# FERPA and COPPA for special education apps: what schools need to know

> What each law covers, how they apply to apps used with students, the 2025 COPPA updates, and practical checks.

URL: https://theautismkit.com/guides/ferpa-coppa-special-education-apps
By The Autism Kit team · Updated 2026-09-27

**Short answer:** FERPA protects student education records held by schools and limits who they can share them with; vendors can receive records only under conditions like the school official exception. COPPA regulates online services collecting personal information from children under 13. The FTC updated the COPPA Rule in 2025 (effective June 23, 2025, with a deadline of April 22, 2026 to meet it in full). This is general information, not legal advice.

**Key takeaways**
- **FERPA** protects **student education records** held by schools.
- **COPPA** covers online services collecting data from **children under 13**.
- The **COPPA Rule** was updated in **2025**.
- Ask your **district counsel** for legal advice.

## What does FERPA cover?

FERPA protects the privacy of student education records and gives parents rights to access them. Schools may share records with vendors only under specific conditions, such as the school official exception with direct control over the data.[1]

## What does COPPA cover?

COPPA applies to operators of websites and online services that collect personal information from children under 13. The FTC published amendments to the COPPA Rule on April 22, 2025. They took effect June 23, 2025, and services had until April 22, 2026 to meet the rule in full.[2]

## What should schools check?

| Question | Why it matters |
| --- | --- |
| Does the app collect student personal information? | Triggers FERPA and COPPA duties |
| Does it need student accounts? | Accounts usually mean data collection |
| Where is data stored? | On-device storage limits exposure |
| Are there ads or tracking? | Often restricted for children |
| Will the vendor sign a DPA? | Puts duties in writing |

**Where The Autism Kit stands.** In the current app, children's routines and photos stay on the device, with no ads. We're happy to review your
  district's student data privacy agreement.

## What can I do next?

- [ ] List what student data each app collects
- [ ] Check vendors against your privacy policy
- [ ] Ask counsel about any open questions

Read next: [What is a student data privacy agreement?](https://theautismkit.com/guides/student-data-privacy-agreement)

## Common questions

### Can a school consent under COPPA instead of parents?

FTC guidance has allowed schools to authorize collection in limited educational contexts. Check current FTC guidance and your district counsel.

### Does FERPA apply to apps?

FERPA applies to schools. When schools share education records with a vendor, they must meet FERPA's conditions, often under the school official exception.

### What if an app collects no student data?

Privacy risk is much lower when student information stays on the device, but districts may still want to review the app.

## Sources

1. US Department of Education, Student Privacy Policy Office: FERPA. https://studentprivacy.ed.gov/ferpa
2. Federal Trade Commission: Children's Online Privacy Protection Rule (COPPA). https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa

General guidance, not a diagnosis or treatment plan. Talk with your pediatrician or a developmental specialist about your child's care.