On a school or edtech website, cookies answer to two US federal laws at once. COPPA, the Children's Online Privacy Protection Act, decides whether a cookie on a site for children under 13 needs a parent's consent: a persistent identifier used only to run the site does not, one used for ads or profiling does. FERPA, the Family Educational Rights and Privacy Act, decides whether data from student records may reach the company behind the cookie at all. A standard cookie banner handles neither on its own.
School districts, universities and edtech vendors operate under privacy obligations that most commercial websites never meet. A banner built for the GDPR or the CCPA may fall short when the visitors are students, the data belongs to an education record or the user is a child under 13.
FERPA and COPPA differ in what they protect
FERPA protects education records held by schools that receive US Department of Education funding, and it controls who those records can be disclosed to. COPPA protects personal information collected online from children under 13, and it requires verifiable parental consent before collection, with narrow exceptions. A primary school website can fall under both: FERPA through the student data behind its portal, COPPA through the identifiers its cookies collect.
When a school website drops a _ga analytics cookie or loads a Meta pixel that sets _fbp, both laws can apply. As of October 2026, the Federal Trade Commission (FTC) can seek civil penalties of up to $53,088 per COPPA violation, the inflation-adjusted maximum in 16 CFR 1.98, and FERPA non-compliance puts federal funding at risk. State student privacy statutes add further layers.
FERPA: what it covers and where cookies fit
FERPA applies to any educational institution that receives funding from the US Department of Education. It gives parents, and eligible students aged 18 or over, control over access to education records, which include any records directly related to a student and maintained by the school or a party acting on its behalf.
Cookies themselves are not mentioned in FERPA. The risk arises when cookies or tracking scripts collect data that forms part of an education record, or when a third-party vendor receiving that data is not covered by the school official exception.
Under 34 CFR 99.31, a school may treat a contractor or service provider as a school official only if it performs a service the school would otherwise use its own staff for, is under the school's direct control with respect to the use and maintenance of education records, and uses the data only for the purposes it was disclosed for. If your school portal sends student-identifiable data to Google through _ga cookies without those conditions in place, that data sharing may breach FERPA's disclosure restrictions.
Practical FERPA steps for school websites
Every third-party script on a school website that receives student-identifiable information should be covered by a written agreement that sets out the provider's role, permitted data use and retention limits. This includes analytics platforms, learning management systems and any embedded content that sets cookies.
It also helps to document which vendors receive data through cookies and scripts, so the school can answer a parent's question about where a record went.
COPPA: the under-13 threshold
COPPA applies to websites and online services directed at children under 13, or those with actual knowledge that they are collecting data from children under 13. For primary school websites, learning platforms used by young students and child-directed edtech products, it decides what may run.
The FTC's amended COPPA Rule, finalised in January 2025, has applied in full since 22 April 2026. Operators now need separate verifiable parental consent before disclosing children's personal information to third parties, such as for targeted advertising. A written data retention policy is required, and indefinite retention of children's data is prohibited.
Under the COPPA Rule (16 CFR Part 312), a persistent identifier that can recognise a user over time and across websites, such as a customer number held in a cookie, counts as personal information. That covers _ga, _fbp and advertising cookies like IDE. The rule then makes one exception, in section 312.5(c)(7): an operator may collect a persistent identifier and no other personal information without parental consent if it is used only to support the internal operations of the site. The rule defines that as activities such as maintaining or analysing how the site functions, authenticating users, security and contextual advertising, and never behavioural advertising or building a profile of a child.
So first-party analytics used only to see how the site works can fall within the exception, with notice in the privacy policy. _fbp, IDE and remarketing tags cannot: on a child-directed site they need verifiable parental consent, or they have to go.
The school consent exception
FTC guidance has long accepted that a school can consent on behalf of parents when an edtech service collects student data for the school's educational use only, and not for any commercial purpose. The FTC did not write this exception into the rule in the 2025 amendments, pointing to possible rulemaking by the Department of Education, so it still rests on FTC guidance. It answers the common question of whether a district breaks the law by using a program that asks for parental consent the school never collected: where the program is used for the school's educational purposes, the school can give that consent itself.
Schools relying on this exception should limit third-party cookies on student-facing platforms to those strictly necessary for educational functions. Marketing cookies, social media pixels and behavioural advertising trackers cannot be justified under the school consent exception.
Does a cookie on a school site need parental consent?
How FERPA and COPPA overlap on school websites
A primary school website serving students under 13 must meet FERPA and COPPA at the same time. The two laws address different parts of the same problem, and meeting one does not satisfy the other.
| Requirement | FERPA | COPPA |
|---|---|---|
| Scope | Education records at federally funded institutions | Personal information from children under 13 |
| Consent authority | Parents (or students aged 18 or over) | Parents (verifiable consent required) |
| School can act without parents? | Yes, through the school official exception for vendors under its direct control | Yes, for educational purposes only (FTC guidance, not written into the rule) |
| Covers cookies and tracking? | When cookies collect data linked to education records | Yes, persistent identifiers are personal information |
| Penalties | Loss of federal funding | Up to $53,088 per violation (civil penalties) |
| Enforced by | US Department of Education | Federal Trade Commission (FTC) |
In practice, a school website needs vendor arrangements that satisfy FERPA's disclosure rules and cookie practices that satisfy COPPA's consent requirements. One law does not cover the gaps in the other.
State student privacy laws add further obligations
Since 2014, most US states have passed their own student privacy laws. Many go further than FERPA or COPPA by imposing direct obligations on edtech vendors, not just schools.
Common state-level requirements include prohibitions on using student data for targeted advertising, mandatory data deletion on request or at the end of a contract, security incident notification and bans on selling student information. California (SOPIPA), New York (Education Law 2-d) and Illinois (SOPPA) have particularly detailed frameworks.
For edtech vendors operating nationally, this patchwork means cookie and tracking practices must satisfy the strictest applicable standard. A vendor agreement that works in one state may be insufficient in another. The US state privacy laws comparison gives a broader picture of how these frameworks interact.
Which cookies belong on education websites
Not all cookies carry the same risk on education websites, and the purpose of each cookie matters more here than on a typical commercial site.
Strictly necessary cookies, such as session identifiers like PHPSESSID, authentication tokens and CSRF protection cookies, can generally be set without parental consent. Under COPPA they fall within support for internal operations, and they do not collect data for third parties.
Analytics cookies depend on how they are used. Google Analytics 4 sets _ga and _ga_* cookies that create persistent identifiers. Used only to see how the site functions, with no advertising features or data sharing switched on, first-party analytics can fall within COPPA's internal-operations exception. Linked to Google's advertising features, it cannot, and the safer route on a child-directed site is privacy-preserving analytics that work without persistent identifiers.
Marketing and advertising cookies, including _fbp, IDE and remarketing tags, should not appear on student-facing education websites. They collect data for behavioural profiling and targeted advertising, which conflicts with both COPPA and most state student privacy laws.
A cookie plan for schools in four steps
Start with a cookie audit. Identify every cookie set on your school website, who sets it, what data it collects and where that data goes. Automated scanning tools can detect cookies you may not know about, particularly those added by third-party scripts or embedded content.
Step 1: classify and remove unnecessary cookies
Remove all marketing pixels, social media trackers and advertising cookies from student-facing pages. If YouTube embeds or social sharing buttons set third-party cookies, replace them with privacy-enhanced alternatives or load them only after consent.
Step 2: get the right kind of consent
A cookie banner cannot deliver COPPA's verifiable parental consent. COPPA requires methods reasonably calculated to make sure the person consenting is the child's parent, and a click on a banner does not do that. On child-directed pages, keep only cookies that support internal operations, and collect verifiable parental consent through a separate process, or the school's consent for educational use, for anything else. A consent banner still has a job on public pages for adult visitors and on sites outside COPPA.
Step 3: review vendor agreements
Make sure every third-party service that receives student data through cookies is covered by FERPA's school official conditions, usually through a written agreement. The agreement should set data use limits, retention periods, deletion obligations and security standards. A vendor risk assessment helps make this process systematic.
Step 4: separate student and public pages
Many school websites serve two audiences: students and parents using educational tools, and the general public visiting informational pages. Consider running different cookie configurations for each. Public pages may use a standard consent banner, while student-facing portals should restrict cookies to those strictly necessary for their functions.
GDPR and international students
Universities and online learning platforms with students in the EU or UK face the GDPR and the UK GDPR on top of FERPA and COPPA, and other countries' privacy laws follow their students too. The GDPR's children's data provisions set the digital age of consent between 13 and 16, depending on the member state, and the EU requires prior opt-in consent for non-essential cookies whatever the visitor's age.
For institutions with an international student body, the safest approach is to apply the strictest standard across all visitors: block all non-essential cookies by default, obtain consent before they run and keep auditable consent records.
Questions about FERPA, COPPA and cookies
Do school websites need a cookie consent banner?
If the site sets non-essential cookies for EU or UK visitors, or for adults where state law asks for it, a banner is the usual tool. For children under 13 under COPPA, a banner is not enough: tracking for ads or profiling needs verifiable parental consent, and cookies used only to run the site need none.
Can schools use Google Analytics on student-facing pages?
Google Analytics sets persistent identifier cookies, which are personal information under COPPA. Used only to analyse how the site works, with advertising features off, it can fall within the internal-operations exception. Linked to advertising, it needs verifiable parental consent on pages for children under 13.
Does FERPA apply to cookies on university websites?
FERPA applies when cookies collect or transmit data that forms part of an education record. If analytics or tracking cookies on a university site capture student-identifiable information and send it to a third party that does not meet the school official conditions, that may breach FERPA's disclosure restrictions.
What is verifiable parental consent under COPPA?
Verifiable parental consent requires methods reasonably calculated to make sure the consenting person is the child's parent. Accepted methods include signed consent forms, credit card verification, video calls and knowledge-based authentication. A cookie banner click does not meet this standard.
Are session cookies exempt from COPPA?
COPPA has no session-cookie exemption: the test is purpose, not lifetime. A cookie used only to support the internal operations of the site, such as keeping a login or a session, needs no parental consent. A cookie used for behavioural advertising or profiling does, however short its lifetime.
Can a school consent to an app for students instead of parents?
Under FTC guidance, yes, when the app collects student data only for the school's educational use and for no commercial purpose. The school then gives consent in place of the parents. The FTC did not write this into the 2025 rule amendments, so it still rests on that guidance.
Keep advertising tags off pages children use
Most of the work on a school site is knowing what loads and holding back what should not. Kukie.io scans your pages for the cookies and scripts they set, blocks marketing and analytics scripts until a visitor accepts them and logs each choice, so you can keep student-facing pages to what they need.
