EdTech and Child Data Privacy: A Parent's Guide 2026

TL:DR: Child data privacy in edtech changed substantially in the last eighteen months, and of the four regimes covered here India's goes furthest on paper. Section 9 of the DPDP Act 2023 requires verifiable parental consent before any processing of a child's data and bans tracking, behavioural monitoring and targeted advertising at anyone under eighteen outright. The catch is timing: the Rules that make it operable were published in November 2025, and the children's provisions take effect eighteen months later, in May 2027. Until then the protection that actually works is design, because an app that stores nothing on a server, like Hooty, or processes a child's voice on the device, like Google Read Along, has nothing to lose in a breach. The trade-off is that most school edtech is bought by the school rather than the parent, so the consent box you are shown is often not the consent the law requires.

A parent opening a school app in 2026 is usually asked for a phone number, a child's date of birth and a school name before seeing a single lesson. That request feels routine, and it is where the law, the vendor's business model and the child's interest stop pointing the same way.

This guide sets out what the rules require in India, the United States, the European Union and the UK, what each regime bans rather than merely regulates, and the checks a parent can run in ten minutes.

What child data privacy in edtech actually means in 2026

Child data privacy in edtech comes down to four questions: who counts as a child, what consent is required, what processing is banned outright, and who enforces it. The answers differ by country.

The first sets the rest. India counts anyone under eighteen as a child, per section 2(f) of the Digital Personal Data Protection Act, 2023. The United States sets the line at thirteen for COPPA, and the GDPR at sixteen by default, with member states allowed to lower it to thirteen. A Class 9 student in Delhi is a child under Indian law and an adult under COPPA.

The second is where school software fails. Parental consent is not a checkbox a teacher ticks for the school, nor the terms accepted by whichever adult owns the phone.

India: what section 9 of the DPDP Act requires

Section 9 is short and specific. A Data Fiduciary must obtain verifiable parental consent before processing a child's personal data, must not process data in a way likely to harm the child's well-being, and must not carry out tracking or behavioural monitoring of children or targeted advertising directed at them, per the Act as published in the Gazette.

That third limb is worth pausing on, because it is not a consent requirement but a prohibition. An edtech product cannot ask a parent to agree to behavioural profiling of a child and then do it, because section 9(3) removes the option. Advertising aimed at children is out entirely, whatever the consent screen says.

The penalties match. Violations of the obligations relating to children can attract up to ₹200 crore, the same ceiling as failing to notify a breach, below the ₹250 crore maximum for failing to maintain reasonable security safeguards, per the government's explainer on the Rules. The Act received assent on 11 August 2023.

The DPDP Rules 2025 and the May 2027 deadline

The Act was a framework without machinery, which arrived in November 2025. The Digital Personal Data Protection Rules were published in the Gazette then, after a consultation that drew 6,915 inputs, per the same PIB explainer of 17 November 2025.

The sentence that matters is rule 1(4). Rules 3 and 5 to 16, which include the children's provisions, "shall come into force eighteen months after the date of publication", per the Rules as published. Eighteen months from November 2025 lands in May 2027. Until then the consent mechanics do not bind, because rules 5 to 16 are not yet in force.

Rule 10 sets out that verification. The Data Fiduciary must take technical and organisational measures to ensure verifiable parental consent, and check that the person claiming to be the parent is an identifiable adult, using identity and age details it holds, details provided voluntarily, or a virtual token from an authorised entity such as a Digital Locker provider, per rule 10.

One carve-out vendors cite is narrower than it sounds. Rule 12 lifts the consent and anti-tracking duties for the classes in Part A of the Fourth Schedule. Item 3 covers "a Data Fiduciary who is an educational institution", but only where "processing is restricted to tracking and behavioural monitoring" for the institution's educational activities or the safety of children enrolled with it. It is written for the school as Data Fiduciary, not an app vendor hired by it.

The United States: COPPA after the 2025 amendments

COPPA covers services directed to children under thirteen and requires verifiable parental consent before an operator collects, uses or discloses their personal information. The Rule was amended in 2025 for the first time since 2013, effective 23 June 2025, with regulated entities given until 22 April 2026 to comply, per the Federal Register notice.

Those amendments widened personal information to include government-issued identifiers and biometric identifiers used for automated recognition. That matters for edtech: a test app using face verification to stop impersonation now handles biometric identifiers the rule names explicitly.

The notable omission is edtech itself. The FTC had proposed definitions of "school" and "school-authorized education purpose", plus a codified school-authorization exception to parental consent. It declined to finalise them, citing the Department of Education's plan to amend FERPA regulations, and said it will keep enforcing COPPA in edtech under existing guidance, per the same notice. A school therefore cannot consent on your behalf as a matter of settled federal rule in the way vendors sometimes imply.

Europe and the UK: consent, then design

The GDPR handles children through Article 8, and its approach is consent-based rather than prohibitive. Where a service is offered directly to a child and relies on consent, the child must be at least sixteen, or consent must come from the holder of parental responsibility; member states may lower the age to thirteen but no further, and the controller must make reasonable efforts to verify it, per Article 8 of the GDPR.

The UK went further with the Age Appropriate Design Code, a statutory code for services likely to be accessed by children. It sets fifteen flexible standards built on one duty: the child's best interests as a primary design consideration. Settings must be high privacy by default, only the minimum data should be collected, children's data should not usually be shared, geolocation should be off by default, and nudge techniques must not push children into giving up more data, per the ICO's code.

The design duty is the useful part for a parent. Consent asks you to judge a data flow you cannot see; a high-privacy default makes the safe option the one that happens when nobody decides anything.

What the Ministry of Education told parents

India's advisory is practical rather than legal, and predates the DPDP Act. The Ministry of Education's 2021 advisory, hosted by CBSE, warned that some companies were luring parents with free services while getting auto-debit mandates activated, targeting vulnerable families, and told parents to read the terms because "your IP address and/or personal data may be tracked", per the CBSE-hosted advisory.

The rest reads like a checklist that has aged well: avoid auto-debit, avoid registering cards in apps, avoid adding emails, contact numbers and addresses, verify that content matches the syllabus, and activate parental controls. It also points parents to the PRAGYATA guidelines before using any edtech platform.

The ten-minute check before you install anything

The legal position is messy and slow-moving. The practical position is not, and five questions cover most of it.

1. Open the app without creating an account. If it refuses to show a lesson until you give a phone number, that is a design choice, and it tells you what the product is for.
2. Look for a privacy notice written for parents, not schools. If the only notice is an agreement addressed to an institution, the vendor has not decided who its user is.
3. Check whether the app works with the network off. An app that needs a live connection for every lesson is streaming and logging; one that works offline can keep the record locally.
4. Look for the word "personalised" in the settings. Behavioural profiling and targeted advertising at children are prohibited in India after May 2027, so a personalisation toggle that depends on either is a warning.
5. Ask what happens after you stop paying. If progress cannot be exported, the data is a bargaining chip rather than a record, a pattern in this breakdown of free SaaS costs.

What low-data design looks like in practice

Two free tools show what design-first looks like.

Hooty runs in a browser with no account, and its grown-ups screen states that "All data stays on this device. Nothing is sent anywhere," with export and import buttons for moving progress by file, per Hooty's own app. It covers classes 1 to 10 from the NCERT textbooks across 26 course packs and 315 chapters, a product that exists because it collects nothing worth selling.

Google Read Along processes a child's voice mainly on the device, does not store voice data after processing, and works without signing in or giving a location or contact number, per Read Along's FAQ. It also runs offline on low-cost Android phones, which matters when the family phone is shared.

Turning this into a household rule

Three rules cover most of what a parent controls, worth writing down once.

First, no account for a child unless the school requires one, and when it does, use a parent's email and a date of birth you are willing to have stored. The reasoning is in this guide to data ownership for small teams: every account is a dataset, and the cheapest way to protect a dataset is not to create it.

Second, keep learning apps in one place on the device, separate from the browser and chat apps, the separation principle in this comparison of self-hosted tools for privacy-conscious founders.

Third, treat procurement as something you may ask about: which provider holds the data, whether the contract names the school or the vendor as Data Fiduciary, and whether the app works without an account. Schools are not used to the question, which is why it is worth asking.

If you run the school rather than the household, a self-hosted tool keeps the student record inside the institution, and this argument for open source over SaaS sets out why that matters for data belonging to minors. The BareStack comparison page shows what changes on your own server, the BareStack FAQ covers backups, and what BareStack builds is where a school or NGO starts.

Bottom line

The strongest protection available to an Indian parent in 2026 is an app that never collects the data, because section 9's ban on tracking and targeted advertising at children is stricter than anything in COPPA or Article 8 and it survives whatever a consent screen says. The DPDP Rules that make it verifiable arrive in May 2027, COPPA stops at thirteen, and the UK's design code is where the others are heading. Until enforcement catches up, choose tools that work without an account and ask the school which provider holds your child's record.

FAQ

At what age does data privacy law protect a child in India?

Under eighteen. Section 2(f) of the DPDP Act 2023 defines a child as an individual who has not completed eighteen years, older than the COPPA threshold of thirteen. A Class 9 student is therefore a child for Indian purposes, with verifiable parental consent required and a ban on targeted advertising.

When do the DPDP children's rules actually start applying?

The Rules were published in November 2025 and rule 1(4) brings rules 3 and 5 to 16 into force eighteen months later, so the children's provisions apply from May 2027. Until then the consent mechanics in rule 10 do not bind, because rules 5 to 16 are not yet in force. Companies that wait will have to rebuild consent flows for every user under eighteen.

Can a school consent to data processing on a parent's behalf?

Not as a general rule in India. Section 9 requires verifiable consent from the parent, and the Fourth Schedule exemption covers only an educational institution tracking and monitoring for its own activities or for enrolled children's safety. In the US, the FTC proposed but did not finalise a school-authorization exception.

What is banned outright rather than merely regulated?

Targeted advertising directed at children, and tracking or behavioural monitoring of children, under section 9(3) of the DPDP Act. That is stronger than a consent requirement, because a parent cannot waive it. COPPA and the GDPR work through consent, and the UK code through design duties.

What should a parent check before installing a school app?

Whether it shows a lesson without an account, whether the privacy notice is written for parents, whether it works offline, and whether progress can be exported. The Ministry of Education's advisory adds auto-debit, card registration and unnecessary personal details.

Is locally stored data safer for a child?

It removes the breach risk rather than managing it. Data in a browser on the family device cannot leak from a vendor's server. The trade-off is that backups become the parent's job, so export the progress file and keep it somewhere you control.

---

Photo by Dan Nelson on Unsplash

Photo by sofatutor on Unsplash