V1 Child-Safety Compliance Plan — COPPA / FERPA for Metis School Deployments

Status: compliance planning baseline, created 2026-06-12 to close V1_V7_PLAN_SET_AUDIT_2026-06-12.md §6.2 (V1: "no COPPA/FERPA treatment although Metis ships to schools with rosters, gradebooks, and guardians"). Like the crypto review, this plan structures the obligations and the default posture; the school-tenant launch gate (§9) requires education-counsel sign-off.

1. What Metis actually collects from minors (scope of exposure)#

Grounded in the shipped spec:

• Roster data via OneRoster sync with teacher/guardian/institutional roles (V1/features.md:1246-1252, :1349, :5078-5084).
• Gradebook records: GradebookEntry per (learner, assignment, attempt) with score, mastery band, assessment mode, integrity verdict, evidence-pack ref (V1/features.md:1559-1563), emitted to LMSes via LTI AGS / xAPI / Caliper (:1566-1568).
• Academic-integrity verdicts + evidence packs, retained beyond routine retention for severe violations (V1/features.md:1500-1516).
• Tutor session content: text and voice tutoring through Psyche (V1/features.md:1232-1236), with transcripts, mastery state, misconception data (:1310-1341).
• Voiceprints: Living Scenes voice cues are identity-bound by default via speaker voiceprint (V1/features.md:3690-3693) — a biometric identifier.
• Iris memory entries scoped per user, with admin-inspection state machine and DSAR plumbing (V1/features.md:2150-2167).
• BYOM: tenant model endpoints receive learner content (V1/features.md:1522-1551).
• Living Scenes Lesson Visualizers with per-tenant share policy that already anticipates "FERPA-class regimes" (V1/features.md:4370-4371, :4384-4386).

2. Age model and gating#

• Consumer product is 13+ at V1. Neutral age gate at signup (date-of-birth entry, no "you must be 13" prompt before the field, retry-blocking on the device for 24 h after an under-13 answer). Under-13 users exist only inside institutional Metis tenants, where age/grade arrives from the roster — which also gives Oshun actual knowledge of child users in those tenants, so COPPA obligations attach there by design rather than by accident.
• Per-user age band (under13 | 13-15 | 16-17 | adult) is computed from roster DOB or signup DOB and stored on the profile; every policy below keys off this band plus region.
• Regional consent ages for teens (GDPR Art. 8 spread): DE 16, FR 15, US 13 (COPPA). The age-band policy table is region-parameterized; the teen band uses the regional digital-consent age, not a hardcoded 13.
• Enforcement points: BFF session context carries the age band; Lilith policy selection, Iris memory scoping, Psyche capability flags (voiceprint, avatar), billing (no crypto checkout for minors — payment is the school's contract, never the child's wallet), and Living Scenes share resolution all read it. A launch-gating test suite asserts each enforcement point (§9).

3. COPPA plan (under-13, US school tenants)#

• Consent basis: school authorization. Per FTC guidance, a school may authorize collection on parents' behalf where the service is used solely for the educational benefit of the school and data is not used for any commercial purpose (no ads, no profiling beyond pedagogy, no resale). The school-official DPA (§5) carries this authorization plus the school's representation that it has provided required notice to parents. Direct parental VPC is therefore not the V1 mechanism — important because the classic VPC methods (payment-card check, ID match) collide with the product's no-KYC posture.
• 2025 COPPA Rule amendments compliance (effective June 2025):
  • Written information-security program — satisfied by mapping to the existing security stack (KMS at rest, audit platform, tenant isolation, V1/DEPENDENCIES.md §24) in a named, maintained document; owner: Security Lead.
  • Public retention policy + retain-no-longer-than-necessary — §6 schedule, published in the privacy center.
  • Separate opt-in for third-party disclosure — V1 makes no third-party disclosures of child data other than school-directed LMS emission and tenant-approved BYOM (§7); both are school-directed under the DPA, and the DPA enumerates them.
  • Biometric identifiers are personal information — the Psyche voiceprint is in scope. Control: voiceprint identity-binding is disabled for the under-13 band (session-bound auth replaces it; the shared-viewing notice path at V1/features.md:3692-3693 already handles non-identity-bound sessions). No voiceprint is ever derived or stored for an under-13 user.
• Audio handling: the COPPA audio exception (collect solely as a replacement for written words, delete promptly) is adopted as the engineering rule: raw audio for under-13 sessions is deleted at session close, hard ceiling 24 h (crash-recovery buffer), retaining only the ASR transcript, which is an education record under §4. No under-13 audio is used for model improvement, voice profiles, or analytics.
• No monetization surfaces: under-13 sessions render no upsell, paywall, or crypto-invoice surface; entitlements flow from the tenant contract.

4. FERPA plan (US school tenants)#

• What counts as an education record in Metis's model (records directly related to a student, maintained by or for the school): GradebookEntry rows and their revision history; mastery state and evidence aggregations; AcademicIntegrityVerdict records and evidence packs; tutor session transcripts (text and ASR-derived); xAPI/cmi5/Caliper statements; misconception and personalization-axis data tied to an identified learner; guardian communications about a specific learner. Not education records: de-identified cohort aggregates (heatmaps), platform telemetry not linked to a learner, teacher-authored content.
• Operating basis: the school-official exception (34 CFR 99.31(a)(1)). Oshun acts as a school official with a legitimate educational interest, under direct control of the school regarding use and maintenance. The DPA (§5) implements the four conditions: (1) performs an institutional service the school would otherwise use employees for, (2) under direct control, (3) uses records only for the authorized purpose — explicitly barring product analytics on identified records beyond service operation, (4) no re-disclosure without consent (LMS emission is school-directed, so it is the school's disclosure, not Oshun's).
• Directory information policy: Metis treats nothing as directory information by default. A tenant may designate fields (name, grade level) as directory info only via an explicit Tenant Console policy, mirroring the school's own published directory policy. This drives the Living Scenes / share surfaces: student-generated Lesson Visualizers already default to tenant_internal_only (V1/features.md:4384-4386); FERPA-class tenants additionally get the outright share-deny toggle (:4370-4371) set ON by default in the school-tenant template.
• Inspection and amendment rights: parent/eligible-student access (45-day FERPA window) and amendment requests are fulfilled through the existing DSAR machinery and admin-inspection state machine (V1/features.md:2150-2167) — a dsar-fulfillment read scoped to the learner, exported via the tenant export formats (V1/features.md:5130). Amendment maps onto the existing appeal/correction paths: integrity-verdict appeals (V1/features.md:1505-1508) and gradebook.correction events (:1569-1572). No new machinery required — this mapping is itself a gate test (§9).
• Annual notification support: Oshun provides tenants template language identifying Oshun as a school official for their FERPA annual notices.

5. The school-tenant DPA (contract artifact)#

One signed artifact per institutional tenant, with state riders:

• FERPA school-official terms (§4), COPPA school-authorization terms (§3), data-use limits, no-ads/no-sale covenant, security program reference, subprocessor list (AWS, RunPod, model providers, ElevenLabs — each with the child-data rule applied: no under-13 audio leaves the Psyche boundary to ElevenLabs for voice-profile purposes; TTS synthesis of tutor output to a child is fine, cloning/training is not).
• State riders: NY Ed Law 2-d (Parents' Bill of Rights + supplemental information published per contract, encryption in transit/at rest — already met), Illinois SOPPA (district-published agreement + data-element list), California SOPIPA/AB 1584, Colorado Student Data Transparency. Deliverable: a rider matrix maintained by Counsel; the Tenant Console onboarding flow blocks activation of a school tenant in a state whose rider is unsigned.
• International note: non-US school tenants run under GDPR Art. 28 processor terms instead; UK tenants additionally get an ICO Children's Code (AADC) conformance statement (age-appropriate defaults: §§2–3 controls are the same mechanics).

6. Data-retention schedule for minors#

Tenant retention policy already exists (30-day / 1-year / indefinite, V1/features.md:4374-4376); for minor learners it is bounded above by this schedule (tenant may shorten, never lengthen):

All retention timers are enforced by scheduled jobs with audit-platform records; the nightly cascade-reach audit pattern (V1/features.md:4363-4364) extends to retention-expiry sweeps. Planning assumptions adopted 2026-06-12: the "school year + 90 days" and "12 months" figures are sector-standard defaults pending counsel/tenant review — chosen to cover grade-appeal windows without indefinite holding.

7. BYOM restrictions for under-13 cohorts#

BYOM endpoints receive learner content (V1/features.md:1522-1551), making the tenant's model provider a subprocessor of children's data:

• Default-deny: a BYOM endpoint cannot be attached to any course/cohort containing under-13 learners unless the tenant has executed the child-data BYOM rider: provider identity, no-training/no-retention attestation, data-residency declaration (the onboarding fields at V1/features.md:1528-1531 already capture residency and audit hooks — the rider adds the contractual attestation), and breach-notification chain.
• Platform enforcement, not paperwork alone: the BYOM sandbox tags every call with the cohort's age-band; calls carrying under13 context to an endpoint without the rider flag are refused fail-closed (consistent with V1/features.md:1543-1546). Kill-switch ≤ 5 s and quarantine behavior (:1590-1591) are unchanged.
• Full request/response logging for BYOM (V1/features.md:1533-1535) is itself child data — those logs inherit the §6 transcript retention bound.

8. Incident response for minor data#

FERPA has no breach-notification clock, but state student-privacy laws and the DPA do. The Metis institutional-data-incident runbook (RISK_REGISTER R-06) includes:

• Severity classing: any confirmed cross-tenant exposure of education records = Sev-1; single-tenant exposure = Sev-2 minimum.
• Notification matrix: tenant operator immediately; affected school within 72 h contractual default; state-specific clocks (e.g., NY 2-d requires notification to the district "in the most expedient way possible") tracked per rider; guardians are notified by the school, with Oshun providing the factual packet — Oshun never contacts minors directly.
• Evidence preservation through the audit platform; regulator-ready export via the existing DSAR/export tooling.

9. Launch gates this plan adds#

School tenants are a separately gated launch wave (LAUNCH_TIMELINE Phase 2 wave 3). The gate — decision owner Education Compliance Officer, co-sign Metis Product Lead and Privacy Lead — requires all of:

1. DPA + rider kit executed-ready (template + NY/IL/CA/CO riders reviewed by education counsel; Tenant Console blocks unsigned-rider states).
2. COPPA-mode test suite green: under-13 band disables voiceprint binding, monetization surfaces, non-pedagogy Iris categories; audio deletion timer verified with fixture sessions; all assertions in the launch-gating suite alongside tests/security/tenant-isolation/.
3. FERPA flow demo: a fixture parent-access request fulfilled end-to-end through the DSAR machinery in < 45 days (target ≤ 10 business days); amendment round-trip via verdict appeal + gradebook.correction.
4. Retention timers live: §6 schedule enforced by jobs with audit records; expiry sweep report exists.
5. BYOM child-data enforcement test: under13-context call to a rider-less endpoint refused; kill-switch ≤ 5 s re-verified.
6. Share-policy defaults: school-tenant template ships share-deny ON, tenant_internal_only ceilings verified (V1/features.md:4370-4386).
7. Incident runbook drill (§8) executed once against a fixture tenant.
8. Security program document (§3, 2025 COPPA amendment) signed by Security Lead.

No school tenant activates before this gate passes — even if GA has shipped for consumer users. Conversely, consumer GA is not blocked by this gate (the consumer product is 13+ by §2).

10. Ownership#