New 2025 Data Privacy Rules: What EdTech Companies Must Know

Navigating the Evolving Privacy Landscape

The educational technology sector faces its most significant regulatory shake-up in a decade as eight new state privacy laws and sweeping updates to COPPA take effect throughout 2025. For EdTech leaders and school administrators, these changes represent more than compliance checkboxes—they demand a fundamental rethinking of how student data is collected, protected, and managed. The expanded definition of personal information, stricter parental consent requirements, and varied state-level obligations create a complex patchwork of compliance challenges that could reshape operational practices across the industry.

With regulators increasingly focused on children's privacy and data security, understanding these developments isn't merely advisory—it's essential for maintaining market access, securing school contracts, and preserving stakeholder trust. This analysis breaks down the critical updates and provides actionable guidance for EdTech companies to navigate this transformed landscape successfully while ensuring robust student data privacy and online learning platform compliance.

Sweeping COPPA Amendments: Raising the Bar for Children's Privacy

Expanded Definitions and Scope

The Federal Trade Commission's final amendments to COPPA, effective June 23, 2025, significantly broaden what constitutes protected personal information in the educational context. The revised rule now explicitly includes:

• Biometric identifiers capable of automated or semi-automated recognition, including fingerprints, handprints, retina and iris patterns, genetic data, voiceprints, gait patterns, and facial templates.
• Government-issued identifiers such as social security numbers, state identification card numbers, birth certificate numbers, and passport numbers.

This expansion means EdTech platforms utilizing facial recognition for attendance, voice recognition for reading assessment, or any biometric authentication methods must now comply with COPPA's stringent requirements, regardless of whether they're specifically designed for children. The FTC has also clarified it will consider marketing materials, user reviews, and representations to third parties when determining if a service is "directed to children".

Enhanced Parental Controls and Transparency

The updated COPPA rule strengthens parental oversight through several critical requirements:

• Detailed consent disclosures: Direct notices to parents must now specifically identify third parties receiving children's data and the purposes for sharing.
• Granular consent options: Parents must be able to consent to data collection and use without automatically approving disclosure to third parties, unless such disclosure is integral to the service's operation.
• Revised consent methods: The amendments authorize new verification approaches, including knowledge-based authentication, submission of government-issued IDs, and enhanced text message verification with follow-up confirmation.

Stricter Data Security and Retention Protocols

Perhaps the most operationally significant changes come in the form of strengthened security and retention requirements:

• Written security programs: Operators must now implement comprehensive written children's personal information security programs with designated responsible personnel, regular risk assessments, and annual reviews.
• Limited data retention: Companies can no longer retain children's personal information indefinitely—they must establish specific timeframes tied to the collection purposes and delete data once it's no longer reasonably necessary.
• Safe harbor oversight: FTC-approved COPPA Safe Harbor programs now face stricter reporting requirements, including public membership lists and regular disclosures of disciplinary actions.

Table: Key COPPA Amendment Compliance Deadlines

The State Law Patchwork: Eight New Privacy Frameworks

Diverse Applicability Thresholds

The state privacy landscape grows increasingly fragmented in 2025, with new laws taking effect in Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, and Maryland. Each establishes different thresholds for applicability:

• Nebraska's law applies broadly to nearly all businesses operating in the state that aren't classified as small businesses by SBA standards, regardless of how much data they process.
• Tennessee's approach is more restrictive, applying only to businesses with revenue exceeding $25 million.
• Delaware and New Hampshire set lower thresholds, covering controllers that process personal data of just 35,000 consumers.
• New Jersey breaks pattern by including nonprofits within its scope, similar to Delaware and Minnesota.

Varied Consumer Rights and Business Obligations

While all new state laws grant consumers fundamental rights like access, deletion, and correction, significant variations create compliance challenges:

• Universal opt-out mechanisms are recognized in Delaware, Nebraska, Minnesota, New Hampshire, New Jersey, and Maryland, but notably not in Iowa.
• Data protection assessments for high-risk processing are required under most new laws, with New Jersey mandating assessments before engaging in such processing.
• Maryland's data minimization requirements are particularly strict, limiting collection to what's "reasonably necessary and proportionate" to provide the requested service and imposing a complete ban on selling sensitive data without exceptions.
• Minnesota's unique provisions grant consumers the right to question profiling results and understand the rationale behind automated decisions.

Table: Comparison of Key State Privacy Law Provisions

Practical Compliance Strategies for EdTech Companies

Building a Adaptive Privacy Program

Navigating this complex regulatory environment requires more than piecemeal adjustments—it demands a comprehensive privacy program built for adaptation:

• Conduct data mapping exercises to identify all personal information flows, with special attention to newly covered data types like biometrics and government IDs.
• Implement granular consent mechanisms that allow for specific authorization for different processing activities, particularly for data sharing with third parties.
• Develop data retention schedules specifically for children's information, with automatic deletion protocols tied to collection purposes.
• Create assessment frameworks for high-risk processing activities, following the NIST privacy framework or similar standards that may provide affirmative defense in states like Tennessee.

Vendor Management and School Partnerships

EdTech companies must reevaluate their relationships with both vendors and educational institutions:

• Strengthen vendor agreements to ensure third-party processors comply with all applicable state laws and COPPA requirements, with audit rights to verify compliance.
• Enhance school communications by providing transparent documentation of data practices in clear, accessible language that schools can share with parents.
• Review "school official" status under FERPA and ensure contracts properly limit data use to educational purposes.

Proactive Adaptation as Competitive Advantage

The 2025 privacy changes represent more than regulatory hurdles—they offer an opportunity to build trust with educational institutions and differentiate in a crowded market. EdTech companies that embrace privacy by design, implement robust compliance programs, and maintain transparent practices will be better positioned to secure school contracts and avoid the significant financial and reputational costs of non-compliance.

As the regulatory landscape continues to evolve, maintaining ongoing vigilance and adaptive policies will be crucial. The organizations that treat student privacy as a core value rather than a compliance obligation will not only avoid regulatory action but will become preferred partners in the educational ecosystem.

Need expert guidance navigating EdTech compliance? Deutsche Consulting's specialized team helps educational technology companies implement sustainable privacy programs that meet evolving regulatory requirements. Contact us today to transform compliance from a challenge into a competitive advantage.