Education apps: children's privacy, store rules and real classrooms

An education app has more than one customer. A child uses it, a parent or teacher decides whether it stays on the device, and a school may sign the contract and answer to its own privacy officer. Behind them stand two app review teams and, depending on where your users live, regulators in Europe and the United States.

Most of the hard decisions follow from one fact you should settle before design starts: the age of the people who will actually use the app. This guide walks through what that choice triggers, from consent rules to store categories, and then turns to classrooms, where Wi-Fi is shared, devices are shared and attention is short. The rules are summarized as they stand at the time of writing. They change, so check the official pages before you submit.

Contains affiliate links. As an Amazon Associate I earn from qualifying purchases.

Settle the audience first

Write three short answers: who uses the app, who installs or pays for it, and where they are. "Children aged 6 to 9 in Dutch primary schools, on shared iPads set up by the school" leads to very different work from "secondary school students revising at home on their own phones" or "teachers planning lessons".

The age line matters most. Under 13 brings COPPA into play for users in the United States. Under 16 is the GDPR's default threshold for a child's own consent, lowered in some EU countries. An app used only by teachers avoids most of this, which is one reason many classroom products split into a teacher app and a much simpler student experience.

Children's data under the GDPR

The GDPR doesn't forbid processing children's data, but it asks for more care. When consent is your legal basis for an online service offered directly to a child, the child must be at least 16 for their own consent to count; below that age, a parent or guardian has to give or authorize it. Member states may lower the age, though not below 13, and they have chosen different thresholds. The Dutch data protection authority, the Autoriteit Persoonsgegevens, states that 16 applies in the Netherlands. You also have to make reasonable efforts to check that consent really came from a parent, and information aimed at children has to be in plain language a child can follow.

Consent is not the only route. When a school chooses your app for its lessons, the school usually decides why and how pupils' data is used, which makes it the controller and you the processor. That relationship needs a written contract under Article 28 of the GDPR, and schools will ask for one before anyone opens the app. Keep a short, honest list of what you collect, where it is stored, which subprocessors see it and how long you keep it. A school's privacy officer will ask for exactly that list.

COPPA for users in the United States

The Children's Online Privacy Protection Act, through the FTC's rule, applies to operators of commercial websites and online services, mobile apps included, that are directed to children under 13 and collect personal information from them. It also applies to general audience services with actual knowledge that they collect from children under 13. The core duties are a clear privacy notice and verifiable parental consent before collection, using methods such as a signed consent form, a card transaction by the parent or a call with trained staff.

The FTC amended the rule in 2025. The changes took effect on June 23, 2025, and most had a compliance deadline of April 22, 2026. Among them: separate parental consent before disclosing children's personal information to third parties, for example for targeted advertising; personal information kept only as long as reasonably necessary, never indefinitely; and biometric identifiers added to the definition of personal information.

Schools have a special position. According to the FTC's COPPA FAQ, a school can consent on parents' behalf only where the operator collects students' information for the use and benefit of the school and for no other commercial purpose. If you use that data for behavioral advertising or to build profiles for your own ends, the school can't consent for the parent at all.

What the stores ask of kids' apps

Both stores add their own layer on top of the law. The table compares the main points at the time of writing.

A few Apple details catch teams out. Under the App Store Review Guidelines, once customers expect your app to follow the Kids Category rules, later updates must keep following them even if you deselect the category. Terms like "For Kids" and "For Children" in app metadata are reserved for the Kids Category. And a parental gate, the adult-level task between a child and a link or purchase, is not the parental consent that privacy laws require. Apple's age ratings now run 4+, 9+, 13+, 16+ and 18+, and its Declared Age Range API lets a parent share a child's age range with an app without revealing the birthdate.

On Google Play, the target audience you declare decides which rules apply, and Google reserves the right to check it. The Families policy also asks for a safety warning at launch in augmented reality features and an in-app reminder to stay safe online in social features.

Accessibility for a room of different learners

A class of thirty children covers a wide range of reading levels, eyesight and motor control. Support Dynamic Type and Android font scaling, keep touch targets generous, label every icon button for VoiceOver and TalkBack, and caption every video. For children who can't read yet, pair instructions with audio. Apple suggests a spoken prompt for parental gates in apps for pre-literate children, and the idea works for every instruction. Our mobile accessibility checklist covers a testing routine per release.

Teachers have needs of their own: class progress at a glance, and controls they can find in the ten seconds before a lesson starts.

Offline classrooms and shared devices

School networks often struggle when thirty tablets request the same video at nine in the morning. Let teachers download lesson content ahead of time, store pupils' work on the device, and sync when the network allows. Show sync state plainly so nobody thinks finished work has vanished. The same patterns appear in our guide to designing for the disconnected user.

Devices are shared, too. With Shared iPad, students sign in with Managed Apple Accounts issued by the school, so never assume that one device means one child. Keep personal data out of shared caches, make sign-out complete, and test what the next pupil sees.

A pre-launch checklist

1. Write the audience answers: who uses it, who installs it, where they are.
2. List every piece of personal data with its purpose, storage location and retention period.
3. Check each SDK for ads, analytics and crash reporting against the store rules for your audience.
4. Decide how you obtain parental consent, or document why a school's authorization covers you.
5. Prepare a data processing agreement template for European schools.
6. Put every link out and every purchase behind a parental gate.
7. Run a full lesson offline, reconnect, and check that nothing was lost or duplicated.
8. Test with VoiceOver, TalkBack and the largest text size.
9. Pass a shared device from one test account to the next and look for leftovers.

Questions

Does an app for teachers need to follow the Kids Category rules?

Not if its users are adults and it isn't listed in the Kids Category. It still needs a privacy policy, and if pupils' data passes through the teacher's app, GDPR and COPPA duties follow the data, whoever holds the phone.

Is a parental gate enough to meet COPPA?

No. Apple's own guidelines say the gate is generally not the same as parental consent. The gate keeps children away from purchases and external links, while COPPA asks for verifiable consent from a parent before you collect personal information. Plan both.

Can we use analytics in a children's app?

Prefer first-party analytics that you host and that record only aggregate events. Third-party analytics in the Kids Category is allowed only in limited cases, and Google Play bars apps aimed only at children from sending device identifiers. Read each SDK's documentation for a children's mode before you add it.

Which consent age should a European app design for?

It depends on the country and ranges from 13 to 16. If you serve several EU countries with one sign-up flow, designing for 16 is the cautious choice, and it matches the Dutch rule.