Six Data Privacy Artifacts to Demand From a Typing Vendor

A data privacy review of a K-5 typing vendor comes down to six artifacts, not assurances. Ask each vendor: what they collect from a child, how long they keep it, who else touches it, their breach clock, what a parent can review and delete, and whether they will sign your data privacy agreement. Meta Typing Club can produce one.

TL;DR: The amended COPPA Rule reaches child-directed services and any operator with actual knowledge it collects from children under 13. Since April 2026 both have had to publish a retention policy naming a timeframe for deletion. That deadline has passed.

Why "COPPA compliant" is not an answer

No operator answers that checkbox against itself. The amended Children's Online Privacy Protection Rule at 16 CFR 312.10 bars retaining children's personal information indefinitely and requires a "written data retention policy" naming "a timeframe for deletion," published in the privacy notice. Latham & Watkins dated full compliance to April 22, 2026, so that duty has been live since last spring.

You can audit part of any typing vendor's privacy posture in 90 seconds, from their website, before the first call.

The six artifacts to request

Where an artifact should exist and does not, a prose answer is a no.

Question	Artifact that settles it
What do you collect from a child?	Registration screen and notice
How long do you keep it?	Retention policy with a deletion timeframe
Who else touches the data?	Third parties named in the notice
How fast do we hear of a breach?	A number of days, in writing
What can a parent review and delete?	A parent-facing review path
Will you sign our DPA unmodified?	A signature, or a redline

16 CFR 312.4(d) makes the online notice name "the identities and specific categories of any third parties" receiving the data, so "trusted service providers" does not clear it. Parent review has its own rule, 16 CFR 312.6.

New York gives a contractor seven calendar days from discovery to notify the agency (8 NYCRR 121.10). Your state may beat the vendor's template.

The consent path is less settled than you think

The concession first. FTC staff guidance recognizes school authorization and bounds it: school consent is "limited to the educational context", where an operator collects student information "for the use and benefit of the school, and for no other commercial purpose" (FTC COPPA FAQ N.1). That is staff guidance, not a codified provision. The Commission proposed an ed tech provision when it amended the Rule and declined to finalize one, which Latham & Watkins attributes to expected FERPA changes.

FERPA's own route is narrow. 34 CFR 99.31 treats a vendor as a school official only while it performs a function you would otherwise staff and stays under your direct control, and 99.33(a) caps what it may then do with the records. So put it on paper: the current National Data Privacy Agreement v2.2 supplies pre-reviewed terms instead of per-vendor redlining, and the clauses to read before a board vote belong in the same document.

Make each vendor name its consent path in writing.

How Meta Typing Club scores on these six questions

One produced, one partial, four missing.

Produced: our registration screen and notice answer what we collect. A display name, a login credential and progress records would run this platform. We ask for a first name, a last name, a username and a password, so we take a child's legal surname we have no use for.

Partial: a parent who created the account sees progress and can delete it. But a student links to whoever created it, so a teacher-created student has no parent linked at all, and a progress dashboard is not the 312.6 artifact.

Missing: our privacy policy names no retention window, no deletion timeframe, and no subprocessors beyond "trusted third-party services for hosting, analytics, and email delivery." No breach clause, no mention of FERPA. We collect log data including IP address and access times. No district has handed Meta Typing Club a data privacy agreement to sign. The retention gap stings most: 312.10 has been operative since April 2026 and our notice still answers it with nothing. Apply this post's own rule and Meta Typing Club is a no today.

The objection worth taking seriously

A colleague will call a six-artifact review heavy machinery for a typing program: no essays, no chat, no uploads, no photographs. That is partly right, and risk-tiering is sound practice. It fails on firsts and on scale. A typing account is often the first login a six-year-old ever has, and keyboarding rolls out by grade band, so one signature creates accounts for every K-5 child in the district. Small record, every child in the building.

Key Takeaways

• Replace the compliance checkbox with six artifacts a vendor produces or does not.
• 16 CFR 312.10 requires a retention policy naming a deletion timeframe.
• "Trusted service providers" does not satisfy 16 CFR 312.4(d).
• School consent rests on FTC staff guidance, not a codified provision.
• Meta Typing Club can produce one of these six artifacts.

Frequently Asked Questions

If our district consents on parents' behalf, is the COPPA question closed?

Treat it as open, and note where responsibility sits. The FTC says: "operators should not state in Terms of Service or anywhere else that the school is responsible for complying with COPPA, as it is the responsibility of the operator to comply with the Rule."

The vendor is in our state alliance's DPA registry. Is that an agreement with us?

No. It shows the vendor signed with some district. Yours needs its own, which is what the National Data Privacy Agreement is for.

What is the smallest data set a typing platform actually needs?

A display name, a login credential, and progress records. No birth date, no home address, no photograph, no parent phone number.

How is a free typing platform funded, and is our students' data part of it?

Meta Typing Club is free of charge today, funded by voluntary donations, and our notice states "We do not sell your personal information." Our terms reserve the right to add paid features later, so budget on today only.

A teacher rolled this out without vetting. What comes first?

Check retention and third-party disclosure in the notice, then request the DPA. A display name plus progress records usually leaves time to paper it properly.

Where to start on Monday

Open the privacy notice of every vendor on your shortlist, ours included, and look for a deletion timeframe and named third parties. A seal such as 1EdTech TrustEd Apps narrows a shortlist; reading the notice is still the work. Then send the six questions to every vendor in one email, Meta Typing Club included, and use our contact form to name the missing artifact that would block approval.