CCPA Compliance for Education Companies
EdTech companies serving California schools and students must navigate CCPA alongside FERPA, COPPA, and California's own Student Online Personal Information Protection Act (SOPIPA). While nonprofit educational institutions are exempt from CCPA, the for-profit EdTech companies that serve them are not. Understanding which student and parent data falls under CCPA versus education-specific privacy laws is critical for compliance and for maintaining trust with school district customers.
Why It Matters
- For-profit EdTech companies are subject to CCPA even when their customers are exempt nonprofit schools and universities
- California has the most aggressive student data privacy enforcement in the nation, with SOPIPA layered on top of CCPA
- Parent and student consumer rights under CCPA coexist with FERPA rights, creating overlapping but distinct compliance obligations
- EdTech marketing data — collected through conferences, webinars, trials, and website visits — is fully subject to CCPA
Common Challenges
- Distinguishing between student data governed by FERPA and SOPIPA versus personal information subject to CCPA consumer rights
- Implementing consumer rights for parents and adult students while respecting FERPA's separate consent and access framework
- Managing CCPA obligations for EdTech marketing and sales data collected from school administrators and decision-makers
- Handling deletion requests when education data retention requirements conflict with CCPA deletion rights
Key Policies You Will Need
Timeline & Cost
Expected Timeline
4-8 weeks for CCPA program alongside existing education privacy compliance
Estimated Cost
$8,000-$25,000 for CCPA overlay on existing education privacy program
Tips for Education
- 1Map every data element to its governing privacy law (FERPA, COPPA, SOPIPA, CCPA) to determine which consumer rights and obligations apply
- 2Implement a single privacy request intake that routes requests appropriately based on whether the requester is a student, parent, or school administrator
- 3Ensure your EdTech marketing and sales data practices comply with CCPA even if your student data is governed by education-specific laws
- 4Sign the California Student Data Privacy Agreement maintained by the Student Data Privacy Consortium to streamline school district procurement
Related Guides
CCPA Compliance for Startups
CCPA Compliance for SaaS Companies
CCPA Compliance for Healthcare Companies
CCPA Compliance for Fintech Companies
CCPA Compliance for E-commerce Companies
CCPA Compliance for Agencies
Get started with CCPA/CPRA compliance
PoliWriter generates all the policies you need for CCPA/CPRA compliance, customized to your education tech stack and practices. Hours, not months.
Get Started Free