New COPPA Case: What a Recent FTC Amicus Brief Does–and Does Not–Change for Schools
September 3, 2025
Jessica Arciniega, Morgan Sexton, and Amelia Vance
CC BY-NC 4.0
Introduction
On August 13, the FTC filed an amicus brief in a lawsuit against edtech vendor IXL Learning (Shanahan v. IXL Learning Inc., 3:24-cv-02724, (N.D. Cal.)). Since then, there has been speculation that the Commission’s interpretations of the Children’s Online Privacy Protection Act (COPPA), as outlined in the brief, somehow change existing COPPA obligations regarding schools and edtech vendors. This blog outlines exactly what this case is about, the FTC’s role in it, and why the FTC’s statements do not change any current FTC interpretations allowing schools to provide COPPA consent to edtech uses for educational purposes.
COPPA Overview:
The Children’s Online Privacy Protection Act (COPPA) is a federal law that requires commercial operators to obtain parental consent prior to collecting personal information from children under 13.
The Status Quo: Schools Can Consent to Technology Uses for Educational Purposes
The FTC’s Statement of Basis and Purpose to the 1999 COPPA Rule says that the COPPA Rule “does not preclude schools from acting as intermediaries between operators and parents in the notice and consent process, or from serving as the parent's agent in the process.” The FTC’s COPPA FAQs goes one step further, permitting schools to consent to data collection and use on behalf of parents in educational contexts if the technology services are solely for the use and benefit of the school and for no other commercial purpose. The FAQs explicitly detail when operators are permitted to rely on authorization from a school–rather than needing to obtain consent from every parent directly–to collect students’ personal information:
The school consent exception aligns with COPPA’s underlying goal to preserve the status quo between schools and families. As explained in an FTC Business Blog post from 2015:
“Many parents care deeply about their children’s privacy, and rightly expect their schools to protect it. But COPPA was not intended to displace the traditional relationship between parents and schools when it comes to the collection of information exclusively for educational purposes in the school context and with the school’s permission. That holds true even when that information is collected online.”
This longstanding approach has become fundamental to the basic administrative and educational functions of school districts. Although the FTC’s COPPA FAQ guidance helped form the basis of an FTC enforcement action against an edtech vendor (see this post for more details), the Commission has not yet codified it into federal statute or regulations.
In the most recent COPPA rulemaking process, the FTC explained that their decision not to codify the school authorization exception was “To avoid making amendments to the COPPA Rule that may conflict with potential amendments to DOE’s FERPA regulations.” Instead, the FTC reiterated that the existing approach permitting school authorization remains intact, saying that “The Commission will continue to enforce COPPA in the ed tech context consistent with its existing guidance” and including a footnote linking to the FAQs.
That being said, the footnote also said that “The Commission will monitor and weigh future developments with respect to DOE's potential FERPA regulation amendments in deciding whether to pursue COPPA Rule amendments related to ed tech.” If the Department of Education (USED) releases an updated FERPA rule (which has been rumored to be in the pipeline for several years now) the FTC will likely circle back and reevaluate the current approach to ensure consistency. This, combined with statements from Chair Ferguson–more on those later–signals the FTC’s increasing willingness to possibly change current school technology consent processes.
Why is school authorization critical to schools’ efforts to integrate edtech into classrooms?
Effectively incorporating edtech platforms that have been thoroughly vetted for privacy and security safeguards can be a powerful way for schools to promote greater learning and success for all students. Requiring parental consent before adopting such technologies would pose a significant barrier to schools' ability to provide all students with technology-enhanced educational experiences. It can be extremely challenging for schools to obtain 100% parental consent in practice (see this blog for more information why). COPPA’s school authorization exception avoids putting teachers in the difficult position of having to choose between creating and implementing multiple lesson plans for the same classroom or not using edtech at all.
Case Background
The Ed Tech Law Center filed a complaint on behalf of Kansas public school parents alleging that an edtech provider, IXL Learning (IXL), collected and monetized the data of millions of children without parental consent. The complaint alleged that IXL “sells predictions concerning a wide range of a child’s attributes and behaviors” (p. 15), uses collected student data for “the purpose of marketing to them and gaining marketing insights directly from them” (p. 20), and grants itself “unlimited use of student-created content for its own profit” (p. 22) But note that the complaint did not allege violations of COPPA (which makes sense, because COPPA does not include a private right of action and can only be enforced by the FTC or state attorneys general).
So how did COPPA come up? IXL responded, arguing that COPPA creates an “agency relationship” binding parents to terms that their child’s school agrees to in a contract with IXL–including a mandatory arbitration clause. IXL referenced multiple prior FTC interpretations to support their claim that COPPA creates this agency relationship between schools and parents. Under this theory of agency, IXL sought to force parents to arbitrate their claims rather than proceed in the court system.
IXL’s alleged wrongdoings took a backseat in the litigation as the new question quickly became: Are parents bound by a vendor’s arbitration clause when a school consents to the vendor’s terms under COPPA?
The FTC filed an amicus brief (amicus brief 1), explaining that nothing in COPPA or FTC guidance creates a broad agency relationship between parents and their school districts. While schools may consent on behalf of parents for educational data uses, schools cannot bind parents to a vendor’s extraneous terms. The district court agreed with the FTC’s position, denying IXL’s motion to compel arbitration because “neither the Children’s Online Privacy Protection Act (‘COPPA’) nor common-law agency principles support IXL’s contention that school districts act as agents of parents when contracting with educational vendors.” This approach aligns with the broader relationship between parents and K-12 schools–even though schools are trusted to supervise students during the school day, schools cannot take students off-campus for a field trip without first obtaining parental consent.
This resembles USED’s FERPA implementation:
In Letter to Agora, USED specified that schools cannot require parents and students to waive their FERPA protections as a prerequisite to attending public school. Rather, schools must get voluntary parental consent to share student data with third parties that otherwise do not comply with FERPA’s exceptions. The FTC followed this approach before in its enforcement action against Edmodo, emphasizing that schools may only consent to educational data uses and do not have the authority to consent to commercial data uses like contextual ads. In the current case, the FTC is again echoing USED’s approach, stating that schools cannot bind parents to extraneous terms beyond those specified in COPPA.
IXL appealed the district court’s decision, and the FTC once again filed an amicus brief (amicus brief 2) reiterating that schools cannot bind parents to an edtech vendor’s arbitration clause under COPPA’s school authorization. However, the FTC’s second brief included additional language that has sparked speculation from some about potential new COPPA interpretations.
What do the Amicus Briefs actually say?
Before we dive into what effects the FTC’s amicus briefs could have on school operations and whether the speculation is correct, it's important to look at what the FTC actually said as well as some of the surrounding context.
Amicus Brief 1
The Commission’s first Amicus Brief responded to IXL’s assertions that FTC interpretations of COPPA and guidance establish that COPPA creates an agency relationship between parents and schools when schools provide consent for vendors to collect and use student information for educational purposes. Specifically, the Commission went through each of IXL’s cited references (all authored by the FTC) to demonstrate that the interpretation was wrong and that none of the guidance documents establish the agency relationship that would subject parents to the arbitration clauses. Notably, the amicus brief claimed that the Commission’s guidance at issue was “limited to addressing circumstances under which schools are acting as an agent for purposes of complying with COPPA’s notice and consent requirements.”
Then Commissioner Ferguson filed a concurrence to the amicus brief, agreeing that “IXL’s argument does not pass the smell test” and that COPPA does not allow schools to bind parents to arbitration agreements. However, he took issue with the brief’s suggestion “that schools can act as agents of their students’ parents ‘for purposes of complying with COPPA’s notice and consent requirements’.” In discussing the Commission's notice of proposed rulemaking proposing codifying the school authorization exception, Ferguson asserted that he saw:
“nothing in COPPA’s text that limits parents’ statutory right to notice and consent when their children are online at school, nor anything suggesting the creation of a federal-law agency relationship between parents and anyone else.”
Ferguson agreed that COPPA does not create an agency relationship that could bind parents to an arbitration clause, but then he went a step farther to say that COPPA does not create any agency relationship between parents and schools–potentially opening the door for future revisions to the current school authorization model.
Amicus Brief 2
Fast forward to today, Commissioner Ferguson is now Chair Ferguson - the head of the FTC. In their second Amicus Brief, the Commission largely repeated the same position as the first brief: nothing in COPPA’s history or FTC guidance establishes an agency relationship where schools could bind parents to an arbitration agreement. However, this time the FTC added language aligning closer to Ferguson’s initial concurrence, suggesting more strongly that COPPA does not create any agency relationship between parents and schools. That being said, the brief ultimately concedes that:
“even if COPPA and its implementing regulations were misconstrued to create such an agency relationship, the scope of that agency should be strictly limited to the contractual terms concerning COPPA’s notice-and consent process, and should not be extended to extraneous provisions such as an arbitration clause.”
What does this mean for schools?
While the FTC’s amicus briefs bring up some complicated questions about the existence and scope of parent-school agency relationships, they make one thing clear–nothing in COPPA allows a vendor to bind parents to an arbitration clause that was agreed to by schools. Nothing in either brief changes the FTC’s current guidance around school consent and schools may continue to rely on the FTC’s FAQ’s stating that schools may consent on behalf of parents in educational contexts if the technology services are solely for the use and benefit of the school and for no other commercial purpose. We will have to wait and see whether the FTC makes any official changes to COPPA’s school consent process.