Children's privacy

COPPA and children's voice recordings

A recording of a child's voice is personal information under the Children's Online Privacy Protection Act. The COPPA Rule lists “a photograph, video, or audio file where such file contains a child's image or voice” directly in its definition, which means any product that records a child saying a word is collecting regulated data from the first recording onward — and needs verifiable parental consent before it does.

Why voice is covered

COPPA applies to operators of online services directed at children under 13, and to operators with actual knowledge that they are collecting information from a child under 13. The question people usually get wrong is whether a voice recording counts as personal information at all. It does, twice over.

The Rule's definition of personal information at 16 CFR 312.2 includes “a photograph, video, or audio file where such file contains a child's image or voice”. It separately includes biometric identifiers “such as ... voiceprints”. Neither requires the recording to contain the child's name, address, or any other identifier. The voice itself is the covered data.

The audio-file exception, and why it does not apply here

There is a narrow FTC enforcement policy statement about audio, issued in 2017, that is frequently cited by products that should not be relying on it.

The policy statement says the FTC will not take enforcement action over the parental consent requirement where an operator collects audio solely as a replacement for written words, such as to perform a search or fulfill a verbal instruction or request, and only maintains the file for the brief time necessary for that purpose. It explicitly does not cover audio used for identification through voice recognition, and it does not cover retention beyond that brief window.

What the Rule requires of you

If you build a children's product on any speech API, including this one, you are the operator and these obligations are yours.

Post a clear, complete privacy notice describing what you collect from children, how you use it, whether you disclose it to third parties, and how a parent can review or delete it.
Give direct notice to parents before collecting anything, rather than relying on the general privacy policy alone.
Obtain verifiable parental consent before collection begins. The rule specifies acceptable methods; a checkbox that says “I am over 13” is not one of them.
Let parents review and delete their child's information, and refuse further collection, without conditioning the child's participation on providing more data than is reasonably necessary.
Retain the data only as long as necessary for the purpose it was collected for, then delete it securely.
Maintain reasonable security, and take steps to ensure any service provider you pass the data to can do the same.

There is no such thing as COPPA certification

This matters because the phrase appears on a lot of vendor websites. The FTC does not certify anyone as COPPA compliant. There are only two defensible postures: general self-assessed compliance with the Rule at 16 CFR Part 312, which the FTC enforces after the fact; or active membership in good standing of an FTC-approved Safe Harbor program — currently CARU, ESRB, iKeepSafe, kidSAFE, PRIVO, and TRUSTe.

The FTC has taken enforcement action against a company for continuing to claim it was “certified as COPPA compliant” after its Safe Harbor membership lapsed. So the practical advice, which cuts against us as much as anyone: when a vendor tells you they are COPPA certified, ask which Safe Harbor program and check that the membership is current. ArticScore does not claim certification. We describe our practices below and put them in writing in the agreement.

How ArticScore approaches child audio

Audio is processed for scoring, not for identification. ArticScore does not perform voice recognition, speaker identification, or voiceprint matching, and does not build speaker profiles from customer audio.
The integrator is the operator. If you build a product on ArticScore, you are the party with the direct relationship with the child and the family, which means the notice and consent obligations are yours. We provide the processing; we do not stand between you and the parent.
API audio is never retained. Audio sent to the ArticScore API is scored and deleted. That is how the API is built, not a default you can change: there is no setting, plan or agreement under which we keep it.
Partner audio is never used for training. Because API audio is not kept, it cannot be used to improve the model. The engine's published fine-tuning was done on licensed public research corpora, documented on the benchmark page.
Data processing terms are available. SpeechTherapyMagic maintains a published data processing agreement and subprocessor list for its own platform, and ArticScore access includes equivalent written terms.

SpeechTherapyMagic's existing privacy policy, data processing agreement, and subprocessor list are published and are the starting point for ArticScore terms.

What we actually do with a recording

The section above is how we approach the question. This is the answer — what happens to a child's audio today, on both surfaces, stated plainly enough that you can hold us to it.

Audio is processed and then deleted. A recording is uploaded, scored, and discarded along with the request that carried it. What we keep is the score — the per-phoneme numbers and error flags — not the sound.
Scores are retained; that is the product. Progress over time is what a parent or a therapist actually watches, and it is derived from scores rather than from stored audio.
Inside the SpeechTherapyMagic app, recordings are kept only with a documented consent basis. There are two. A guardian can sign a media release that specifically authorizes keeping practice recordings to improve scoring accuracy; it is its own item on the form, separate from every publicity permission, and unticked by default. Or a speech-language pathologist who uses the app with their own clients can ask us to keep the recordings of the practice they run; we switch that on for the clinician's account only, and every recording kept under it is marked with that basis. Without one of the two, nothing is kept.
Consent can be withdrawn, and withdrawal deletes the recordings. Revoking a media release destroys the audio already retained under it, files and records alike, and a clinician who asks us to stop can have their kept recordings deleted. Deleting a child's profile or the account deletes that child's recordings as well, and no recording is kept for more than two years.
Audio submitted through the ArticScore developer API is never retained. Partner traffic is scored and dropped, without exception. A partner's end users never saw our consent form, and an API key holder cannot consent on a stranger's child's behalf — so the API surface has no path to retention at all, whatever that key's own account may have signed.
Scoring happens on our own servers. Every recording, from the SpeechTherapyMagic app or the developer API, is scored by ArticScore running on infrastructure we operate. It is not sent to a third-party speech-scoring service, and if ArticScore is unavailable the request fails and can be retried; it is never handed to another engine instead.

Practical notes for building on a speech API

Collect the minimum, and say what you keep

Scoring needs the audio and the target word. It does not need the child's full name, their school, or their date of birth to be attached to the recording. Keeping the identity and the audio in separate places, joined by an identifier you control, is both better privacy practice and easier to explain to a school.

Decide retention deliberately

Progress tracking is the reason products keep recordings, and it is a legitimate reason — but it is a decision, not a default. Ask whether you need the audio or only the scores derived from it. Storing scores and discarding audio after processing preserves most of the product value and removes most of the risk.

Remember children do not need accounts

The lowest-risk design in this category is one where the adult holds the account and the child simply speaks into it. SpeechTherapyMagic's own platform is built that way — children never create accounts — and it removes an entire category of consent and identity problem.

Children's privacy questions

Is a child's voice recording personal information under COPPA?

Yes. The COPPA Rule's definition of personal information at 16 CFR 312.2 explicitly includes "a photograph, video, or audio file where such file contains a child's image or voice", and separately includes biometric identifiers such as voiceprints. A recording of a child speaking is covered whether or not it contains their name.

Does the FTC's audio-file exception apply to a pronunciation scoring app?

Almost certainly not. The FTC's 2017 enforcement policy statement says it will not take action over the parental consent requirement where audio is collected solely as a replacement for written words — to perform a search or fulfil a verbal instruction — and is kept only for the brief time necessary for that purpose. A pronunciation scoring product analyses the child's voice as the subject of the interaction rather than as a substitute for typing, and typically retains recordings for progress tracking. Both of those fall outside the exception, so the full notice and verifiable parental consent requirements apply.

Is ArticScore COPPA certified?

There is no such thing as COPPA certification, and any vendor claiming it should be asked what they mean. The FTC does not certify products. The only formal status that exists is membership in good standing of an FTC-approved Safe Harbor program under 16 CFR 312.11 — CARU, ESRB, iKeepSafe, kidSAFE, PRIVO, or TRUSTe. The FTC has brought enforcement action against a company for claiming COPPA certification after its Safe Harbor membership had lapsed. We are not making a certification claim; we describe our practices and our contractual terms, and we recommend you evaluate them on that basis.

Who is responsible for parental consent — us or ArticScore?

If you operate the product a child uses, you are the operator under COPPA and the notice and consent obligations are yours. ArticScore processes audio on your behalf. That does not remove our obligations to handle the data properly, and it does not transfer yours to us. This division should be written into the agreement between us rather than assumed.

What about FERPA and school deployments?

If you deploy through a school, a different framework often applies: student records are covered by FERPA, several US states have their own student privacy statutes, and schools frequently rely on the school-consent mechanism the FTC recognises for educational use. School procurement will normally want a data processing agreement and a subprocessor list. This is a question to route through your own counsel, and the specifics belong in a contract rather than on a web page.

Do you use our audio to train your models?

No. Audio submitted through the developer API is scored and deleted, never retained, so it cannot be used for training. The published fine-tuning behind ArticScore's benchmark figures was carried out on licensed public research corpora, which are named on the benchmark page along with their licensing terms.

Does SpeechTherapyMagic keep recordings from its own app?

Only with a documented consent basis. Practice recordings are deleted immediately after scoring by default. A guardian can authorize keeping them through a media release, where it is its own item, separate from the publicity permissions and unticked unless the guardian ticks it. A speech-language pathologist who uses the app with their own clients can also ask us to keep the recordings of the practice they run; that arrangement is recorded on their account and on every recording kept under it. Retained recordings are stored privately, are never published or shown to other families, and are not used to identify a child. They are deleted when the release is revoked or the clinician asks, when the child's profile or the account is deleted, and in any case two years after they were made. This applies to the SpeechTherapyMagic app only — audio submitted through the ArticScore developer API is never retained under any circumstances.