Per FTC staff guidance, a school can act as the parent's agent and consent to an app collecting student information, but only for educational services that benefit the school and have no other commercial purpose. Anything beyond that, such as behavioral advertising, needs parental consent. This is general information, not legal advice.
What the guidance says
The FTC's COPPA FAQ has a section on schools. The key points:
- School authority is limited to the educational context.
- If an operator uses or discloses students' information for its own commercial purposes, it must get parental consent. Examples given include online behavioral advertising and building user profiles unrelated to the school service.
- Operators should not say in their terms of service that the school is responsible for COPPA compliance, because the operator carries that responsibility.
- The method used to confirm school consent must be reasonably reliable.
What operators must provide to schools
According to the same section, an operator should give schools:
- Direct notice of its information practices, the same notice it would give a parent.
- On request, a description of the types of personal information collected.
- A chance to review a child's personal information and have it deleted.
- A chance to stop further use or collection of the child's information.
It should also delete the information once it is no longer needed for the educational purpose.
Why this is an engineering question too
Each of those promises needs software behind it. A short mapping:
| Promise to the school | What your system must be able to do |
|---|---|
| Describe what you collect | Keep an accurate data inventory, including data gathered by libraries |
| Let the school review data | Export a student's data on request |
| Delete on request | Delete across databases, backups policies, logs, and analytics tools |
| No other commercial use | Ensure no SDK sends identifiers to ad or profiling services |
| Stop collection | Turn off collection per account, not just per release |
The last two rows are where dependencies bite. A tag script or analytics package added for the marketing site can end up inside the student app through a shared component. If it builds a profile, your "no other commercial use" statement stops being true without anyone deciding that.
A practical safeguard
Keep student-facing apps on a separate, short dependency list from your marketing sites. Review any addition to the student app against a simple rule: does this package send data anywhere other than our own services? If yes, it needs a named owner and a documented reason.
Also review changelogs when a library updates. New telemetry is often added in a minor release and noted in a single line.
Quick check
Can our terms of service make the school responsible for COPPA compliance?
The FTC staff guidance says operators should not state that, since the operator carries the responsibility. Ask counsel to review your terms.
Can we use student data to improve our product?
The guidance draws the line at the operator's own commercial purposes, with advertising and unrelated profiles as examples. Whether product improvement falls inside the educational purpose is a question for your counsel and your agreements.
Safeguard's dependency scanning and policies can help a team notice when a new package enters a student-facing build, and the free scan gives a first look at an existing repository.
Sources
Last reviewed: 19 October 2026.
