FTC Kids’ Privacy Rule Update Leaves EdTech, Students in Limbo

The first updates to the Federal Trade Commission’s children’s privacy rules in more than a decade leave students and educators without stronger tools to protect their privacy.

The final rules unveiled Thursday, dropped an earlier proposal the FTC had floated to rein in educational technology providers.

The proposals would have barred ed tech companies from using kids’ data gained in educational settings for commercial purposes. They also would have also allowed ed tech providers to get consent from schools instead of parents in some circumstances, a proposal praised by educators and ed tech companies and criticized by some parent groups.

The agency said it declined to include those changes to avoid conflict with potential updates to the US Education Department’s Family Educational Rights and Privacy Act rules, which govern student data privacy.

By not finalizing those proposals, the FTC has punted on a responsibility that belongs to it, not the Education Department, said Amelia Vance, president at the Public Interest Privacy Center, which works with groups that represent educators.

“The FTC governs companies. The Department of Education does not,” Vance said.

Instead, the agency said Thursday it would continue to enforce the Children’s Online Privacy Protection Act under existing 2022 guidance that requires ed tech companies to protect student data, and prohibits them from using data collected from students for educational purposes for marketing and other commercial purposes unrelated to services schools requested.

Compliance Question

The deferral in codifying guidance leaves gray areas in which ed tech companies can operate, said Bailey Sanchez, deputy director of the Future of Privacy Forum’s US legislation team. Instead of a generally applicable rule, the FTC will have to rely on case-by-case enforcement actions.

For instance, the commission in 2023 fined defunct education technology platform Edmodo Inc. for collecting kids’ data without parental permission and using it for advertising. It’s unclear if the requirements of the settlement apply to other companies.

“Codifying enforcement actions into rules gives clarity to companies as to what the FTC expects as compliance obligations for everyone,” said Sanchez.

That ambiguity also makes contractual requirements for ed tech companies less clear. The FTC weighed in on the issue in an August filed a brief in support of a class action from a group of parents against an education technology provider.

The agency argued the childrens’ privacy law doesn’t bind parents and children to every part of an education company’s terms of service just because school districts agreed to them. Republican FTC commissioner Andrew Ferguson, who is set to lead the agency during the Trump administration, expressed skepticism in a statement that school consent is appropriate at all.

The Edmodo settlement also provided guidance on the school’s role in providing consent for student-data collection. The updated rules didn’t extend that clarity more broadly.

“There is arguably a lack of clear lines of responsibility between ed tech providers and schools under the current COPPA guidance,” said Cobun Zweifel-Keegan, managing director of the International Association of Privacy Professionals’ Washington, D.C., office. “Regardless of the substance, designating where responsibility lies between software developers and schools helps to create clarity and consistency.”

With the change in administrations, the Education Department is unlikely to release any FERPA updates soon. The department didn’t immediately respond to a request for comment.

Other changes to the FTC rule may still benefit student privacy, said Vance. Broadly applicable provisions requiring data minimization—which was also required of ed tech providers in the original proposed COPPA amendments—and parental consent for third-party use of kids’ data could fill gaps in ed tech privacy rules, she said.

“Schools are in desperate need of support and leverage when it comes to ed tech companies, and it’s really sad that the FTC decided to take away the leverage that would have provided additional privacy protections for all students,” said Vance.