The April 22 Deadline
Updated for 2026
The FTC updated COPPA. The new rule takes effect on April 22, 2026. This is the first major change since 2013. EdTech platforms serving children under 13 must act now. Weeks remain, not months.
The changes are deep. Platforms built on the 2013 rules must audit and update core systems. Small fixes will not be enough.
Reddit's Fine: A Clear Warning
In March 2026, the UK's ICO fined Reddit £14.47 million. Why? Reddit failed to keep children away from harmful content. Age checks were weak. Minors got through.
That fine was under UK GDPR, not COPPA. But the failure is the same kind. COPPA 2026 targets platforms that know minors are present but do not protect them.
EdTech is in a harder spot. These platforms know who their users are. They sell to schools. They market to parents. They see student email addresses. The "we didn't know" defense is not available.
What COPPA 2026 Changed
The FTC update added five key rules for EdTech platforms.
1. Minimization Is Now Required
Collect only what the service truly needs. The 2013 rule let platforms collect a lot with parental consent. The 2026 rule bans extra collection even with consent. Device IDs, tracking signals, and location info not needed for the service must stop now.
2. No Targeted Ads to Minors
EdTech platforms cannot use children's records for behavioral ads. Consent does not change this. Some platforms used blanket consent to justify broad data use. That loophole is now closed.
3. Separate Consent for AI Features
Any AI feature that uses children's input needs its own consent form. AI tutors, writing tools, and adaptive engines all count. Consent for the main service does not cover AI add-ons.
4. Deletion Rules with Real Teeth
Delete children's records when they are no longer needed. Platforms that run automated deletion on a set schedule face lower liability in FTC actions. This is a real safe harbor — use it.
5. Higher De-identification Bar
Removing a name is not enough. Platforms must show that re-identification is not reasonably possible. For aggregate analytics, this means k-anonymity or differential privacy.
FERPA and COPPA: Both Apply
For K-12 platforms working with schools, FERPA runs alongside COPPA. Here is what matters:
- FERPA lets schools share student records with vendors — but only for contracted services
- COPPA still applies for children under 13, even when FERPA allows the sharing
- School consent under FERPA does not replace COPPA parental consent
FERPA compliance is not COPPA compliance. Both must be met separately.
What to Do Before April 22
Work through this checklist before the deadline.
Inventory
- List all records collected from users under 13
- Find every third-party tool that receives children's records — analytics, CRM, monitoring
- Check consent for each collection type
Anonymization
- Add PII detection to student content before it is logged
- Strip names, email addresses, and student IDs from analytics events
- De-identify aggregate reports used for product work
- Clean AI training sets that include student input
Consent
- Build separate consent flows for each AI feature
- Log consent with timestamps
- Add a withdrawal flow that triggers deletion right away
Retention
- Set a retention period for each record type
- Automate deletion when periods end
- Check backup systems for gaps
Vendors
- Review agreements with all sub-processors
- Confirm that analytics vendors do not use children's records for ads
- Update agreements to match the 2026 de-identification standard
How Anonymization Helps
The new de-identification rule is the most technical part of COPPA 2026. Stripping names alone does not meet the standard. You need a system that finds and removes all PII across every data flow.
anonym.legal detects 285+ entity types across 48 languages. Many EdTech platforms serve students who speak many languages. Student PII appears in Spanish, Mandarin, Arabic, and dozens of others — not just English. Wide language coverage is not a nice-to-have here. It is a compliance need.
The platform also catches edge cases that manual review misses. Phone numbers, student ID patterns, and indirect identifiers are common in student content. Automated detection finds these at scale. Manual review does not.
The batch processing feature lets teams run existing databases through the tool. That covers old student content that now must meet the higher standard. Retroactive de-identification is part of the compliance picture under the 2026 rule.
See our security and compliance overview for how we handle sensitive records. The legal compliance page covers both FERPA and COPPA in detail.
The Cost of Inaction
COPPA fines run up to $51,744 per violation per day. For a platform with 100,000 student accounts, a systemic gap in de-identification could mean tens of millions in fines.
Reddit's fine was £14.47 million. Reddit has billions in revenue. For a mid-sized EdTech platform, that scale of fine would be company-ending.
April 22 is close. The work is doable if it starts now. Regulators have made clear they will enforce the new rule. Waiting is not a strategy.
Start anonymizing student records today →
Sources
- FTC COPPA Rule Update, Federal Register, 2025 (effective April 22, 2026)
- ICO Reddit enforcement notice, March 2026 — £14.47M penalty
- FERPA, 20 U.S.C. § 1232g, and implementing regulations 34 CFR Part 99
- FTC COPPA FAQ: AI-powered features and parental consent, 2026