Edtech Privacy Assessment

EdTech Privacy Assessment — Children's Data in Educational Technology

Overview

Educational technology (EdTech) platforms that process children's personal data operate at the intersection of multiple privacy frameworks. In the United States, COPPA's school exception (16 CFR 312.5(c)(4)) allows schools to provide consent on behalf of parents for the collection of children's data in educational contexts, but only for school-authorised educational purposes. The Family Educational Rights and Privacy Act (FERPA, 20 U.S.C. Section 1232g) governs education records maintained by educational agencies or institutions receiving federal funding. In the EU, GDPR applies with the heightened protections of Art. 8 (parental consent for children) and Recital 38 (specific protection for children). The UK AADC applies to EdTech services likely to be accessed by children. This skill provides a framework for conducting privacy assessments of EdTech platforms that navigate these overlapping requirements.

Regulatory Frameworks

COPPA School Exception — 16 CFR 312.5(c)(4)

COPPA permits an operator to collect personal information from a child for the use and benefit of the school, and for no other commercial purpose, without obtaining verifiable parental consent directly, when:

1. The school has authorised the collection of personal information on behalf of the students
2. The collection is solely for the school's use and benefit in the educational context
3. The operator does not use the collected information for any commercial purpose unrelated to the educational context
4. The operator does not disclose the information to non-school third parties

Critical Limitations:

• The school acts as an agent of the parent; the school does not have unlimited authority
• The school can only consent to the collection of information necessary for the school-authorised educational activity
• If the operator wants to use the data for commercial purposes (including advertising), the operator must obtain verifiable parental consent directly from the parent
• The FTC has stated that schools "should not be able to consent on behalf of the parent to the collection of information that is not needed for the educational purpose" (FTC COPPA FAQ J.2)

FERPA — 20 U.S.C. Section 1232g

FERPA protects education records maintained by educational agencies or institutions that receive federal funding. EdTech platforms may receive education records as "school officials" under the school official exception.

Key Provisions:

• Education records: Records, files, documents, and other materials directly related to a student that are maintained by an educational agency or institution or by a person acting for such agency or institution
• School official exception (34 CFR 99.31(a)(1)): An educational agency or institution may disclose education records to a contractor, consultant, volunteer, or other party to whom the agency has outsourced institutional services or functions, provided that: the party performs an institutional service or function; the party is under the direct control of the agency; the party uses the education records only for the purposes for which the disclosure was made; the party meets the criteria specified in the agency's FERPA annual notification
• Legitimate educational interest: The school official must have a legitimate educational interest in the education records — meaning the official needs to review the record to fulfil their professional responsibility
• Directory information exception (34 CFR 99.37): Schools may disclose directory information (name, address, telephone number, email, date and place of birth, honours, activities) without consent if parents have been notified and given the opportunity to opt out

FERPA vs. COPPA Interaction

GDPR Application to EdTech

In the EU, the COPPA school exception does not exist. Schools using EdTech platforms must comply with:

• Art. 6 Lawful Basis: Schools may rely on Art. 6(1)(e) (public task) for processing necessary for educational purposes, or Art. 6(1)(f) (legitimate interests) where public task does not apply
• Art. 8 Parental Consent: If the EdTech platform relies on consent as its lawful basis for processing children's data, parental consent is required for children below the applicable national threshold
• Art. 28 Processor Agreement: If the school is the data controller and the EdTech vendor is the processor, a compliant Art. 28 data processing agreement must be in place
• Controller Determination: The school is typically the controller for educational processing; the EdTech vendor is the processor. However, if the vendor processes data for its own purposes (product improvement, analytics, advertising), it becomes a controller or joint controller for those purposes

Student Privacy Pledge (FPF/SIIA)

The Student Privacy Pledge, administered by the Future of Privacy Forum (FPF) and the Software and Information Industry Association (SIIA), is a voluntary industry commitment. Signatories commit to:

1. Not sell student personal information
2. Not behaviourally target advertising to students using data from the educational context
3. Not create advertising profiles of students
4. Not change privacy policies without notice and choice
5. Enforce strict limits on data retention and deletion
6. Support access to and correction of student information by authorised parties
7. Use student data only for authorised educational/school purposes or as directed by parent/student
8. Maintain a comprehensive data security program
9. Not disclose student information except for legitimate educational purposes
10. Require downstream recipients to comply with these commitments

Over 400 EdTech companies are signatories as of 2024.

EdTech Privacy Assessment Framework

Assessment Phase 1: Platform Classification

Assessment Phase 2: Data Mapping

For each data element collected by the EdTech platform:

Assessment Phase 3: Legal Basis Evaluation

Assessment Phase 4: Contractual Requirements

The agreement between the school and the EdTech vendor must address:

1. Scope of data processing: Specific data elements, purposes, and retention periods
2. Prohibition on commercial use: Vendor may not use student data for advertising, marketing, or non-educational product development
3. Sub-processor restrictions: Vendor must disclose all sub-processors and ensure they comply with equivalent restrictions
4. Data deletion obligations: Vendor must delete all student data at the school's request and at the end of the contract period
5. End-of-year deletion: Vendor must delete or return all student data at the end of each academic year unless the school specifically authorises retention
6. Security requirements: Specific technical and organisational security measures
7. Breach notification: Vendor must notify the school within 24-72 hours of a data breach affecting student data
8. Audit rights: School has the right to audit the vendor's compliance with the agreement
9. FERPA compliance (US): Vendor acknowledged as school official; data used only for legitimate educational interests
10. COPPA compliance (US): Vendor acknowledges school exception limitations; does not use data for non-educational commercial purposes