When COPPA Stops Applying at 13

A practical way to approach when coppa stops applying at 13 is to ask what a student would expect if they saw the sharing described in plain language. Where the sharing matches that expectation and the authorization supports it, it may proceed with a log entry; where it surprises, it needs consent, an identified exemption or a fresh determination, not a quiet assumption.

Remote work extends the site boundary to employees homes, and the controls must travel with the file to those homes.

Event detection is a confidentiality control, because a breach discovered late harms more students than the same breach discovered early.

Analytics may improve teaching, but analytics built on identifiable student information need the same authorization analysis as any other use.

Group mailboxes and shared drives are where access control most frequently fails, because nobody owns the membership list.

Name, enrolment status and field of study are commonly designated, while grades, disciplinary outcomes and financial facts are not directory information.

Public files requests may reach student data, and staff handling them need to know which files are protected before responding.

Discussion posts in a course system are maintained about identifiable students, and their storage should follow the course file schedule.

A note kept only for its author's personal use, never shared, sits outside the category, and the moment it is shared that safeguarding can fall away.

Language access matters for confidentiality notifications, because a student who can not read a notice can not meaningfully consent or opt out.

Learning management platforms record clicks, views, submissions and time on task, and each of those data points needs a purpose before it is collected.

Retain a privacy committee that may really stop a project, since a committee that only advises shall be ignored when it matters.

Trigger access reviews on role changes automatically where possible, and treat manual review as a fallback, not as the plan.

Include deletion verification in vendor contracts, with a method and a timetable, since a promised deletion without verification will be doubted.

Assess AI tools with the same gate, plus a particular review of training data use, prompt storage and output handling.

Keep inventories current, and treat an inventory that is a year out of date as no inventory at all.

Require incident notification in the vendor contract, with a stated timetable, since a vendor incident discovered late harms more students.

Apply the highest notification and permission standard to sensitive survey topics, because the injury of unwanted disclosure is greatest there.

Audit AI tools for data storage, prompt handling and output storage, since AI systems create files that ordinary audits miss.

In that illustration the request is answered for the employment capacity solely, and the academic file is not disclosed by mistake.

Consider a vendor audit that finds a subprocessor nobody had recorded, holding a copy of student files for a retired integration.

In that illustration the files are removed from the broad system, the affected students are told, and the integration is fixed so it cannot happen again.

Consider a proctoring tool adopted during a rush to online teaching, and reviewed properly only a year later, following thousands of recordings were stored.

Consider a college that merges two campuses and discovers that each campus held the same records under different storage schedules.

Excluding students from privacy oversight is a mistake, because students notice problems that staff have normalised.

Responding to an access request slowly, or in an unusable format, is a mistake, since delay turns a right into a frustration.

Its value is in the structure it teaches: name the file, state the purpose, settle the authorization, limit the sharing, protect the information, and keep the file.

Assuming an integration passes only the data shown on a diagram is an error, since integrations routinely pass more than intended.

Handling a transfer or withdrawal as if it ended a student's rights is an error, since rights over records previously retained do not end when enrollment ends.