Earlier this week, the Federal Trade Commission and Department of Education announced plans to hold a joint workshop on the application of the Children’s Online Privacy Protection Act (“COPPA”) and the Family Educational Rights and Privacy Act (“FERPA”) to educational technology products and services in the K-12 school environment.  In advance of the workshop, the FTC and Department of Education are soliciting comments on several key questions regarding COPPA and FERPA compliance for educational technology providers.  This is a valuable opportunity for Ed Tech providers to provide feedback to both agencies on the practical application of COPPA and FERPA in this arena.

The FTC’s announcement cited the increasing use of “Ed Tech” in the K-12 environment, including school-issued personal computing devices and online curriculum, as the impetus for holding the workshop.  The FTC enforces the COPPA Rule, which governs the online collection, use, and disclosure of personally identifiable information from children under the age of 13.  The Department of Education, on the other hand, has enforcement power over FERPA, which governs the use and disclosure of personally identifiable information in students’ education records.

The stated aim of the workshop is to “gather information to help clarify how the FTC and ED can ensure that student privacy is properly protected without interfering with the promise of Ed Tech.” The FTC and the Department of Education have thus indicated a willingness to explore updating prior guidance on COPPA and FERPA to account for the increasing prominence of Ed Tech as well as the compliance experience of schools and providers

The announcement states that the FTC and Department of Education staff are seeking comment on the following questions:

  • Are the joint requirements of FERPA and COPPA sufficiently understood when Ed Tech providers collect personal information from students?  Are providers and schools adhering to the requirements in practice?
  • What practical challenges do stakeholders face in simultaneously complying with both COPPA and FERPA?
  • Under what circumstances is it appropriate for a school to provide COPPA consent, and what process should the Ed Tech provider use to obtain consent?  Who has the authority to provide and revoke consent and how?
  • COPPA and FERPA both limit the use of personal information collected from students by Ed Tech vendors.  What are the appropriate limits on the use of this data?
  • How should requirements concerning notice, deletion, and retention of records be handled and by whom and when?
  • Schools often use the “School Official Exception” to FERPA’s written consent requirement when disclosing personally identifiable information from education records to Ed Tech providers.  In your experience, what are some of the ways in which schools maintain “direct control” over Ed Tech providers under FERPA’s “School Official Exception?”  Should there be alignment between the “School Official Exception” and schools’ ability to provide consent for purposes of COPPA?

The FTC will accept comments in response to these topics through November 17, 2017.  The workshop is scheduled for December 1, 2017, and the FTC and Department of Education will publish an agenda and list of speakers for the workshop at a later date.

Print:
EmailTweetLikeLinkedIn
Photo of Lindsey Tonsager Lindsey Tonsager

Lindsey Tonsager helps national and multinational clients in a broad range of industries anticipate and effectively evaluate legal and reputational risks under federal and state data privacy and communications laws.

In addition to assisting clients engage strategically with the Federal Trade Commission, the…

Lindsey Tonsager helps national and multinational clients in a broad range of industries anticipate and effectively evaluate legal and reputational risks under federal and state data privacy and communications laws.

In addition to assisting clients engage strategically with the Federal Trade Commission, the U.S. Congress, and other federal and state regulators on a proactive basis, she has experience helping clients respond to informal investigations and enforcement actions, including by self-regulatory bodies such as the Digital Advertising Alliance and Children’s Advertising Review Unit.

Ms. Tonsager’s practice focuses on helping clients launch new products and services that implicate the laws governing the use of endorsements and testimonials in advertising and social media, the collection of personal information from children and students online, behavioral advertising, e-mail marketing, artificial intelligence the processing of “big data” in the Internet of Things, spectrum policy, online accessibility, compulsory copyright licensing, telecommunications and new technologies.

Ms. Tonsager also conducts privacy and data security diligence in complex corporate transactions and negotiates agreements with third-party service providers to ensure that robust protections are in place to avoid unauthorized access, use, or disclosure of customer data and other types of confidential information. She regularly assists clients in developing clear privacy disclosures and policies―including website and mobile app disclosures, terms of use, and internal social media and privacy-by-design programs.

Photo of Laura Kim Laura Kim

Laura Kim draws upon her experience in senior positions at the Federal Trade Commission to advise clients across industries on complex advertising, privacy, and data security matters. She provides practical compliance advice and represents clients in FTC and State AG investigations. Ms. Kim…

Laura Kim draws upon her experience in senior positions at the Federal Trade Commission to advise clients across industries on complex advertising, privacy, and data security matters. She provides practical compliance advice and represents clients in FTC and State AG investigations. Ms. Kim advises on a wide range of consumer protection issues, including green claims, influencers, native advertising, claim substantiation, Made in USA claims, children’s privacy, subscription auto-renewal marketing, and other digital advertising matters. In addition, Ms. Kim actively practices before the NAD, including recent successful resolution of matters for both challengers and advertisers. She co-chairs Covington’s Advertising and Consumer Protection Practice Group and participates in the firm’s Internet of Things Initiative.

Ms. Kim re-joined Covington after a twelve-year tenure at the FTC, where she served as Assistant Director in two divisions of the Bureau of Consumer Protection, as well as Chief of Staff in the Bureau of Consumer Protection and Attorney Advisor to former Chairman William E. Kovacic. She worked on key FTC Rules and Guides such as the Green Guides, Jewelry Guides, and the Telemarketing Sales Rule. She supervised these and other rule making proceedings and oversaw dozens of the Commission’s investigations and enforcement actions involving compliance with these rules. Ms. Kim also supervised compliance monitoring for companies under federal court or Commission order.

Ms. Kim also served as Deputy Chief Enforcement Officer at the U.S. Department of Education, where she helped establish a new Enforcement Office within Federal Student Aid. In this role, she managed investigations of higher education institutions and oversaw issuance of fines and adverse actions for institutions in violation of federal student aid regulations. Ms. Kim also supervised the borrower defense to repayment division and the Clery campus safety and security division.

Photo of Caleb Skeath Caleb Skeath

Caleb Skeath advises clients on a broad range of privacy and data security issues, including regulatory inquiries from the Federal Trade Commission, data breach notification obligations, compliance with consumer protection laws, and state and federal laws regarding educational and financial privacy.