What Should Parents Confirm With Learning Platforms After the 2026 COPPA Rule Takes Effect?

The FTC’s amended COPPA Rule had a general compliance deadline of April 22, 2026, according to the final rule notice. That date does not make every learning platform subject to identical requirements. First identify whether the school arranged the service or your family signed up directly; then ask what information is collected, why it is used, and how a parent can request access or deletion.

Schedule: The rule was published on April 22, 2025, took effect on June 23, 2025, and set April 22, 2026, as the general compliance date for covered entities, as described in the FTC notice.

This week’s action: Save the platform’s current privacy notice and send the relevant questions below to the school or provider. Don’t treat a separate email address as a substitute for reviewing the service’s data practices.

This guide is for parents and guardians of children under 13 who use school-assigned or family-selected learning services in the United States. It is also for caregivers comparing learning apps and trying to understand who handles requests about a child’s information.

Last updated October 20, 2026. Dates and rule explanations checked against the FTC’s final rule notice and current COPPA guidance.

The 2026 COPPA rule and learning platforms

The Children’s Online Privacy Protection Act (COPPA) is not a general certification for educational products. The FTC’s guidance explains that coverage depends on factors such as whether a service is directed to children under 13 or has actual knowledge that it is collecting personal information from a child under 13. A label such as “learning app” does not settle the question. The service’s audience, knowledge, and information practices matter. See the FTC’s explanation of which services COPPA covers.

What does the 2026 COPPA rule mean for a child using a learning app? It means that a covered service should be assessed against the amended rule’s requirements after its general compliance deadline. It does not mean every educational service must offer identical controls, or that a parent can automatically require any platform to close an account. The practical first step is to identify who arranged the account and ask for the provider’s information-handling details.

The amended rule concerns how covered operators handle children’s personal information. For a parent, the useful questions are concrete: what information is collected, what the service does with it, who receives it, how long it is kept, and how to reach the person responsible for privacy questions. The FTC’s COPPA FAQ provides further explanation of the rule’s scope and parent-related processes.

COPPA is not the only possible framework. School records may raise separate questions under the Family Educational Rights and Privacy Act (FERPA). FERPA and COPPA are not interchangeable, and the fact that a platform is used for schoolwork does not by itself answer which rules apply to a particular record or request.

Family-selected platforms

When a parent creates an account directly, start with the provider’s privacy policy and any direct notice sent to parents. Look for the information collected from a child, the stated purpose for each category, disclosures to other organizations, retention and deletion practices, and a working contact route for parents.

Does the service ask for more than the course appears to need? Compare each requested item with the activity the child will use. A name or school identifier may be tied to account setup; a profile photo, location, contacts, or behavioral tracking may need a clearer explanation. Do not assume a particular item is unlawful simply because it seems unnecessary. Ask the provider to explain the connection between the information and the educational function.

Is the explanation specific enough to evaluate? “We use data to improve our services” may not tell a parent whether information is used for instruction, analytics, advertising, personalization, or sharing with service providers. Ask what “improve” means in this context and whether data is used for purposes outside providing the course. Check whether the notice explains how parents can exercise applicable rights.

A useful review sequence is:

• Identify the account owner and who selected the service.
• Note every category of child information the notice says it collects.
• Match each category to the stated purpose.
• Check which parties may receive the information and for what reason.
• Find the retention, deletion, and parent-contact procedures.
• Save the policy or notice and the date you reviewed it.

This is a way to organize questions, not a legal conclusion about coverage. The FTC notes that COPPA’s application depends on the particular service and circumstances. If a policy is unclear about whether information is used for advertising or other non-educational purposes, ask the provider directly before adding optional details or allowing optional features.

For additional context, the FTC’s guide for parents on children’s online privacy describes practical ways families can review services and discuss information sharing with children.

School-arranged services

A school may arrange an online service for a specific educational purpose and, in certain circumstances, may provide consent on a parent’s behalf. FTC guidance limits that school authorization to the educational context. It should not be read as permission for a provider to use student information for unrelated commercial purposes. The FTC COPPA FAQ explains the school authorization context.

Can a school consent on a parent’s behalf to a learning platform collecting a child’s information? In a qualifying educational setting, a school may be able to consent for the parent when the service is used for the school’s benefit and purpose. That authority is limited. It does not establish that every platform use is covered, nor does it give the provider open-ended permission to repurpose student information.

Ask the school which services are approved, what information each service collects, and what educational purpose it serves. Also ask whether the school has reviewed the provider’s privacy terms and whether the service uses data beyond what is needed to deliver the educational activity. A school’s selection of a tool is useful context, but it is not a reason to assume that every data practice is appropriate.

Does a school-assigned learning platform still require a parent to create a separate account? Not necessarily. Account setup depends on the school’s process and the platform’s requirements. Before registering independently, check the school’s instructions. A separate family account could create a duplicate profile or place the student under a different set of terms. Ask whether the school creates the account, sends an invitation, or expects a parent to complete a specific consent step.

The school is often the best first contact for a service it selected. Ask who handles student privacy questions and where parents should submit requests to review or delete information. The answer may distinguish between information held by the school and information held by the provider.

Parent and school responsibilities

For school records, FERPA can provide rights to parents in certain circumstances. The U.S. Department of Education’s FERPA overview explains the law’s relationship to education records. Its guidance on using online tools as part of a course also addresses concerns about course tools and student privacy.

Can a parent ask a learning platform to provide or delete a child’s information? A parent may have COPPA rights to review a child’s personal information and, in relevant circumstances, request its deletion from a covered operator. The applicable process depends on the service and the information involved. For a school-arranged tool, the school may be the right starting point, particularly if the request concerns records maintained as part of the student’s education. Check the FTC’s COPPA FAQ and the Department of Education’s FERPA information rather than treating the two laws as one request system.

A parent’s question about a platform account and a parent’s request to inspect an education record may go to different contacts. Ask the school to clarify which organization holds the relevant information and who receives the request. If the school says the provider handles it, ask for the provider’s parent privacy contact. If the provider directs the family back to the school, ask the school to confirm the route in writing.

Keep a simple record of the policy version or date reviewed, the contact person, the date you asked, and the response. This creates a clear trail if the family later needs to clarify what was explained or follow up on an unanswered request. Avoid sending sensitive documents or extra child information just to ask a general privacy question.

Questions to take to the school or provider

The following decision branches help determine whom to contact and what to request.

• If the school selected the platform, ask the school for its approved platform list, the purpose of each service, the categories of student information collected, and the contact who handles parent privacy questions.
• If your family selected and registered for the service, review its direct privacy notice and contact the provider about data collection, use, disclosures, retention, and parent requests.
• If the account’s origin is unclear, ask the school whether it created or authorized the account before registering again.
• If the policy describes education use but also mentions advertising, personalization, or analytics, ask which information supports each activity and whether any use is outside the educational purpose.
• If no one explains how to view or request deletion of information, ask for the correct privacy contact and a written description of the process before adding optional information.

For a school, a concise message could ask:

• Which learning services are approved for my child’s class, and what is each one used for?
• What child or student information does each service collect?
• Which information is required for the course, and which fields or features are optional?
• Does a provider use student information for purposes beyond delivering the school activity?
• Who can explain disclosures, retention, and deletion?
• Should a parent send a request to the school or directly to the provider?

For a family-selected service, ask the provider:

• What information is collected directly from my child or from the device or account?
• What is each category used for?
• Is information shared with other organizations, and for what purpose?
• How can a parent review the child’s information or request deletion?
• What is the correct contact for a parent privacy request?

Record the response and the date of the notice you reviewed. If an answer is vague, ask a narrower follow-up: “Which data is used for this purpose, and does that use continue after the course ends?” A clear answer should identify the relevant data and explain the process without requiring a parent to infer it from general marketing language.

Email separation: a limited privacy measure

A separate, managed email address can help keep routine platform notices away from a family’s primary inbox. It can also make it easier to identify which service sent a message. It does not prevent a learning platform from collecting a child’s name, school, activity data, or other information. It does not establish COPPA compliance, replace a review of the privacy notice, or override school account instructions.

For a school-assigned account, use the address or account method the school requires. Do not substitute a temporary address if it could prevent the school, child, or parent from receiving essential course notices or recovering access. A learning account may need to remain usable over time, so the ability to recover it matters more than keeping the registration address separate.

For optional, low-risk family signups, a separate address may be reasonable if the provider permits it and a parent can still receive required notices. The choice between a temporary address and an alias depends on whether the account must remain accessible. FoxFwd’s guide to temporary addresses versus aliases explains that distinction. Families reviewing what their primary inbox reveals can also use this inbox exposure audit guide.

For a child’s school account, the stronger safeguard is a clear account owner, a recoverable sign-in method, and a direct answer from the school about data practices. Email separation is only an inbox-management choice. It cannot answer the central questions: what the platform collects, why it collects it, and who can review or remove the information.

If a family is considering an optional service and the provider allows a separate address, FoxFwd can be considered for a low-risk registration where long-term recovery is not required. Keep school-mandated accounts and important education communications on the method approved by the school. For those decisions, the relevant next step is to compare temporary and long-term email options and ask the school or provider about the child’s data—not to treat an email address as a privacy review.