# COPPA, GDPR and the Children's Code for online academies

> COPPA can cover US under-13s; GDPR digital consent ages vary, and the UK Children's Code covers services likely used by children under 18.

URL: https://halqora.com/blog/coppa-gdpr-childrens-code-online-academies
Last updated: 2026-10-21

Published: 2026-10-21 · By Halqora team

For online tutoring, [COPPA](https://ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions) can cover US under-13s; [EU GDPR Article 8](https://gdpr-info.eu/art-8-gdpr) sets consent ages of 13–16, and [UK GDPR](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/children-and-the-uk-gdpr/what-are-the-rules-about-an-iss-and-consent) uses 13. As of October 2026, the [UK Children's Code](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/childrens-code-guidance-and-resources/age-appropriate-design-a-code-of-practice-for-online-services/services-covered-by-this-code) covers services likely accessed by under-18s; duties depend on your service, data and legal basis.

> **Key facts:** - COPPA generally requires verifiable parental consent before collecting covered children's personal information, according to the [FTC's COPPA guidance](https://ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions).
> - Most provisions of the amended COPPA Rule had a compliance date of 22 April 2026, according to the [published final rule](https://federalregister.gov/documents/full_text/html/2025/04/22/2025-05904.html).
> - EU GDPR Article 8 concerns consent for online services offered directly to children, rather than every use of children's data: see the [text of Article 8](https://gdpr-info.eu/art-8-gdpr).
> - The Children's Code has 15 standards, including data minimization and protective defaults, according to the [ICO's code guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/childrens-code-guidance-and-resources/age-appropriate-design-a-code-of-practice-for-online-services).

> **Definition:** A lawful basis is the legal ground you identify for processing personal information; Article 8 adds requirements when that ground is consent for an online service offered directly to a child.

This is general information, not legal or tax advice; check with an adviser in your country. The rules and source references below are dated 21 October 2026.

## Which law applies to your academy and its students?

Your academy's address does not settle the privacy question. Start with where your students are, their ages, what your online service does and what information you collect. COPPA, GDPR consent rules and the Children's Code have different scope tests. Ask an adviser to map those tests to your academy before deciding that a parent's enrollment form covers every requirement.

Make a data map before choosing consent wording. Follow information from enrollment to the class platform, teacher notes, invoices and outside services. Write down who uses each field and why.

For UK education technology, the [ICO's edtech guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/childrens-code-guidance-and-resources/the-children-s-code-and-education-technologies-edtech) says obligations depend on actual processing roles. Some providers may fall within the Children's Code, including when they use children's information for their own purposes. Review what the supplier does with the data, alongside what the academy instructs the supplier to do.

Connect the privacy map to your [safeguarding policies for online tutoring](https://halqora.com/blog/safeguarding-online-tutoring). Staff should know who may contact a child and who may read the child's information.

## What does COPPA require, and what changed in 2025?

COPPA covers commercial online services directed to children under 13 that collect personal information, plus general-audience services with actual knowledge of collecting information from children under 13. Covered operators generally need verifiable parental consent before collection. For an academy, the practical task is to establish coverage, explain the collection and verify the parent's authorization before the relevant information enters your systems.

The FTC lists consent methods including a signed form, a card transaction that notifies the account holder, a call with trained staff, or government ID verification followed by deletion of the ID. Choose an appropriate method with advice. A parent typing a name into a form does not, by itself, establish that you have completed a suitable verification process.

The amended rule was published on 22 April 2025 and took effect on 23 June 2025. Most provisions had a compliance date of 22 April 2026. As of October 2026, that date has passed. Review current practices against the amended rule instead of treating the changes as future work.

The [FTC's announcement of the amendments](https://ftc.gov/news-events/news/press-releases/2025/01/ftc-finalizes-changes-childrens-privacy-rule-limiting-companies-ability-monetize-kids-data) describes separate parental consent for disclosures such as targeted advertising, limits on retention, and the addition of biometric and government-issued identifiers to personal information. The final rule also requires a written information security program with safeguards suited to the information and operator, and employees assigned to coordinate it.

Assign responsibility for consent, security and deletion decisions. Do not collect identity documents without a clear need.

## When do GDPR Article 8 and UK digital consent ages matter?

GDPR Article 8 matters when you offer an information society service directly to a child and rely on consent for the processing. The EU default age is 16; member states may lower the age, but not below 13. UK GDPR uses 13. Below the applicable age, that consent route requires authorization from the holder of parental responsibility.

The linked Article 8 page reproduces the regulation's text and is an unofficial source. The ICO's UK consent guidance explains the UK position. Check the relevant EU member state's age rather than applying the UK age to families across Europe.

Keep the condition attached to the age. Saying “children can consent at 13” leaves out both the jurisdiction and the type of processing. Reaching a digital consent age does not resolve every question about a child's data, and being below that age does not mean that every activity uses consent as its lawful basis.

Ask your adviser to identify the appropriate basis for each processing purpose. Do not assume a parent's contract justifies every lesson note, disclosure or later use. Explain the choices in language parents and children can understand.

## Who does the Children's Code cover, and what are its standards?

The ICO Children's Code covers information society services likely to be accessed by children, including services that are not aimed at children. For the code, children are people under 18. The code's 15 standards address how services are designed and operated, so checking a consent form alone does not answer whether the service gives children's information suitable protection.

The standards include children's best interests, data protection impact assessments, transparency, default settings, data minimization, parental controls, profiling and nudge techniques. Use those areas as design questions. What does a child see on arrival? What information is visible before a parent changes a setting? Does a prompt encourage a child to disclose more information than the lesson needs?

A data protection impact assessment, or DPIA, is a structured review of data protection risks and ways to reduce them. Ask your adviser how to assess the academy's service and document decisions about actual screens and staff actions.

For example, review [no-login class links for children](https://halqora.com/blog/no-login-class-links-for-children) as an access design choice. Removing a password step can make joining easier, but the link still needs careful handling. Decide who receives the link and what staff do if a family forwards it to someone else.

## How do COPPA, EU GDPR and the UK rules compare?

| Topic | COPPA (US) | EU GDPR | UK GDPR + Children's Code |
| --- | --- | --- | --- |
| Relevant ages (years) | Under 13 for covered services | Article 8 consent age: 16; member states may lower to 13 | Digital consent age: 13; Code: under 18 |
| Parental consent | Generally verifiable consent before covered collection | Parental authorization below the applicable age when Article 8 applies | Parental authorization below 13 for the relevant consent route; assess Code duties separately |
| Retention | Keep data only as long as reasonably necessary | Review purpose and retention under GDPR | Review purpose and retention; apply data minimization |
| Security | Written information security program under the amended rule | Assess safeguards with your adviser | Assess safeguards and protective design with your adviser |
| Penalties (USD per violation where supplied) | Up to USD 53,088, as of 21 October 2026 | See regulator | See regulator |
| Key dates | Published 22 April 2025; effective 23 June 2025; most compliance due 22 April 2026 | Check applicable national rules | Check applicable UK guidance |

The comparison separates age thresholds from wider duties. COPPA's under-13 scope, Article 8's consent ages and the Code's under-18 coverage answer different questions. Read the parental consent row together with the scope conditions above. The retention and security rows are prompts for your review, rather than a complete statement of each regime's requirements or an academy compliance assessment.

The COPPA penalty figure comes from the FTC's guidance. A consent age should never become the reason to stop reviewing access, unnecessary collection or disclosures for older students.

## Can religious study information be special category data?

Under UK GDPR, personal information revealing religious beliefs is special category data, according to the [ICO's data protection guide](https://ico.org.uk/media/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr-1-1.pdf). Enrollment in the Quran or Islamic studies classes can reveal religion. Review the meaning of the information you hold, including lesson notes, and ask an adviser what additional justification and safeguards the processing needs.

Do not add a religion field simply because your academy teaches religious subjects. Ask whether the field serves a necessary purpose. Review free-text notes too: a note about a family's beliefs can disclose more than a subject name or lesson outcome.

Keep teaching feedback focused on the lesson. Tell teachers what belongs in a report and where to raise a separate safeguarding concern. Limit access according to staff responsibilities, and explain the handling in your privacy notice.

## What should you check in your academy and its software?

An academy privacy checklist should follow the child's information through daily work. Confirm the legal position with an adviser, then assign each task to someone who can carry it out. Keep the review tied to enrollment, teaching, administration and leaving the academy. Staff should be able to connect the policy to decisions on their screens.

1. **Map students and purposes.** Identify relevant jurisdictions and ages. List each purpose for collection before deciding which consent rules apply.
2. **Review consent evidence.** Establish what authorization or verification is required, who obtains it and where staff can find the evidence. Keep distinct permissions clear.
3. **Reduce form fields.** Challenge requests for identity documents, extra contact details and sensitive free text. Remove fields without a clear need.
4. **Review staff access.** Check what teachers and administrators can see. Include reports, invoices, shared links and exported documents in the review.
5. **Question suppliers.** Ask about processing roles, purposes, disclosures, hosting, deletion and security. Obtain documented answers before making promises to families.
6. **Document retention decisions.** Ask what should happen when lessons end and how relevant suppliers handle deletion. Do not substitute an unsupported retention promise for a documented process.
7. **Check observation and lesson media.** Explain who can observe a lesson and what permission covers. If considering recordings elsewhere, review [recording online lessons and consent](https://halqora.com/blog/recording-online-lessons-consent) separately.
8. **Walk through a family request.** Make sure staff know who handles a privacy question and can locate the relevant information without distributing it more widely.

## How Halqora handles this

Halqora is [management software for online academies](https://halqora.com/features). Admins and teachers sign in; families use private class and invoice links without accounts. Avoiding family accounts removes a family password requirement, but does not remove privacy duties.

Class and invoice links do not expire. An admin can replace a link, which stops the old link working. Lesson reports are internal to teachers and admins; families do not see them.

Halqora stores observation consent records. Camera and microphone observation depends on consent on file. That permission does not establish a lawful basis for every use of student information. Halqora does not record lessons, and these features are not a claim of legal compliance.

## Sources

- [FTC guidance on complying with COPPA](https://ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions), checked 21 October 2026
- [Published final rule amending COPPA](https://federalregister.gov/documents/full_text/html/2025/04/22/2025-05904.html), checked 21 October 2026
- [FTC announcement of the COPPA amendments](https://ftc.gov/news-events/news/press-releases/2025/01/ftc-finalizes-changes-childrens-privacy-rule-limiting-companies-ability-monetize-kids-data), checked 21 October 2026
- [Text of GDPR Article 8, unofficial reproduction](https://gdpr-info.eu/art-8-gdpr), checked 21 October 2026
- [ICO guidance on online services and children's consent](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/children-and-the-uk-gdpr/what-are-the-rules-about-an-iss-and-consent), checked 21 October 2026
- [ICO age appropriate design code guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/childrens-code-guidance-and-resources/age-appropriate-design-a-code-of-practice-for-online-services), checked 21 October 2026
- [ICO guidance on services covered by the Children's Code](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/childrens-code-guidance-and-resources/age-appropriate-design-a-code-of-practice-for-online-services/services-covered-by-this-code), checked 21 October 2026
- [ICO guidance on the Children's Code and education technology](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/childrens-code-guidance-and-resources/the-children-s-code-and-education-technologies-edtech), checked 21 October 2026
- [ICO guide to data protection, including special category data](https://ico.org.uk/media/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr-1-1.pdf), checked 21 October 2026

## Questions

### Does COPPA apply to online tutoring?

COPPA covers commercial online services directed to children under 13 that collect personal information, and general-audience services with actual knowledge that they collect information from children under 13. According to the FTC's guidance, verifiable parental consent is generally required before collection. An academy teaching US children should assess its position even when based elsewhere. Ask an adviser to confirm whether your service is covered.

### At what age can a child consent to data processing under GDPR?

As of October 2026, EU GDPR Article 8 sets a default age of 16 when an information society service is offered directly to a child and processing relies on consent. Member states can lower that age to 13. UK GDPR uses 13. Below the applicable age, parental authorization is needed for that consent route. These ages do not decide every lawful basis for processing children's information.

### What changed in COPPA in 2025?

The amended COPPA Rule took effect on 23 June 2025, with most provisions requiring compliance by 22 April 2026. The FTC describes separate parental consent for disclosures such as targeted advertising, retention limited to what is reasonably necessary, and expanded personal information covering biometric and government-issued identifiers. The rule also requires a written information security program with employees assigned to coordinate it.

### Is Quran class data sensitive?

Quran class data can reveal religious beliefs. Under UK GDPR, information revealing religious beliefs is special category data, according to ICO guidance. Review enrollment details and lesson notes for what they reveal, rather than treating them as ordinary scheduling records. Limit access, avoid unnecessary religious information, and ask a data protection adviser what additional condition and safeguards your processing needs.