The April 22 Deadline
Updated for 2026
The FTC updated COPPA. The new rule takes effect on April 22, 2026. This is the first major change since 2013. EdTech platforms serving children under 13 must act now. Weeks remain, not months.
The changes are deep. Platforms built on the 2013 rules must audit and update core systems. Small fixes will not be enough.
Reddit's Fine: A Clear Warning
In March 2026, the UK's ICO fined Reddit £14.47 million. Why? Reddit failed to keep children away from harmful content. Age checks were weak. Minors got through.
That fine was under UK GDPR, not COPPA. But the failure is the same kind. COPPA 2026 targets platforms that know minors are present but do not protect them.
EdTech is in a harder spot. These platforms know who their users are. They sell to schools. They market to parents. They see student email addresses. The "we didn't know" defense is not available.
What COPPA 2026 Changed
The FTC update added five key rules for EdTech platforms.
1. Minimization Is Now Required
Collect only what the service truly needs. The 2013 rule let platforms collect a lot with parental consent. The 2026 rule bans extra collection even with consent. Device IDs, tracking signals, and location info not needed for the service must stop now.
2. No Targeted Ads to Minors
EdTech platforms cannot use children's records for behavioral ads. Consent does not change this. Some platforms used blanket consent to justify broad data use. That loophole is now closed.
3. Separate Consent for AI Features
Any AI feature that uses children's input needs its own consent form. AI tutors, writing tools, and adaptive engines all count. Consent for the main service does not cover AI add-ons.
4. Deletion Rules with Real Teeth
Delete children's records when they are no longer needed. Platforms that run automated deletion on a set schedule face lower liability in FTC actions. This is a real safe harbor — use it.
5. Higher De-identification Bar
Removing a name is not enough. Platforms must show that re-identification is not reasonably possible. For aggregate analytics, this means k-anonymity or differential privacy.
FERPA and COPPA: Both Apply
For K-12 platforms working with schools, FERPA runs alongside COPPA. Here is what matters:
- FERPA lets schools share student records with vendors — but only for contracted services
- COPPA still applies for children under 13, even when FERPA allows the sharing
- School consent under FERPA does not replace COPPA parental consent
FERPA compliance is not COPPA compliance. Both must be met separately.
What to Do Before April 22
Work through this checklist before the deadline.
Inventory
- List all records collected from users under 13
- Find every third-party tool that receives children's records — analytics, CRM, monitoring
- Check consent for each collection type
Anonymization
- Add PII detection to student content before it is logged
- Strip names, email addresses, and student IDs from analytics events
- De-identify aggregate reports used for product work
- Clean AI training sets that include student input
Consent
- Build separate consent flows for each AI feature
- Log consent with timestamps
- Add a withdrawal flow that triggers deletion right away
Retention
- Set a retention period for each record type
- Automate deletion when periods end
- Check backup systems for gaps
Vendors
- Review agreements with all sub-processors
- Confirm that analytics vendors do not use children's records for ads
- Update agreements to match the 2026 de-identification standard
How Anonymization Helps
The new de-identification rule is the most technical part of COPPA 2026. Stripping names alone does not meet the standard. You need a system that finds and removes all PII across every data flow.
anonym.legal detects 267+ entity types across 48 languages. Many EdTech platforms serve students who speak many languages. Student PII appears in Spanish, Mandarin, Arabic, and dozens of others — not just English. Wide language coverage is not a nice-to-have here. It is a compliance need.
The platform also catches edge cases that manual review misses. Phone numbers, student ID patterns, and indirect identifiers are common in student content. Automated detection finds these at scale. Manual review does not.
The batch processing feature lets teams run existing databases through the tool. That covers old student content that now must meet the higher standard. Retroactive de-identification is part of the compliance picture under the 2026 rule.
See our security and compliance overview for how we handle sensitive records. The legal compliance page covers both FERPA and COPPA in detail.
The Cost of Inaction
COPPA fines run up to $51,744 per violation per day. For a platform with 100,000 student accounts, a systemic gap in de-identification could mean tens of millions in fines.
Reddit's fine was £14.47 million. Reddit has billions in revenue. For a mid-sized EdTech platform, that scale of fine would be company-ending.
April 22 is close. The work is doable if it starts now. Regulators have made clear they will enforce the new rule. Waiting is not a strategy.
Start anonymizing student records today →
When This Approach Has Limits
Automated, multilingual de-identification across every student data flow is the right technical answer to COPPA 2026's higher de-identification bar, and that point is sound, but limits remain worth stating plainly.
Age and consent scope are legal determinations, not tool outputs. Whether a user is under 13, whether valid parental consent exists, and whether a given AI feature needs its own consent form are questions COPPA answers, not the detection engine. anonym.legal can strip names and student IDs from content, but it cannot tell you which records fall under the rule or whether your consent flows are adequate. FERPA and COPPA apply separately, and school consent does not replace parental consent. Those scoping calls require legal review; the tool operates only after that boundary is drawn.
The higher de-identification bar is a standard the tool helps meet, not one it certifies. The 2026 rule requires showing that re-identification is not reasonably possible, which for aggregate analytics points to k-anonymity or differential privacy. Removing direct identifiers does not satisfy that on its own. Quasi-identifiers like school plus grade plus birthdate can re-identify a child even after names are gone, leaving output pseudonymized rather than anonymized. Detection accuracy also bounds the result: an unusual name or a student ID in a non-standard format can be missed, and student content spans languages where coverage varies.
Compliance is the outcome a regulator judges, not the act of running the tool. Batch processing old records and stripping analytics events are technical measures that support compliance but do not constitute it. The FTC weighs the whole program: retention automation, deletion on withdrawal, vendor agreements, and documented consent. A confirmed anonymization pass is still one human-supervised step inside that program. Someone has to verify the output, maintain the governance records, and decide whether the result clears the standard before the April deadline.
Sources
- FTC COPPA Rule Update, Federal Register, 2025 (effective April 22, 2026)
- ICO Reddit enforcement notice, March 2026 — £14.47M penalty
- FERPA, 20 U.S.C. § 1232g, and implementing regulations 34 CFR Part 99
- FTC COPPA FAQ: AI-powered features and parental consent, 2026