The FTC's amended COPPA Rule, published April 22, 2025, required compliance with most provisions by April 22, 2026. Sharing children's data with third parties, including for targeted advertising, now needs separate parental consent; data may be kept only as long as reasonably necessary; and biometric identifiers count as personal information. What changed and what to check in your app.
COPPA applies to online services directed to children under 13, and to general-audience services that knowingly collect personal information from them. The FTC finalized amendments in January 2025; they were published on April 22, 2025, took effect 60 days later, and most provisions required compliance within a year of publication.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
List every SDK and what it sends. Advertising, attribution and many analytics SDKs are third-party disclosures.
Remove advertising SDKs from child-directed experiences unless you obtain separate consent and have a reason to keep them.
Move product analytics to a first-party collector with events that carry no personal details.
Write the retention schedule, publish it as the rule requires, and implement deletion that actually runs.
Document the security program, and check that voice, photo or video features do not collect biometric data you did not intend to.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
Student Data Privacy for Ed Tech: FERPA, State Laws and the Data Privacy Agreement
Schools share student records with ed tech vendors under FERPA's school official exception, which puts the vendor under the school's direct control for that data. State laws such as California's SOPIPA and New York's Education Law 2-d add bans on targeted advertising and security requirements. What vendors sign, what they must build, and how to answer district security reviews.
Read
Ad-Hoc Questions on DynamoDB vs Postgres: 16 Analytics Queries at 100,000, 1 Million and 5 Million Orders
Every question across customers is a full table scan in DynamoDB: 217,000 read units at 5 million orders, whether it returns 10 rows or all of them. Postgres answered the same 16 questions in 0.08 to 2.7 seconds without a single index added for them, and an index built in 2.7 seconds took one from 148 ms to 44 ms. Measured in AWS.
Read
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.