Edtech engineering teams serving US schools should start by mapping which student data they hold, then build a written information security program, document vendor assurances and prepare to answer school questions under FERPA. If any users are children under 13, COPPA's security rule sets concrete program steps.
Why is edtech compliance different?
You rarely hold the legal relationship with the student. The school or district does, and it passes obligations to you through contracts. The US Department of Education's student privacy site describes FERPA as the federal law that gives parents rights over access to their children's education records, the right to seek amendment, and some control over disclosure of personally identifiable information from those records. Rights transfer to the student at 18 or on entering a postsecondary institution. The same site lists education technology vendors among the audiences it addresses.
So a district's first question is rarely "do you have a certificate". It is "where does student data go and who can see it".
What does COPPA require on security?
If your service collects personal information from children under 13, the FTC's COPPA Rule section 312.8 applies. It is unusually specific for a regulation. The operator must maintain reasonable procedures to protect confidentiality, security and integrity, and at a minimum a written information security program with safeguards appropriate to the sensitivity of the data and the operator's size, complexity and activities. The program must:
- Designate one or more employees to coordinate it.
- Identify risks and, at least annually, perform additional assessments of internal and external risks and of the sufficiency of safeguards.
- Design, implement and maintain safeguards to control those risks, based on volume and sensitivity of data and likelihood of harm.
- Regularly test and monitor the effectiveness of safeguards.
- At least annually, evaluate and modify the program in light of risks, test results, new methods and material changes.
Paragraph (c) covers vendors: before letting other operators, service providers or third parties collect or maintain children's data on your behalf, or before releasing data to them, take reasonable steps to determine that they can maintain confidentiality, security and integrity, and obtain written assurances that they will do so.
Whether COPPA applies to your product depends on facts such as audience and data collected, so confirm with counsel.
What should engineers build to support that?
Constructed example. A reading-practice app for grades 2 to 5 runs on a cloud database with an analytics vendor and a speech-recognition API. The team keeps:
- A data map: fields collected, where each is stored, which vendors receive it, retention period.
- A named security coordinator and a calendar entry for the annual risk assessment.
- A vendor register with the written assurances, the reviewing date and the data each vendor touches.
- Tests run on a schedule, such as dependency scans, access reviews and restore drills, with results saved.
Where does software supply chain risk show up?
Student apps lean on third-party libraries, SDKs and hosted services. Section 312.8 asks you to control risks identified in assessment, so an unreviewed analytics SDK that sends identifiers off platform is an assessment finding. A component inventory per release and a vulnerability triage routine give the assessment real inputs.
What do district security reviews ask for?
Common requests include: data flow diagrams, subprocessors, encryption, incident notification terms, retention and deletion at contract end, and access controls. This list comes from experience of the review pattern, not a regulation. Prepare a standard packet so each district does not restart the work.
What to do
- Build the student data map and keep it current with each release.
- Name a security coordinator and write down the program in plain language.
- Calendar the annual risk assessment and program review.
- Create a vendor register with written assurances and data scopes.
- Remove data you do not need and define deletion at contract end.
- Run scheduled tests and keep dated results.
- Keep a component inventory and a vulnerability response routine for dependencies.
- Prepare a standard district packet with data flows, subprocessors and incident terms.
Safeguard's SBOM and dependency scanning can supply step 7. It does not decide legal applicability or certify compliance.
Quick check
Does COPPA require a written security program?
Yes, for operators covered by the rule. Section 312.8(b) requires a written information security program with a designated coordinator, annual risk assessments, tested safeguards and annual program review.
Are vendors covered by the same rule?
Section 312.8(c) requires reasonable steps to confirm vendors can protect children's data and written assurances before data is shared or collected on your behalf.
Sources
Last reviewed: 18 October 2026.
