Schools execute data processing agreements with EdTech vendors, designate them as school officials under FERPA, and route student information through platforms built and operated by private companies. What those agreements cannot do — despite what many vendors implicitly rely on — is transfer the legal compliance obligation for COPPA consent from the