted ads or model training?
• Limit: Can the tool work without collecting extras (location, contacts, microphone always-on)?

If a company can’t answer these clearly, treat that as a signal—not a challenge.

How parents can spot safer AI tools (and talk to schools without getting ignored)

You don’t need a law degree to advocate for privacy. You need a short script, a few settings checks, and a willingness to ask for the contract terms.

At-home checklist for AI apps

Before your child uses a new AI app, do this quick pass:

• Check the age gate: Is it 13+? If your child is under 13, don’t “work around” it.
• Scan the privacy policy for 3 lines:
  • What data is collected?
  • Is it shared/sold?
  • How do you delete it?
• Look for model training language: Phrases like “improve our models” or “train our AI” should come with an opt-out.
• Turn off unnecessary permissions:
  • Microphone (unless needed for a specific lesson)
  • Location
  • Contacts
  • Photo library access
• Create a “kid-safe account”:
  • Use a nickname
  • Avoid school name in profile
  • Use a parent email (for under 13, this also supports consent flows)

Questions to email your school (short, specific, answerable)

When schools roll out AI tools, staff are busy—and vague concerns can get brushed aside. Use direct, yes/no-friendly questions:

• “Is this tool covered by a district agreement (contract/DPA), or are students signing up individually?”
• “Does the vendor prohibit selling student data and targeted advertising?”
• “Is student data used to train the vendor’s AI models? If yes, is there an opt-out?”
• “What is the retention period for student prompts, files, and generated outputs?”
• “What is the school’s process for parent access or deletion requests?”

Watch-outs specific to AI

AI introduces a few unique privacy angles:

• Prompts can contain sensitive info (family details, health, emotions). Teach kids a simple rule: “Don’t type it if you wouldn’t want it read aloud in class.”
• Outputs can be saved. Some tools store chat history by default—check settings.
• “Personalization” can mean profiling. Helpful personalization is fine; opaque scoring or behavioral tracking is not.

Next Steps: a simple plan for the next 20 minutes

If you want to take action today, here’s a fast, realistic path.

• Pick one tool your child uses most (a chatbot, tutoring app, or school platform).
• Do a 5-minute privacy sweep:
  • Find “Privacy,” “Data,” or “Safety” settings
  • Turn off chat history where possible
  • Disable model training if there’s a toggle
• Send one email to the school using the questions above (copy/paste is fine).
• Have a 3-minute conversation with your child:
  • What kinds of questions are safe to ask an AI?
  • What information should never be shared (full name + school, address, phone, passwords, photos of IDs)
  • What to do if the AI asks for personal info (stop and tell you)

If you’d like, reply with the name of the AI app or school tool you’re evaluating and your child’s age range (under 13 / 13–17). I can help you map it to COPPA vs. FERPA vs. state privacy expectations and draft a short message to the school or vendor.