Legal frame
The data path is designed to the law, not around it. Three regimes apply to any product that hears a child under five. This page states our reading; it is not legal advice and the policy documents it points to are in review.
COPPA
The Children's Online Privacy Protection Rule requires verifiable parental consent, specified by purpose. Consent to report to a parent's dashboard and consent to train models are two different consents, never bundled. Bundling them is a classic FTC enforcement target.
- FTC, Children's Online Privacy Protection Rule
- FTC, Complying with COPPA: Frequently Asked Questions
Student records
Where a programme is an education-record holder, FERPA and state student-privacy statutes add a second layer on top of COPPA. Which statutes apply depends on the state the programme operates in and whether it receives federal education funds.
Biometrics
A child's voiceprint is biometric data in a growing number of states. Statutes such as Illinois BIPA carry statutory damages per violation. Training models on toddler voice recordings is exactly what these laws target.
The design default is absolute: commercial models are never trained on raw child audio. Dialect-model improvement, which is a real equity goal, uses adult voice data and licensed dialect corpora, not the children's recordings.
The wall
Two physically separate stores with different access controls:
| Store | Contents | Consent | Risk |
|---|---|---|---|
| Dashboard reporting | Derived structured events: labels, zones, milestones, timestamps | Simple, purpose-specified | Low |
| Any model work | Structured events only; any richer data requires separate, explicit opt-in on de-identified data | Separate, explicit | Managed |
That wall is architectural, not procedural. See How the data path works; the signing and encryption underneath are documented publicly by Locale Network (encryption architecture).
Accessibility obligations
Under the 2024 DOJ Title II rule, state and local government web content must meet WCAG 2.1 AA, with deadlines of 26 April 2027 (larger entities) and 26 April 2028 (smaller). Content posted by a government's contractor or vendor is explicitly in scope. A platform sold to a state agency inherits that obligation. The apps are built to WCAG 2.2 for that reason.
This page states the frame the products are designed to. It is not a compliance certification. Policy documents (privacy, terms, children's privacy) are in review and will be published on the policies page when counsel signs off.
Sources
- FTC, COPPA Rule. https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa
- FTC, Complying with COPPA FAQ. https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions
- W3C WCAG 2.2. https://www.w3.org/TR/WCAG22/