A Plain-English Guide to Student Data, COPPA and Local AI

When I started building a learning app for middle schoolers, I assumed privacy would be a checkbox near the end, like picking a font for the footer. It turned out to be more like the foundation of a house. Get it wrong and everything built on top sits a little crooked. I am an engineer and a parent, not a lawyer, so let me say this clearly up front: this is not legal advice. It is a plain-English tour of what I have learned, written for parents who want to ask better questions and for small builders who do not have a legal department. If you are building something real, talk to a lawyer who knows children's privacy law.

COPPA in plain English

COPPA is the Children's Online Privacy Protection Act, a US federal law. The Federal Trade Commission enforces it through regulations usually called the COPPA Rule. The short version:

• It applies to websites, apps and online services directed to children under 13, and to general audience services that know they are collecting personal information from children under 13.
• Before collecting personal information from a child under 13, a service generally needs verifiable parental consent. Not a box the kid ticks, but a method reasonably designed to confirm that a parent is actually the one agreeing.
• "Personal information" is broader than most people expect. It includes names and contact details, but also persistent identifiers that can recognize a device over time, photos, videos, audio files containing a child's voice, and location detailed enough to find a street.
• Parents have the right to review what was collected about their child and to have it deleted.

One wrinkle for middle school: grades 6 to 8 straddle the age 13 line. Some kids in a class are covered by COPPA and some are not. As a builder, I find it simpler and kinder to treat everyone with the same care, rather than flipping privacy practices on a kid's birthday. Other laws can apply too, including rules about school records and a growing number of state privacy laws, so think of COPPA as the floor, not the ceiling.

The FTC keeps its guidance in one place, and it is more readable than you might fear: the FTC's children's privacy resources.

What the amended rule adds

The FTC updated the COPPA Rule, and the amended rule became enforceable on April 22, 2026. Three changes stand out for small builders.

A written data retention policy. You need to write down what children's information you keep, why you keep it, and when you delete it, with real time limits. Keeping kids' data forever "just in case" is not allowed. I like this one. In engineering terms, it means putting an expiry date on everything.

A written information security program. Not just "we use encryption," but a written program that describes how you protect children's information, who is responsible for it, and how you review and update it. For a small team this can be a short, honest document. The point is that someone has thought it through and owns it.

Separate consent for sharing with third parties. If you want to disclose a child's information to third parties, for example for advertising, you need separate verifiable parental consent for that disclosure, unless it is integral to the service. It cannot be folded into the general "yes, my kid can use this app" consent.

Consent per purpose, per vendor, and less data overall

I have come to think consent works best when it is broken down by purpose and by vendor, even beyond what the law strictly requires. A parent should be able to say yes to "use my kid's answers to choose the next practice problem" and no to "use my kid's voice recordings to improve a speech model." They should also know which outside company, if any, touches each piece. Think of a field trip permission slip. You want to know where the bus is going and who is driving, not sign one form that covers every trip for the year.

The best partner to good consent is data minimization. The safest data is data you never collected. Before adding any field, I ask three questions:

1. Do we need this to help the kid learn, right now?
2. Could we get the same benefit from something less personal, like a grade level instead of a birthdate?
3. When will we delete it?

If there is no clear answer, we do not collect it. It is like keeping a small pantry. Less goes stale, and you always know what is on the shelves.

AI vendors and zero data retention

Most learning apps that use AI send some of a student's input to a model provider. That provider is a third party, and it deserves the same scrutiny as any other. Whether you are a parent reading a privacy policy or a builder reading a vendor contract, these are the questions I would ask:

• What exactly is sent? Ideally only the minimum needed for the task, with names and other identifiers stripped out first.
• Is it stored, and for how long?
• Is it used to train the provider's models?
• Is a zero data retention arrangement available?

Some AI providers offer zero data retention settings or agreements for business customers, under which inputs and outputs are not stored after a request is processed, subject to their terms. These are not always on by default and sometimes come with conditions, so read the actual terms rather than the marketing page. If a vendor cannot give you a clear answer, treat that as a no.

When on-device AI is the better choice

There is another option that keeps getting more practical: running the AI on the device itself. Smaller local language models, and the on-device speech recognition built into many phones, tablets and laptops, can do useful work without the data ever leaving the device.

For kids, this is often the better privacy choice, especially for the most sensitive inputs. A child's voice explaining a math problem, or a photo of a worksheet with their name at the top, never needs to leave the tablet if it is transcribed and processed locally. There is no third party to vet, nothing to retain on a server, and nothing to leak from a system you do not control.

It is a tradeoff, though, not a free lunch:

• Quality. Local models are smaller and usually less capable than the largest cloud models. They can be fine for some jobs, like transcription or simple checks, and weaker at others, like nuanced feedback on a written explanation.
• Battery and heat. Running a model locally works the device harder. An older family tablet may get warm and drain quickly.
• Download size. Models can be large files. Asking a family to download one over a slow connection, or onto a nearly full device, is a real cost.
• Device variety. Not every family has a recent device, and a feature that only works on new hardware is not fair to everyone.

My rule of thumb: process the most sensitive raw inputs, like voice and photos, on the device when you reasonably can, and send only a minimal, de-identified result to the cloud when a bigger model is truly needed. It is like the difference between a home kitchen and a restaurant. Do the prep at home, and only send out what you cannot make yourself.

Takeaways

• This is not legal advice. If you are building, talk to a lawyer who knows children's privacy.
• COPPA covers children under 13 and requires verifiable parental consent before collecting their personal information.
• The amended FTC rule, enforceable since April 22, 2026, asks for a written data retention policy with time limits, a written information security program, and separate consent for disclosures to third parties.
• Break consent down by purpose and by vendor so parents can say yes to some uses and no to others.
• Collect less. Ask whether you need it, whether something less personal would do, and when you will delete it.
• Check AI vendors on storage and training use, and ask about zero data retention.
• Use on-device AI for the most sensitive inputs when quality, battery and download size allow.