Skip to content
the autism kit
Guide

FERPA and COPPA for special education apps: what schools need to know

What each law covers, how they apply to apps used with students, the 2025 COPPA updates, and practical checks.

By The Autism Kit teamUpdated Sep 27, 2026 · 1 min read
Listen to this articleAbout 1 min
Read aloud · speed
A laptop screen showing the words cyber security
Photo: cottonbro studio on Pexels
The short answer

FERPA protects student education records held by schools and limits who they can share them with; vendors can receive records only under conditions like the school official exception. COPPA regulates online services collecting personal information from children under 13. The FTC updated the COPPA Rule in 2025 (effective June 23, 2025, with a deadline of April 22, 2026 to meet it in full). This is general information, not legal advice.

Key takeaways
  • FERPA protects student education records held by schools.
  • COPPA covers online services collecting data from children under 13.
  • The COPPA Rule was updated in 2025.
  • Ask your district counsel for legal advice.

What does FERPA cover?

FERPA protects the privacy of student education records and gives parents rights to access them. Schools may share records with vendors only under specific conditions, such as the school official exception with direct control over the data.1

What does COPPA cover?

COPPA applies to operators of websites and online services that collect personal information from children under 13. The FTC published amendments to the COPPA Rule on April 22, 2025. They took effect June 23, 2025, and services had until April 22, 2026 to meet the rule in full.2

What should schools check?

Practical privacy checks for apps
QuestionWhy it matters
Does the app collect student personal information?Triggers FERPA and COPPA duties
Does it need student accounts?Accounts usually mean data collection
Where is data stored?On-device storage limits exposure
Are there ads or tracking?Often restricted for children
Will the vendor sign a DPA?Puts duties in writing

What can I do next?

0 of 3 done

Read next: What is a student data privacy agreement?

Common questions

FTC guidance has allowed schools to authorize collection in limited educational contexts. Check current FTC guidance and your district counsel.

Sources

  1. US Department of Education, Student Privacy Policy Office: FERPA. studentprivacy.ed.gov
  2. Federal Trade Commission: Children's Online Privacy Protection Rule (COPPA). ftc.gov

This guide shares general information and our team's perspective, based on the sources above. Rules and services differ by country, region and school, so always check your local guidance and your organisation's policies. How we write our guides.

Was this guide helpful?
Share this guide with someone who'd find it useful
Listen

Keep reading

All guides and stories →

One small, useful tip a week

Practical ideas built on evidence-based practices, plus a free printable to start. Unsubscribe anytime.

We never sell or share your email.