COPPA in 2026: what the amended rule means for schools, daycares and the apps they use

What COPPA covers

The Children's Online Privacy Protection Act applies to operators of online services directed to children under 13, or with actual knowledge they collect personal information from such children. ‘Personal information’ includes photos, videos and audio containing a child's image or voice.

What changed

• Separate consent for third-party disclosure. Operators generally need separate verifiable parental consent before disclosing children's personal information to third parties for purposes such as targeted advertising.
• Stronger data security and retention obligations, including written programmes and a retention policy that does not keep children's data indefinitely.
• Clearer treatment of the ‘school authorization’ path, under which a school may authorise collection for an educational purpose in lieu of individual parental consent, within limits.
• Civil penalties continue to be inflation-adjusted and substantial per violation.

The distinction that matters for photo apps

COPPA bites hardest where children themselves use the service and the operator collects from them. Apps with no child accounts — where teachers capture, the school approves, and only adults log in — sit in a simpler position, though the school still controls consent and the vendor still owes security and retention duties. This is one reason Oyku has no child-facing features at all.

Questions for any vendor

Pair this with FERPA's directory-information opt-out (photos can count) — see FERPA and school photos — and a tiered photo consent policy.