Dual Enrollment and Minor Student AI Data: COPPA Meets FERPA

Two Regulatory Regimes, Overlapping Populations

COPPA and FERPA are built on different triggers, and treating them as a single minor student privacy obligation misses how each actually applies to dual enrollment programs. COPPA is a Federal Trade Commission rule that applies to operators of websites or online services directed to children under 13, or that have actual knowledge they are collecting personal information from a child under 13. It requires notice and verifiable parental consent before collection, use, or disclosure of that data, and the FTC enforces it through civil penalties.

FERPA is a U.S. Department of Education framework that applies to educational agencies and institutions receiving federal funding, and it protects education records rather than a specific age group. It is enforced through the Department's Student Privacy Policy Office, and it does not create a private right of action for students or parents.

A dual enrollment record typically touches two FERPA-covered entities at once, the K-12 local education agency and the postsecondary institution, rather than one relationship governed by FERPA and another by COPPA. FERPA also builds in a transfer point: rights over an education record shift from parent to the student once the student turns 18 or begins attending a postsecondary institution, which can happen mid-program for a dual enrollment student.

Where AI Data Flows Trigger Each Regulation

Dual enrollment AI tools typically read from two systems of record, a K-12 student information system or LMS and a postsecondary SIS, then merge that data for tutoring, advising, or enrollment functions. That merge is where regulatory ambiguity shows up in practice.

Because COPPA's trigger is the age of the user rather than the type of institution, its applicability to a dual enrollment population is narrower than commonly assumed. Most dual enrollment students fall in the 14 to 18 age range, outside COPPA's under-13 threshold, so an AI tool serving only that population is unlikely to trigger COPPA obligations for those specific records. COPPA obligations attach independently if the same platform also serves a younger population, for example an early college or concurrent enrollment program that includes students under 13.

This means an AI agent processing enrollment or LMS data needs to evaluate age or grade-level attributes before deciding whether a COPPA consent workflow applies at all, rather than assuming FERPA governs one side of the pipeline and COPPA governs the other. The more consistent overlap is between two FERPA-covered entities, each of which may authorize AI vendor access under its own version of FERPA's school official exception.

Technical Controls for Enforcing the Boundary at Runtime

Enforcing this boundary requires more than a static access control list built around student identity. Because the applicable consent basis differs by where a data element originated (K-12 system versus postsecondary system), access decisions need to account for data origin, not just the person requesting it.

A practical pattern is to tag records with their originating regulatory context as they move through the AI pipeline, and to scope agent permissions by source system rather than by student alone. Consent and authorization status can then be treated as a first-class attribute on the record itself, evaluated at the moment of access rather than assumed from a role assignment made earlier.

Where a platform has a confirmed under-13 subpopulation, that subset benefits from logical or storage-level separation, so COPPA-specific consent and retention rules can be enforced independently of the broader FERPA-governed dataset. Orchestration logic should also be able to halt or flag any action that would combine K-12-origin and postsecondary-origin data without a verified shared legal basis, since that combination is where an AI system could disclose data beyond what either institution authorized.

• Tag records with originating regulatory context (K-12 vs. postsecondary) as they enter the AI pipeline.
• Scope agent permissions by source system, not only by student identity.
• Evaluate consent and authorization status at access time as attributes on the record.
• Isolate confirmed under-13 data so COPPA consent and retention can run independently.
• Block or flag merges of K-12-origin and postsecondary-origin data without a verified shared legal basis.

Operational and Contractual Requirements

Technical controls only hold if the contractual and governance layer defines what they are enforcing. The K-12 LEA and postsecondary institution need a data-sharing agreement specifying which FERPA exception authorizes AI vendor access to dual enrollment records, since FERPA's school official exception depends on the institution maintaining direct control over how a vendor uses and retains the data.

Vendor contracts should map explicitly to that direct control requirement, spelling out data use limits, retention periods, and deletion obligations rather than relying on general data protection language. Where a platform's user base does include students under 13, age-gating and a verifiable parental consent workflow need to run as a separate process from the FERPA-based consent already in place for older dual enrollment students, not as a variant of it.

Consent and notice language should also account for the point where FERPA rights shift from parent to eligible student, so both parties understand who is accountable for which data element as a student moves through the program. Vendor onboarding checklists should include a review of AI-specific data flows against both COPPA operator obligations, where applicable, and FERPA disclosure logging requirements.