The Children’s Online Privacy Protection Act (COPPA) regulates how data websites and online services may collect data from children under 13 years old. Regulations include: verifiable consent must be obtained from the parents before gathering any information on young users; they must have a clear, understandable privacy policy that goes over how and why data is collected, and; any collected data must be kept secure and confidential. Schools are able to provide the required consent for students' use of educational websites that comply with COPPA.

The 2025 update to COPPA clarified the obligations of websites and other services that collect kids' data. Some of the updated provisions include enhanced retention requirements, increased transparency, and stronger limits on data sharing.

US Federal Trade Commission's page on COPPA 

2025 COPPA update 

The Children’s Internet Protection Act (CIPA) mandates that schools and libraries that receive E-Rate discounts must implement specific protections on technology that accesses the internet. This includes web filters and to block and/or restrict access to content that would be deemed harmful and inappropriate for children, as well as monitoring of online activity. The policies that dictate how these filters and monitoring systems work must be publicly available.

The 2012 (passed 2008, enforced 2012) update to CIPA mandated that the FTC "provide a nationwide program that promotes children’s safe use of the internet." Practically, this translates to requiring schools to design and implement programs to meet this goal. 

US Federal Communication Commission's page on CIPA 

2012 CIPA update 

The Family Educational Rights and Privacy Act (FERPA) protects the privacy of your educational records. It rules that parents have access to their child's education records before they turn 18, and once the student turns 18 the access right transfers to them as an 'eligible student'.

US Education Department's page on FERPA 

The Health Insurance Portability and Accountability Act (HIPAA) protects your right to your health information and sets regulations and limits on who can view and receive your protected health information. Generally, this is your immediate care team (doctor, pharmacy, insurance provider), and only for your care needs.

US Health and Human Services' page on HIPAA