Glossary

DEFINITION

COPPA (Children's Online Privacy Protection Act)

The U.S. federal law requiring verifiable parental consent before online services collect personal information from children under 13.

In depth

The Children's Online Privacy Protection Act (COPPA, 1998; FTC Rule updated 2013, proposed update 2023) applies to operators of websites and online services directed to children under 13, and to general-audience services with actual knowledge that they are collecting personal information from children under 13. COPPA requires: clear privacy notice, verifiable parental consent before collecting personal information, parental access and deletion rights, data minimization (collect only what is necessary for the stated purpose), and reasonable data security. Schools can provide consent on behalf of parents for EdTech used solely for educational purposes and under the school's control — but only when the operator collects data solely for the school's benefit and parents are notified. Most consumer AI tools (ChatGPT, Claude, Gemini) prohibit use by children under 13 in their terms of service and are not COPPA-compliant platforms. They also collect data for product improvement and training, which breaks the school-consent path for under-13 use. AI tools used with children — tutoring AI, educational chatbots, AI-powered learning platforms — must comply with COPPA if they are directed to children or if the operator has actual knowledge of child users.

Examples

  • A teacher using a consumer ChatGPT account to generate personalised quiz questions referencing a specific student's performance data — COPPA violation if the student is under 13.
  • An EdTech platform adding an AI chat feature that interacts directly with students — COPPA-compliant only if the feature collects no unnecessary personal information and parental consent is obtained.
  • A school deploying Google Workspace for Education with Gemini features enabled for elementary students — requires COPPA-compliant school consent, not consumer-tier Gemini.

How Locke handles coppa (children's online privacy protection act)

Locke detects student identifiers and child-relevant personal information — names, ages, school grades, family information — locally before any prompt reaches an AI model. For EdTech operators deploying AI in K-12 contexts, local-first detection helps enforce the data-minimization requirements that are central to COPPA compliance.

See the product

Related terms