Minors’ Data in Educational Apps: What the LGPD Requires of Schools

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

When schools, educational technology platforms, and children’s apps process the personal data of children and teenagers, they must follow specific safeguards set out in Brazil’s General Data Protection Law (LGPD) and detailed in the guidelines of the National Data Protection Authority. Failing to comply exposes institutions to administrative sanctions, civil liability, and reputational harm that undermines families’ trust.

What the LGPD requires for children’s and teenagers’ data

Law 13.709/2018 sets apart the data of children (under 12 years of age) and teenagers (12 to 18). Article 14 requires that this data always be processed in the best interest of the data subject, a principle borrowed from the Statute of the Child and Adolescent (Estatuto da Criança e do Adolescente). Following the law’s general rules is not enough: the institution must be able to show that each act of data collection concretely serves the minor’s well-being.

This heightened duty of care applies to any organization that handles student information. Preschools and elementary schools, remote learning platforms, developers of gaming and reading apps, and the educational technology companies hired by school systems are all “processing agents,” and each is answerable for the data it collects.

The law treats as personal data any information that can identify a child, such as name, image, voice, geolocation, academic performance, and browsing habits. When the processing involves health data, racial or ethnic origin, or biometrics, the data falls into the category of sensitive data, which receives additional protection and narrows the legal grounds on which it may be used.

Parental consent and the purpose of processing

The core of Article 14 is consent. For children’s data, the rule requires specific, prominent authorization given by at least one parent or legal guardian. Generic consent buried in lengthy terms of use or obtained through pre-checked boxes does not meet the legal requirement and may be invalidated.

The institution must make reasonable efforts to verify that the person giving consent is actually the guardian, taking the available technology into account. This duty to verify grows with the risk of the processing: the more sensitive the information collected, the more rigorous the identity check on the person consenting should be.

The purpose must be explained clearly, simply, and accessibly, taking into account the physical, motor, and cognitive characteristics of young users. The National Data Protection Authority’s guidelines call for information to be presented in age-appropriate language, with visual aids where possible, so that both the child and the guardian understand what will be done with the data.

There is also an important exception. Collecting a child’s data may not require consent when it is necessary to contact the parents, provided it is used only once and not stored, or when it is necessary to protect the minor. Outside these narrow situations, the guardian’s authorization remains indispensable.

The ban on commercial use and the impact report

One of the strictest limits in the law concerns commercial exploitation. A child’s participation in games, internet applications, or other activities may not be conditioned on providing more personal information than is strictly necessary. Excessive collection driven by marketing interests or the monetization of profiles directly violates the principle of necessity.

Platforms that target advertising based on students’ behavior, or that pass contact lists on to commercial partners, face a high risk of enforcement action. A child’s best interest cannot coexist with turning school data into an advertising asset.

A school that outsources its technology does not outsource its responsibility: it remains answerable for the data families entrust to it.

For higher-risk processing, preparing a data protection impact report becomes practically important. This document describes the collection processes, the security measures in place, and the mechanisms for mitigating risks to data subjects’ rights. Although the law provides that the authority may request the report, keeping it up to date serves as proof of diligence and helps the institution identify vulnerabilities before they turn into incidents.

The report also informs decisions about which tools to adopt. Before contracting a new educational platform, school management can assess whether the vendor collects only what is necessary, where the data is hosted, and what security guarantees the contract provides.

Joint liability for schools that outsource services

The digitization of education has led many institutions to hire specialized companies for electronic gradebooks, virtual learning environments, and apps for communicating with families. Outsourcing does not relieve the school of responsibility. When the school acts as the controller, defining the purposes of the processing, it is liable for harm caused to data subjects, even if the failure occurred in the vendor’s operations.

The LGPD provides for joint and several liability between controllers and operators in certain circumstances, which allows an injured family to seek compensation from the school, the contracted company, or both. For that reason, the relationship between the parties should be set out in a contract that allocates obligations, defines security measures, and establishes notification duties in the event of an incident.

Choosing a vendor carefully is part of the duty of care. Contracting with a platform that cannot demonstrate compliance, that hosts data without adequate safeguards, or that reserves the right to exploit students’ information commercially shifts onto the school a risk that could have been avoided at the selection stage.

Compliance checklist for school administrators

To reduce risk and show good faith in the event of an inspection, administrators can adopt a set of practical measures. The checklist below summarizes the main points to watch when processing student data:

• Map all the data collected from students, identifying which is personal and which is sensitive.
• Obtain specific, prominent consent from guardians, in clear, age-appropriate language.
• Collect only what is necessary, avoiding unnecessary fields in enrollment forms and apps.
• Review contracts with technology vendors, requiring data protection clauses and a ban on commercial use.
• Appoint a data protection officer (encarregado), the person responsible for handling requests from data subjects and from the authority.
• Prepare an impact report for higher-risk processing and keep it up to date.
• Establish an incident response plan, with deadlines and communication channels to families and the competent authority.
• Train teachers and administrative staff in the safe handling of student information.

Adopting these practices is not just a bureaucratic formality. It builds an institutional culture of respect for privacy that protects students and shields the school from lawsuits and penalties. As technology becomes central to education, compliance is no longer a competitive advantage but a condition of operating.

Frequently Asked Questions

Does a school need parents’ consent to post a student’s photo on social media?

Yes. A child’s image is personal data, and using it on social media, bulletin boards, or promotional materials requires specific, prominent consent from at least one guardian. The generic authorization signed at enrollment generally does not cover this purpose, which must be disclosed separately and clearly.

Can educational apps use students’ data for advertising?

No. The law prohibits conditioning a child’s participation on providing more data than necessary, and it bars commercial exploitation that is contrary to the child’s best interest. Platforms that target advertising based on students’ behavior face a high risk of enforcement action and civil liability.

Who is liable if there is a data leak on a platform the school contracted?

The school, as the data controller, remains responsible to the families even if the failure occurred at the outsourced company. The law allows joint and several liability between the school and the vendor, which lets the injured data subject seek compensation from any of the parties involved in the processing.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.