|
As of April 2026, COPPA 2.0 has passed the Senate but has yet to clear the House.
The Good
COPPA 2.0 expands privacy protections from children under 13 to teens ages 13–16, and adds a meaningful new right for parents and teens to correct or delete personal information collected by websites, apps, and online services. For school districts, this is significant. For years, EdTech vendors have operated in a gray zone when it came to teen data. COPPA technically didn't cover children past age 13, leaving districts to rely on contracts and state laws to fill the gap. COPPA 2.0 closes that gap at the federal level.
The bill also looks to formally codify the long-standing "school consent exception," meaning companies working under agreements with educational institutions may be exempt from needing direct parental consent for student data collection — a provision that streamlines how districts manage EdTech deployments. The outright ban on targeted advertising to kids and teens is also a win for districts that have long pushed back on vendors monetizing student attention inside classroom tools.
The Bad
COPPA 2.0 changes the rules around when a company is considered to "know" it's dealing with a child. This makes it easier to hold companies accountable, but without clearly explaining what the new standard actually means in practice. Until the FTC issues clearer guidelines, school districts that work with many outside vendors won't know exactly what they're supposed to do to comply. That leaves them in an uncertain middle ground.
There's also a bit of an irony in the consent rules: requiring stronger proof that a parent actually gave permission might force schools and companies to collect more sensitive personal information just to verify that consent is real, the opposite of what the law is trying to achieve. Families who may not speak English fluently, may lack stable housing, or aren't comfortable with technology will have the hardest time navigating that process.
The "We're Not Sure Yet"
COPPA 2.0 gives teens ages 13–16 the responsibility to exercise their own privacy rights independently, without parental involvement. That's a notable philosophical shift. Whether a 13-year-old is genuinely equipped to navigate data consent decisions is, at best, an open question. Districts will likely find themselves in the middle — fielding questions from parents who didn't realize their teen had opted in to something, or from students who don't realize they had a choice at all.
The bill also sets COPPA 2.0 as a floor for state protections, not a ceiling. States can still pass stricter laws on top of the federal baseline. For districts operating near state lines, or for vendors serving multiple states, this means the compliance landscape could remain a patchwork with some states layering on additional requirements around biometric data, geolocation, or retention timelines that go beyond what COPPA 2.0 requires. Districts would be wise to keep monitoring state-level developments rather than assuming federal passage means the rules are settled.
The bottom line: COPPA 2.0 is a meaningful step forward for student privacy, but it hands districts both new leverage and new uncertainty.
| 
