Compliance & regulatory considerations
EdTech regulation is unusually dense because the audience often includes minors and the data often crosses borders. We design to the strictest applicable regime per learner cohort rather than to the lowest common denominator.
COPPA (US under-13)
FERPA (US institutions)
GDPR-K (EU under-16)
UK Age Appropriate Design Code
UK GDPR + DPA 2018
CCPA / CPRA
WCAG 2.2 AA
SOC 2 Type 1 (in progress)
Children's data is the load bearing constraint. COPPA in the US requires verifiable parental consent before any personal information is collected from a child under 13, prohibits behavioural advertising, and forces a clear deletion path that flows through every sub-processor. GDPR-K in the EU sets the digital consent age between 13 and 16 depending on member state, with parental consent required below that age. The UK Age Appropriate Design Code (Children's Code) layers fifteen additional standards including high default privacy, no nudge patterns, age estimation where appropriate, and minimised data sharing. We treat child accounts as a different schema from adult accounts so the wrong control can never apply to the wrong record, and we maintain a per-jurisdiction matrix of defaults so a US, UK, and EU rollout does not require three different code paths.
FERPA matters the moment you sell into US K-12 districts or universities. We build to the FERPA Direct Service Agreement model: the institution remains the data controller, we are the processor under instruction, the school official exception is documented, and parental access to records is delivered through a dedicated portal rather than through customer support. Auditable access logs survive a Department of Education enquiry.
Accessibility is procurement-blocking, not optional. Universities, councils, and most regulated employers will not buy a platform that fails WCAG 2.2 AA. We design to AA from day one and verify with both automated tooling (axe-core, Lighthouse, Pa11y) and manual screen reader testing on NVDA and VoiceOver. Captioning, keyboard navigation, focus management on modal dialogs, sufficient colour contrast, and reduced motion preferences are part of the component library, not a remediation phase.