COPPA: The Rule in One Guide

A practical way to approach coppa: the rule in one guide is to ask what a student would expect if they saw the disclosing described in plain language. Where the disclosing matches that expectation and the authority supports it, it can proceed with a log entry; where it surprises, it needs consent, an identified exemption or a fresh determination, not a quiet assumption.

Single sign-on reduces password risk but concentrates identity risk, and the safeguards around the identity provider deserve matching attention.

A contract with a vendor can authorise processing on the university's behalf, but it cannot authorise uses the university itself could not authorise.

Opt-out processes that are hard to find or hard to use shall be treated, fairly, as if they did not exist.

Fees and formats for file inspection must not become barriers, or the right of access becomes theoretical.

Students who are also employees have files in both capacities, and the capacity in which a file was created matters to its treatment.

Parent and guardian access through a portal is a sharing determination, and the portal's permissions should reflect rights transfer, not family habit.

Grades, transcripts, enrolment facts and disciplinary outcomes are the clearest education files, but the category reaches well beyond them.

Mobile apps for student services may collect location, contacts or device information beyond the service itself, and that collection needs its own review.

Event and attendance systems hold location information regarding students, and that information can reveal patterns that deserve protection.

A note kept only for its author's personal use, never disclosed, sits outside the category, and the moment it is disclosed that protection may fall away.

Verify consent for specificity, freedom and revocability, and do not rely on a blanket consent that was never explained.

Log access to sensitive files, and review those logs, because unchecked logs safeguard nobody.

Complete both the COPPA and the FERPA analysis for AI tutors used by younger students before any pilot begins.

Safeguard alumni files with the same care as current files, since graduation does not end the college's duty.

Contain subprocessors in vendor contracts by name or by category with notification of changes, since an unnamed chain is an uncontrolled chain.

Answer complaints about access in writing, with reasons, because an unexplained refusal cannot be challenged or learned from.

Audit vendor compliance, and do not accept a vendor's self-assessment as a substitute for evidence where the information is sensitive.

Review a decision after it is made: was the data used for the specified purpose, does the recipient still need it, has storage expired?

Consider a network team that retains connection logs and is asked for them during a disciplinary procedure, and that verifies the disclosure rules before releasing any log.

Consider a vendor audit that finds a subprocessor nobody had recorded, holding a copy of student records for a retired integration.

Consider a health centre that shares treatment records with a general student platform by accident, and that treats the accident as an event, not as a clerical slip.

Consider a small university without a dedicated privacy officer that shares the role with a neighbouring university via a formal arrangement.

In the badly done illustration, sensitive comments were included in the export, no deletion date was agreed, and the student notification still described the old platform.

A second common error is relying on a permission that was never particular, never explained, or obtained after the disclosure it was meant to authorise.

Assuming cloud hosting moves responsibility is a mistake, because the institution remains answerable for a record another company stores.

A third is confusing security with privacy: a well-encrypted system can still disclose a record to a recipient who had no right to it.

Distributing a personal survey without settling anonymity and retention first is an error that cannot be repaired by a later apology.

Treating a course evaluation as anonymous without checking whether it is maintained regarding identifiable students is a mistake.