American students returning to classrooms this fall are logging into an online environment governed by a children's privacy framework that has changed substantially in the past year, even though Congress has yet to complete its biggest proposed overhaul.
Clym reviewed federal legislation, FTC rulemaking, enforcement actions, and education technology data to examine how children's online privacy protections are changing for the 2026-27 school year.
School districts accessed an average of 2,982 distinct educational technology tools during the 2024-25 school year, nearly 9% more than the previous year, according to LearnPlatform by Instructure. That scale helps explain why privacy rules written for an earlier internet are being reconsidered as students move between classroom platforms, apps, games and other digital services.
Congress has been debating one answer. On March 5, 2026, the Senate unanimously passed the Children and Teens' Online Privacy Protection Act, commonly called COPPA 2.0. Sen. Edward Markey's office described it as the most significant proposed update in more than 25 years to the federal privacy framework for young people. But as the 2026-27 school year approaches, the measure still has not become law.
COPPA currently stops at age 13
The existing Children's Online Privacy Protection Act, enacted in 1998, applies to covered websites and online services that collect personal information from children under 13. COPPA 2.0 would expand federal protections to teenagers ages 13 to 16, creating a broader privacy framework for minors.
Among other provisions, the Senate bill would restrict individually targeted advertising using minors' personal information and create an "eraser button" that would allow children and teens, or their parents, to request correction or deletion of personal information. The Senate bill text also broadens the federal framework beyond the under-13 threshold that has defined COPPA for decades.
The House has not moved at the same pace. Its companion measure, H.R. 6291, was forwarded from an Energy and Commerce subcommittee to the full committee in December 2025, but has not advanced to a House vote. Congressional records show no later committee action on the bill as of July 2026.
The rules for children under 13 have already changed
COPPA 2.0's delay does not mean federal children's privacy regulation has stood still. The Federal Trade Commission finalized major amendments to the COPPA Rule in 2025, with most new requirements taking effect in 2026. The FTC's amended rule expanded the definition of personal information to include biometric identifiers and requires covered operators to obtain separate verifiable parental consent before disclosing children's personal information to third parties for targeted advertising and certain other purposes.
The updated rule also places tighter limits on how long covered companies can retain children's personal information. Those changes apply to the existing COPPA framework for children under 13, rather than extending the law to teenagers in the way COPPA 2.0 would.
Enforcement has continued under current law as well. In December 2025, a federal judge approved an order requiring Disney to pay $10 million to settle FTC allegations that the company allowed personal data to be collected from children viewing child-directed YouTube videos without the parental notice and consent required by the COPPA Rule. The FTC case summary says the settlement also requires Disney to comply with COPPA and establish a program for reviewing whether videos posted to YouTube should be designated as made for kids.
Schools sit at the intersection of multiple privacy rules
The expansion of classroom technology adds another layer because student information can be governed by more than one federal privacy framework.
The Family Educational Rights and Privacy Act, or FERPA, protects the privacy of students' education records at schools and educational agencies covered by the law. The U.S. Department of Education notes that schools may use third-party contractors and online services under certain conditions, including requirements governing the use and maintenance of personally identifiable information from education records. Department of Education guidance specifically addresses software, apps, and web-based tools used as part of school activities.
COPPA, by contrast, focuses on covered online services that collect personal information from children under 13. The two laws can overlap in school settings, but they regulate different relationships and types of data. That can make privacy responsibilities more complicated when schools introduce outside technology providers into classrooms.
The debate is increasingly about teenagers, not just children
The central gap COPPA 2.0 is designed to address is the period after a child turns 13. A 12-year-old and a 14-year-old can use the same social platform, game or educational service, but the federal protections available to them under COPPA are not the same.
That distinction matters more as digital services become embedded in school, entertainment and social life. It also helps explain why lawmakers have repeatedly returned to proposals that would extend privacy protections to teens, limit targeted advertising to minors and give young users more control over information already collected about them.
States have also continued to develop their own youth privacy and online safety rules, creating a patchwork that can give minors different rights depending on where they live. The result is a children's privacy landscape increasingly shaped by federal law, FTC regulation, state legislation and the practices of individual technology companies.
What students are returning to this fall
COPPA 2.0's unanimous Senate passage shows broad agreement that the federal privacy framework written in 1998 does not address every way children and teenagers now interact with digital services. What remains unresolved is whether the House will agree on the same approach and how a new federal law would interact with state rules.
For students heading into the 2026-27 school year, however, children's online privacy is already changing without a new act of Congress. The FTC has tightened the rules for services covered by COPPA, schools are managing thousands of digital tools under overlapping privacy obligations, and teenagers remain at the center of an unfinished federal debate over how far online privacy protections should extend.
This story was produced by Clym and reviewed and distributed by Stacker.
