What to ask an app or school about your child's data: six questions
Ask six questions: what do you collect, why, who sees it, is it sold or used for ads, can I see and delete it, and how long do you keep it. A good answer is specific and written down; a vague answer is an answer too.
Six questions about your child's data — one card per app or school
A free printable PDF, no sign-up.
A new app asks you to accept its terms, or the school sends home a form naming a platform you have never heard of. You don't need to be a lawyer to find out what happens to your child's data. You need six questions, and to know what a good answer sounds like. Here are the questions, the answer to look for, the sign that should make you stop, and a message you can send tonight.
- Definition
- A child's personal data: Any information that identifies your child or is linked to them: name, photo and class, marks and answers, their voice if it is recorded, and what the app logs about how they use it, such as time played and what they tapped.
The six questions, and the answer to look for
Read each question, then what a good answer sounds like, then the warning sign. The same questions work for an app you download yourself and for a platform the school uses.
| Question | A good answer sounds like | Warning sign |
|---|---|---|
| 1. What do you collect about my child? | A specific list: first name, class, answers to exercises, time spent. | “Some information to improve our service”, or a list that includes location, photos and contacts with no clear need. |
| 2. Why do you need each item? | A purpose for each item tied to the service itself: “We store answers so we can show you what they got wrong.” | A general purpose unrelated to what your child does in the app, or no purpose at all. |
| 3. Who sees it, and where is it stored? | Named roles (the teacher, the parent), named companies providing a specific service such as hosting, and the country where it is stored. | “Our partners” or “third parties” with no names, and no country. |
| 4. Do you sell it, or use it for ads? | A plain, written “no” in the privacy policy, covering targeted advertising. | No answer, or “we may share it for marketing purposes”. |
| 5. Can I see it, correct it and delete it? | A clear way to do it: a button in the settings or an address to write to, and a time frame for the request. | “That's not possible”, or a way nobody can tell you about when you ask. |
| 6. How long do you keep it, and what happens when they leave? | A set period, and deletion after they leave the school or close the account. | “We keep it” with no period, and nobody knows what happens after they leave. |
Before you accept a new app for your child
- I read the children's or students' section of the privacy policy, not just the first page.
- I found a written answer to at least questions 1, 2 and 4.
- I gave the app only what it needs: no real photo and no location unless the service needs them.
- I know where to ask for deletion if my child stops using it.
- If the app is the school's: I know who approved it there.
Why these six questions
These questions have a source. In the US, the Federal Trade Commission publishes frequently asked questions on the Children's Online Privacy Protection Act (COPPA), a US law that protects children under 13. It includes a list of what a school should ask a company before it consents on parents' behalf: what types of personal information it collects from students, how it uses that information, whether it uses or shares it for commercial purposes unrelated to the service, whether it lets the school review and delete it, what security measures protect it, and what its retention and deletion policies are.
The same page explains that the law requires companies to give parents a way to review what was collected from their child and have it deleted, and to prevent its further use or collection, and to keep the information only as long as is reasonably necessary for the purpose it was collected for. It says a school's ability to consent for parents is limited to the educational context, for the school's use and benefit and no other commercial purpose. Among the commercial purposes unrelated to the service that a school should ask about, it gives one example: using students' personal information for online behavioural advertising.
In Jordan, Personal Data Protection Law No. 24 of 2023 was set to take effect on 17 March 2024, according to a summary by the law firm Clyde & Co published on 17 October 2023. The summary says consent to processing must be clear and in writing, with a specified period and purpose, in clear and plain language. It lists the data subject's rights to access their data, correct it, have it erased under conditions set by the law, withdraw consent, and object to processing and profiling that are no longer necessary, and says personal data may not be transferred outside Jordan where the recipient's level of protection is lower than the law's, except in listed cases. That summary was written when the law was issued, so ask the school or company which law it applies to your child's data.
If the app uses AI, we suggest adding to question 2: is my child's data used to train the model? UNICEF lists “Protect children's data and privacy” among the ten requirements in its Guidance on AI and children (version 3.0, December 2025). Laws differ from country to country; the six questions don't. Ask them wherever you live.
How to ask, and whom
Start with what is published
Open the privacy policy and search it for “children”, “students” or “minors”; you may find some of the answers there. Write what you found next to each question on the card, or “not found”.
Ask in writing about what you didn't find
Send the missing questions to the app's privacy contact or to the school office. A written answer can be kept and checked; a spoken one is forgotten.
At school, ask the leadership, not only the teacher
The teacher may not know where the platform's data is stored or who can see it. Ask whoever chose it at the school. If you are choosing a school now, these questions expand questions nine and ten of ten questions to ask before enrolling your child.
Ask your child too
Ask which apps they use in class and at home, and what they are asked to type or photograph in them. It is a good question for the weekly school check-in.
Good evening. My child, [child's name], in [class], uses [app or platform]. Could you please answer the following in writing: what data is collected about them, and why; who can access it, and in which country it is stored; whether it is sold or used for advertising; how I can see it and ask for it to be deleted; and how long it is kept, and what happens to it when they leave. Thank you, [parent's name].
String publishes its practices on its Trust Center; read it with the same six questions, as you would any other app's page.
When the answer falls short
- No answer after two weeks: ask once more, in writing, and give the date of your first message. If nothing comes back, that is your answer.
- “Yes, we share it with our partners”: ask for their names and what they do with it. If it is for advertising, look for an alternative.
- A platform the school relies on: don't keep your child out of class. Ask the school which settings reduce what is collected, give the platform only what it asks for, and keep the reply.
- An app you chose yourself: if it won't answer question 4, ask in writing for the data to be deleted, then delete the account and the app.
These questions fail when the answer is true on paper and not in practice; you cannot see what happens inside the company. But a written answer is clearer than a spoken one, and it gives you something to point to if you ever ask for deletion. Teachers have their own rules about what student data they put into AI tools; they are in seven rules for student data.
Frequently asked questions
- Do I have the right to ask for my child's data to be deleted?
- It depends on the law where you live. In Jordan, Clyde & Co's summary of the 2023 law lists the data subject's right to erasure, under conditions. In the US, COPPA requires companies to let parents review and have deleted the data of a child under 13, as the FTC page explains. Wherever you are, ask for deletion in writing.
- Do free apps sell children's data?
- The price doesn't tell you. Ask question 4 of every app, free or paid, and look for the answer in writing in the privacy policy.
- Who do I ask at school about student data privacy?
- Ask the school leadership, or whoever the school names as responsible for its platforms or data. The teacher knows how to use the platform but may not know where its data is stored or who sees it.
- What if the platform is compulsory at school?
- Don't keep your child out of lessons. Ask the six questions in writing, ask which settings reduce what is collected, give the platform only what it asks for, and keep the reply.
Sources
Every fact in this post that we did not produce ourselves comes from one of these sources.
- Complying with COPPA: Frequently Asked Questions — US Federal Trade Commission (FTC), undated, reflects the Rule as amended 2025-04-22 (read 2026-10-22)
- Jordan issues first personal data protection law — Clyde & Co, 2023-10-17
- Guidance on AI and children (version 3.0) — UNICEF Innocenti, 2025-12
Written with String's editorial team: we use AI for research and first drafts, and a person checks every fact and every source before anything is published. How we write
Founder and CEO, String
“I grew up in a house of teachers.” I spent a year designing the STEM program for one of the largest school groups in Saudi Arabia, have written curriculum by hand, trained robotics coaches and sold software into schools, then left that job to build String in Amman.
