Advancement · School Operations

Before an app
meets a nine-year-old.

The Children’s Online Privacy Protection Act limits what online services may collect from children under 13, and schools approve many of those services on parents’ behalf. Add each product with what it collects, the ads it shows, who it shares with and the consent basis. The checklist counts concerns and flags what the school cannot authorize.

Review a productWhat you get
$5one-time · every device you sign in on
Buy · $5

Included with Caveat Classroom and Whole-school licenses. Or get it in the School operations toolkit, $49 for 32 items.

Your products

The worked example is made up and names no real company: a reading app under a signed agreement, a free quiz game with behavioral ads and a voice tool that collects voiceprints. Saved on this device only.

Loading the product form. If nothing appears, turn on JavaScript.

What you get

Advancement · School Operations$5 · included with Classroom and Whole-school licenses

What you finish with
A record per product: name, vendor, under-13 use, personal information collected, ads, third-party sharing, consent basis, date the policy was read and eight review checks. Counts concerns per product and lists products by concerns; flags behavioral ads to children, school consent stretched beyond school use, sharing for ads, unclear sharing, biometric data, no retention policy and reviews over a year old.
Who it is for
Technology directors, principals, data privacy officers and teachers choosing apps for students under 13.
Format
Browser checklist with a saved record per product. Prints one review, every product in a table or a blank sheet; downloads a spreadsheet (.csv); exports and imports a file.
Access
$5 one-time, yours on every device you sign in on; the tool opens once you are signed in with it. Included with Caveat Classroom and Whole-school licenses. Also in the School operations toolkit ($49) and the Advancement Suite pass ($99), and 1 more bundle. Everything you type stays in this browser; nothing is sent to Caveat.
Where it lives
The School Operations space in Caveat Advancement.
Support
Questions about access, an order or a correction: team@caveatacademic.com.

How to use it

  1. List every app and site students use, including free ones.
  2. Read the privacy policy and terms; note what is collected.
  3. Record ads, sharing and the consent basis.
  4. Ask the vendor in writing about anything unclear.
  5. Stop using anything the flags mark until it is resolved.

Review a product

Consent

Who can consent, for whatThe schoolCan authorize collectionin place of parents.Only for the school’seducational purpose,with no commercial use.ParentsMust consent foranything beyond schooluse.Separately for sharingwith third parties, suchas for ads.NobodyCan make behavioral adsto under-13s acceptablein a school tool.Choose another product.Who can consent, for whatThe schoolCan authorize collection in place ofparents.Only for the school’s educational purpose,with no commercial use.ParentsMust consent for anything beyond school use.Separately for sharing with third parties,such as for ads.NobodyCan make behavioral ads to under-13sacceptable in a school tool.Choose another product.
Summarized from the FTC’s COPPA guidance for schools; FERPA and state student privacy laws add their own rules.

The amended rule

The FTC’s amendments to the COPPA Rule, published in April 2025 with compliance required by April 22, 2026, add separate parental consent for disclosing children’s data to third parties such as advertisers, written data retention and information security programs, and biometric identifiers to the definition of personal information.

Other laws too

COPPA governs the vendor. The school’s own duties come from FERPA and the Protection of Pupil Rights Amendment, and many states have student data privacy laws and model agreements. A signed data privacy agreement is the usual way to hold a vendor to all of them.

Sources

  1. Children’s Online Privacy Protection Act, 15 U.S.C. 6501 to 6506, and the COPPA Rule, 16 CFR part 312, as amended by the final rule published in the Federal Register on April 22, 2025.
  2. Federal Trade Commission. Complying with COPPA: Frequently Asked Questions, section on COPPA and schools (ftc.gov).
  3. U.S. Department of Education, Student Privacy Policy Office. Protecting Student Privacy While Using Online Educational Services (studentprivacy.ed.gov).
  4. Student Data Privacy Consortium. National data privacy agreement (privacy.a4l.org).

The worked examples are made up. This checklist supports a review; it is not legal advice, and state student privacy laws may add requirements. Nothing you type is sent to Caveat. Support: team@caveatacademic.com.