# V1 Child-Safety Compliance Plan — COPPA / FERPA for Metis School Deployments Status: compliance planning baseline, created 2026-06-12 to close `V1_V7_PLAN_SET_AUDIT_2026-06-12.md` §6.2 (V1: "no COPPA/FERPA treatment although Metis ships to schools with rosters, gradebooks, and guardians"). Like the crypto review, this plan structures the obligations and the default posture; the school-tenant launch gate (§9) requires education-counsel sign-off. ## 1. What Metis actually collects from minors (scope of exposure) Grounded in the shipped spec: - **Roster data** via OneRoster sync with teacher/guardian/institutional roles (`V1/features.md:1246-1252`, `:1349`, `:5078-5084`). - **Gradebook records**: `GradebookEntry` per (learner, assignment, attempt) with score, mastery band, assessment mode, integrity verdict, evidence-pack ref (`V1/features.md:1559-1563`), emitted to LMSes via LTI AGS / xAPI / Caliper (`:1566-1568`). - **Academic-integrity verdicts + evidence packs**, retained beyond routine retention for severe violations (`V1/features.md:1500-1516`). - **Tutor session content**: text and **voice** tutoring through Psyche (`V1/features.md:1232-1236`), with transcripts, mastery state, misconception data (`:1310-1341`). - **Voiceprints**: Living Scenes voice cues are identity-bound by default via speaker voiceprint (`V1/features.md:3690-3693`) — a biometric identifier. - **Iris memory** entries scoped per user, with admin-inspection state machine and DSAR plumbing (`V1/features.md:2150-2167`). - **BYOM**: tenant model endpoints receive learner content (`V1/features.md:1522-1551`). - **Living Scenes Lesson Visualizers** with per-tenant share policy that already anticipates "FERPA-class regimes" (`V1/features.md:4370-4371`, `:4384-4386`). ## 2. Age model and gating - **Consumer product is 13+ at V1.** Neutral age gate at signup (date-of-birth entry, no "you must be 13" prompt before the field, retry-blocking on the device for 24 h after an under-13 answer). Under-13 users exist **only** inside institutional Metis tenants, where age/grade arrives from the roster — which also gives Oshun _actual knowledge_ of child users in those tenants, so COPPA obligations attach there by design rather than by accident. - **Per-user age band** (`under13 | 13-15 | 16-17 | adult`) is computed from roster DOB or signup DOB and stored on the profile; every policy below keys off this band plus region. - **Regional consent ages for teens** (GDPR Art. 8 spread): DE 16, FR 15, US 13 (COPPA). The age-band policy table is region-parameterized; the teen band uses the regional digital-consent age, not a hardcoded 13. - **Enforcement points**: BFF session context carries the age band; Lilith policy selection, Iris memory scoping, Psyche capability flags (voiceprint, avatar), billing (no crypto checkout for minors — payment is the school's contract, never the child's wallet), and Living Scenes share resolution all read it. A launch-gating test suite asserts each enforcement point (§9). ## 3. COPPA plan (under-13, US school tenants) - **Consent basis: school authorization.** Per FTC guidance, a school may authorize collection on parents' behalf where the service is used solely for the educational benefit of the school and data is not used for any commercial purpose (no ads, no profiling beyond pedagogy, no resale). The school-official DPA (§5) carries this authorization plus the school's representation that it has provided required notice to parents. Direct parental VPC is therefore **not** the V1 mechanism — important because the classic VPC methods (payment-card check, ID match) collide with the product's no-KYC posture. - **2025 COPPA Rule amendments compliance** (effective June 2025): - **Written information-security program** — satisfied by mapping to the existing security stack (KMS at rest, audit platform, tenant isolation, `V1/DEPENDENCIES.md` §24) in a named, maintained document; owner: Security Lead. - **Public retention policy + retain-no-longer-than-necessary** — §6 schedule, published in the privacy center. - **Separate opt-in for third-party disclosure** — V1 makes no third-party disclosures of child data other than school-directed LMS emission and tenant-approved BYOM (§7); both are school-directed under the DPA, and the DPA enumerates them. - **Biometric identifiers are personal information** — the Psyche voiceprint is in scope. **Control: voiceprint identity-binding is disabled for the under-13 band** (session-bound auth replaces it; the shared-viewing notice path at `V1/features.md:3692-3693` already handles non-identity-bound sessions). No voiceprint is ever derived or stored for an under-13 user. - **Audio handling:** the COPPA audio exception (collect solely as a replacement for written words, delete promptly) is adopted as the engineering rule: **raw audio for under-13 sessions is deleted at session close, hard ceiling 24 h** (crash-recovery buffer), retaining only the ASR transcript, which is an education record under §4. No under-13 audio is used for model improvement, voice profiles, or analytics. - **No monetization surfaces**: under-13 sessions render no upsell, paywall, or crypto-invoice surface; entitlements flow from the tenant contract. ## 4. FERPA plan (US school tenants) - **What counts as an education record in Metis's model** (records directly related to a student, maintained by or for the school): `GradebookEntry` rows and their revision history; mastery state and evidence aggregations; `AcademicIntegrityVerdict` records _and evidence packs_; tutor session transcripts (text and ASR-derived); xAPI/cmi5/Caliper statements; misconception and personalization-axis data tied to an identified learner; guardian communications about a specific learner. **Not** education records: de-identified cohort aggregates (heatmaps), platform telemetry not linked to a learner, teacher-authored content. - **Operating basis: the school-official exception** (34 CFR 99.31(a)(1)). Oshun acts as a school official with a legitimate educational interest, under **direct control** of the school regarding use and maintenance. The DPA (§5) implements the four conditions: (1) performs an institutional service the school would otherwise use employees for, (2) under direct control, (3) uses records only for the authorized purpose — explicitly barring product analytics on identified records beyond service operation, (4) no re-disclosure without consent (LMS emission is school-directed, so it is the school's disclosure, not Oshun's). - **Directory information policy:** Metis treats **nothing as directory information by default**. A tenant may designate fields (name, grade level) as directory info only via an explicit Tenant Console policy, mirroring the school's own published directory policy. This drives the Living Scenes / share surfaces: student-generated Lesson Visualizers already default to `tenant_internal_only` (`V1/features.md:4384-4386`); FERPA-class tenants additionally get the outright share-deny toggle (`:4370-4371`) set ON by default in the school-tenant template. - **Inspection and amendment rights:** parent/eligible-student access (45-day FERPA window) and amendment requests are fulfilled through the existing DSAR machinery and admin-inspection state machine (`V1/features.md:2150-2167`) — a `dsar-fulfillment` read scoped to the learner, exported via the tenant export formats (`V1/features.md:5130`). Amendment maps onto the existing appeal/correction paths: integrity-verdict appeals (`V1/features.md:1505-1508`) and `gradebook.correction` events (`:1569-1572`). No new machinery required — this mapping is itself a gate test (§9). - **Annual notification support:** Oshun provides tenants template language identifying Oshun as a school official for their FERPA annual notices. ## 5. The school-tenant DPA (contract artifact) One signed artifact per institutional tenant, with state riders: - FERPA school-official terms (§4), COPPA school-authorization terms (§3), data-use limits, no-ads/no-sale covenant, security program reference, subprocessor list (AWS, RunPod, model providers, ElevenLabs — each with the child-data rule applied: **no under-13 audio leaves the Psyche boundary to ElevenLabs for voice-profile purposes; TTS synthesis of tutor output to a child is fine, cloning/training is not**). - **State riders:** NY Ed Law 2-d (Parents' Bill of Rights + supplemental information published per contract, encryption in transit/at rest — already met), Illinois SOPPA (district-published agreement + data-element list), California SOPIPA/AB 1584, Colorado Student Data Transparency. Deliverable: a rider matrix maintained by Counsel; the Tenant Console onboarding flow blocks activation of a school tenant in a state whose rider is unsigned. - **International note:** non-US school tenants run under GDPR Art. 28 processor terms instead; UK tenants additionally get an ICO Children's Code (AADC) conformance statement (age-appropriate defaults: §§2–3 controls are the same mechanics). ## 6. Data-retention schedule for minors Tenant retention policy already exists (30-day / 1-year / indefinite, `V1/features.md:4374-4376`); for minor learners it is **bounded above** by this schedule (tenant may shorten, never lengthen): | Data class | Retention (minor learners) | Disposal | | --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------ | | Raw voice audio (under-13) | session close, ≤ 24 h ceiling | hard delete (§3) | | Raw voice audio (13–17) | ≤ 30 days | hard delete | | Tutor transcripts | school year + 90 days, unless tenant directs shorter | hard delete + Iris cascade | | GradebookEntry + mastery state | life of tenant contract | returned/deleted ≤ 90 days post-termination with certificate of deletion | | Integrity evidence packs (clear/inconclusive) | 12 months | hard delete | | Integrity evidence packs (violation/severe) | per tenant policy, min 12 months — the spec's "beyond routine retention" (`V1/features.md:1503-1504`) gets this explicit bound | tenant-directed | | xAPI/Caliper statements held by Oshun | 24 months rolling | aggregate-then-delete | | Iris memory entries (under-13) | pedagogy-scoped categories only; school year + 90 days | existing Iris deletion cascade (`V1/features.md:2179-2181`) | | Living Scenes kept artifacts (school tenants) | tenant retention policy; default 1 year | takedown cascade (`V1/features.md:4361-4364`) | All retention timers are enforced by scheduled jobs with audit-platform records; the nightly cascade-reach audit pattern (`V1/features.md:4363-4364`) extends to retention-expiry sweeps. Planning assumptions adopted 2026-06-12: the "school year + 90 days" and "12 months" figures are sector-standard defaults pending counsel/tenant review — chosen to cover grade-appeal windows without indefinite holding. ## 7. BYOM restrictions for under-13 cohorts BYOM endpoints receive learner content (`V1/features.md:1522-1551`), making the tenant's model provider a subprocessor of children's data: - **Default-deny:** a BYOM endpoint cannot be attached to any course/cohort containing under-13 learners unless the tenant has executed the **child-data BYOM rider**: provider identity, no-training/no-retention attestation, data-residency declaration (the onboarding fields at `V1/features.md:1528-1531` already capture residency and audit hooks — the rider adds the contractual attestation), and breach-notification chain. - **Platform enforcement, not paperwork alone:** the BYOM sandbox tags every call with the cohort's age-band; calls carrying `under13` context to an endpoint without the rider flag are refused fail-closed (consistent with `V1/features.md:1543-1546`). Kill-switch ≤ 5 s and quarantine behavior (`:1590-1591`) are unchanged. - **Full request/response logging** for BYOM (`V1/features.md:1533-1535`) is itself child data — those logs inherit the §6 transcript retention bound. ## 8. Incident response for minor data FERPA has no breach-notification clock, but state student-privacy laws and the DPA do. The Metis institutional-data-incident runbook (RISK_REGISTER R-06) includes: - Severity classing: any confirmed cross-tenant exposure of education records = Sev-1; single-tenant exposure = Sev-2 minimum. - Notification matrix: tenant operator immediately; affected school within 72 h contractual default; state-specific clocks (e.g., NY 2-d requires notification to the district "in the most expedient way possible") tracked per rider; guardians are notified **by the school**, with Oshun providing the factual packet — Oshun never contacts minors directly. - Evidence preservation through the audit platform; regulator-ready export via the existing DSAR/export tooling. ## 9. Launch gates this plan adds School tenants are a **separately gated launch wave** (LAUNCH_TIMELINE Phase 2 wave 3). The gate — decision owner **Education Compliance Officer**, co-sign Metis Product Lead and Privacy Lead — requires all of: 1. **DPA + rider kit executed-ready** (template + NY/IL/CA/CO riders reviewed by education counsel; Tenant Console blocks unsigned-rider states). 2. **COPPA-mode test suite green**: under-13 band disables voiceprint binding, monetization surfaces, non-pedagogy Iris categories; audio deletion timer verified with fixture sessions; all assertions in the launch-gating suite alongside `tests/security/tenant-isolation/`. 3. **FERPA flow demo**: a fixture parent-access request fulfilled end-to-end through the DSAR machinery in < 45 days (target ≤ 10 business days); amendment round-trip via verdict appeal + `gradebook.correction`. 4. **Retention timers live**: §6 schedule enforced by jobs with audit records; expiry sweep report exists. 5. **BYOM child-data enforcement test**: `under13`-context call to a rider-less endpoint refused; kill-switch ≤ 5 s re-verified. 6. **Share-policy defaults**: school-tenant template ships share-deny ON, `tenant_internal_only` ceilings verified (`V1/features.md:4370-4386`). 7. **Incident runbook drill** (§8) executed once against a fixture tenant. 8. **Security program document** (§3, 2025 COPPA amendment) signed by Security Lead. No school tenant activates before this gate passes — even if GA has shipped for consumer users. Conversely, consumer GA is **not** blocked by this gate (the consumer product is 13+ by §2). ## 10. Ownership | Role | Owns | | ---------------------------- | --------------------------------------------------------------------------- | | Education Compliance Officer | gate decision, DPA kit, rider matrix, FTC/ED regulatory watch | | Metis Product Lead | enforcement-point implementation, gradebook/FERPA mapping | | Privacy Lead (DPO) | retention schedule, DSAR/FERPA flows, GDPR/AADC variants | | Safety Lead (Lilith) | minor-specific tone/crisis policy bands, guardian-notification policy hooks | | Security Lead | written information-security program, breach runbook | | Tenant Success Lead | school onboarding flow, annual-notification templates |