COPPA 2.0 Stalled, But FTC’s 2025 Rule Rewrite Hits 2,982 School Apps

For legal counsels advising edtech and digital platforms, the stalled COPPA 2.0 is only half the story. While the House deliberates, the FTC’s 2025 amendments to the COPPA Rule have already moved the compliance goalposts — tightening consent, data retention, and advertising restrictions across the 2,982 tools kids encounter daily.

American students returning to classrooms for the 2026-27 school year are entering a digital environment where children’s online privacy is governed by rules that have evolved significantly—despite the fact that Congress has not yet passed COPPA 2.0. On March 5, 2026, the Senate unanimously approved the Children and Teens’ Online Privacy Protection Act, a sweeping update that would extend the 1998 COPPA’s protections from children under 13 to teenagers up to age 16. The bill, championed by Senator Edward Markey, would ban targeted advertising to minors using their personal information and create a so-called “eraser button” enabling children and parents to request deletion or correction of data. However, as of August 2026, the House of Representatives has not acted on its companion bill, leaving the Senate’s landmark legislation in limbo. Corporate counsels, school administrators, and edtech providers are therefore preparing for the new academic year under a framework that is both old and new: the 1998 statute remains, but the Federal Trade Commission has used its rulemaking authority to modernize COPPA’s requirements, and the growing scale of educational technology has put a spotlight on compliance.

“

Recent high-profile settlements—such as the $6 million penalty paid by edtech platform Edmodo in 2022 for collecting children’s data without consent—have sent a clear signal that the agency will pursue violators aggressively.

Data from LearnPlatform by Instructure underscores the magnitude of the issue. During the 2024-25 school year, U.S. school districts accessed an average of 2,982 distinct educational technology tools—a nearly 9% increase over the prior year. This explosion means that students’ personal information, from names and location data to browsing habits and learning patterns, is collected by a vast array of apps, platforms, and services. The legacy COPPA of 1998, enacted when the internet was a fraction of its current size, requires operators of websites and online services directed to children under 13 to obtain verifiable parental consent before collecting personal information. But it does not cover teenagers, nor does it directly address the sophisticated advertising and data-sharing ecosystems that have emerged since.

Recognizing the strain, the FTC has been assertive in updating its COPPA Rule. In 2025, the agency finalized amendments that, among other things, require separate verifiable parental consent for the disclosure of children’s personal information to third parties, impose strict data retention limits, and expand the definition of personal information to include biometric data and identifiers that can track a child across sites. Compliance deadlines for many of these provisions were set ahead of the 2026-27 school year, meaning that for the thousands of edtech tools used in classrooms, operators now face a more stringent legal environment even without a statutory overhaul. The FTC has also stepped up enforcement. Recent high-profile settlements—such as the $6 million penalty paid by edtech platform Edmodo in 2022 for collecting children’s data without consent—have sent a clear signal that the agency will pursue violators aggressively. These actions, combined with the new rule, have effectively raised the bar for children’s privacy protection in the absence of Congressional action.

While COPPA 2.0 would codify many of these protections for teenagers and introduce a nationwide standard, the current patchwork of state laws adds another layer. California’s Age-Appropriate Design Code, for example, was enjoined in 2023 but inspired similar bills in other states. Some states have enacted their own children’s privacy statutes, creating a compliance maze for operators. For edtech companies, this means navigating a federal baseline that applies only to under-13 users, while filling gaps for older students through state laws or voluntary measures. For schools, the challenge is vetting an ever-growing roster of tools to ensure they comply with both legal requirements and district policies.