Children's privacy

COPPA and children's voice recordings

A recording of a child's voice is personal information under the Children's Online Privacy Protection Act. The COPPA Rule lists “a photograph, video, or audio file where such file contains a child's image or voice” directly in its definition, which means any product that records a child saying a word is collecting regulated data from the first recording onward — and needs verifiable parental consent before it does.

Why voice is covered

COPPA applies to operators of online services directed at children under 13, and to operators with actual knowledge that they are collecting information from a child under 13. The question people usually get wrong is whether a voice recording counts as personal information at all. It does, twice over.

The Rule's definition of personal information at 16 CFR 312.2 includes “a photograph, video, or audio file where such file contains a child's image or voice”. It separately includes biometric identifiers “such as ... voiceprints”. Neither requires the recording to contain the child's name, address, or any other identifier. The voice itself is the covered data.

The audio-file exception, and why it does not apply here

There is a narrow FTC enforcement policy statement about audio, issued in 2017, that is frequently cited by products that should not be relying on it.

The policy statement says the FTC will not take enforcement action over the parental consent requirement where an operator collects audio solely as a replacement for written words, such as to perform a search or fulfill a verbal instruction or request, and only maintains the file for the brief time necessary for that purpose. It explicitly does not cover audio used for identification through voice recognition, and it does not cover retention beyond that brief window.

What the Rule requires of you

If you build a children's product on any speech API, including this one, you are the operator and these obligations are yours.

Post a clear, complete privacy notice describing what you collect from children, how you use it, whether you disclose it to third parties, and how a parent can review or delete it.
Give direct notice to parents before collecting anything, rather than relying on the general privacy policy alone.
Obtain verifiable parental consent before collection begins. The rule specifies acceptable methods; a checkbox that says “I am over 13” is not one of them.
Let parents review and delete their child's information, and refuse further collection, without conditioning the child's participation on providing more data than is reasonably necessary.
Retain the data only as long as necessary for the purpose it was collected for, then delete it securely.
Maintain reasonable security, and take steps to ensure any service provider you pass the data to can do the same.

There is no such thing as COPPA certification

This matters because the phrase appears on a lot of vendor websites. The FTC does not certify anyone as COPPA compliant. There are only two defensible postures: general self-assessed compliance with the Rule at 16 CFR Part 312, which the FTC enforces after the fact; or active membership in good standing of an FTC-approved Safe Harbor program — currently CARU, ESRB, iKeepSafe, kidSAFE, PRIVO, and TRUSTe.

The FTC has taken enforcement action against a company for continuing to claim it was “certified as COPPA compliant” after its Safe Harbor membership lapsed. So the practical advice, which cuts against us as much as anyone: when a vendor tells you they are COPPA certified, ask which Safe Harbor program and check that the membership is current. ArticScore does not claim certification. We describe our practices below and put them in writing in the agreement.

How ArticScore approaches child audio

Audio is processed for scoring, not for identification. ArticScore does not perform voice recognition, speaker identification, or voiceprint matching, and does not build speaker profiles from customer audio.
The integrator is the operator. If you build a product on ArticScore, you are the party with the direct relationship with the child and the family, which means the notice and consent obligations are yours. We provide the processing; we do not stand between you and the parent.
Nothing is retained by default. API audio is scored and deleted; that is the behaviour, not an option you have to ask for. If your deployment needs something different, it gets agreed in writing rather than inferred from a marketing page.
Training use is opt-in and explicit. Customer audio is not used to improve the model unless that is separately and specifically agreed. The engine's published fine-tuning was done on licensed public research corpora, documented on the benchmark page.
Data processing terms are available. SpeechTherapyMagic maintains a published data processing agreement and subprocessor list for its own platform, and ArticScore access includes equivalent written terms.

SpeechTherapyMagic's existing privacy policy, data processing agreement, and subprocessor list are published and are the starting point for ArticScore terms.

What we actually do with a recording

The section above is how we approach the question. This is the answer — what happens to a child's audio today, on both surfaces, stated plainly enough that you can hold us to it.

Audio is processed and then deleted. A recording is uploaded, scored, and discarded along with the request that carried it. What we keep is the score — the per-phoneme numbers and error flags — not the sound.
Scores are retained; that is the product. Progress over time is what a parent or a therapist actually watches, and it is derived from scores rather than from stored audio.
Inside the SpeechTherapyMagic app, recordings are kept only with signed guardian consent. A guardian has to sign a media release that specifically authorizes practice recordings being kept to improve scoring accuracy. It is its own item on the form, separate from every publicity permission, and unticked by default. No signature, no retention.
That consent is revocable, and revoking it deletes the recordings. Withdrawal is not merely a stop on future collection: revoking the release destroys the audio already retained under it, files and records alike.
Audio submitted through the ArticScore developer API is never retained. Partner traffic is scored and dropped, without exception. A partner's end users never saw our consent form, and an API key holder cannot consent on a stranger's child's behalf — so the API surface has no path to retention at all, whatever that key's own account may have signed.
SpeechAce-engine calls are processed by SpeechAce under their privacy policy. When a request is served by the SpeechAce engine, the audio goes to SpeechAce as a subprocessor. It travels with a freshly generated random identifier rather than any account or child identifier, so a persistent identity never accompanies a child's voice off our systems.

Practical notes for building on a speech API

Collect the minimum, and say what you keep

Scoring needs the audio and the target word. It does not need the child's full name, their school, or their date of birth to be attached to the recording. Keeping the identity and the audio in separate places, joined by an identifier you control, is both better privacy practice and easier to explain to a school.

Decide retention deliberately

Progress tracking is the reason products keep recordings, and it is a legitimate reason — but it is a decision, not a default. Ask whether you need the audio or only the scores derived from it. Storing scores and discarding audio after processing preserves most of the product value and removes most of the risk.

Remember children do not need accounts

The lowest-risk design in this category is one where the adult holds the account and the child simply speaks into it. SpeechTherapyMagic's own platform is built that way — children never create accounts — and it removes an entire category of consent and identity problem.

Children's privacy questions

Is a child's voice recording personal information under COPPA?

Yes. The COPPA Rule's definition of personal information at 16 CFR 312.2 explicitly includes "a photograph, video, or audio file where such file contains a child's image or voice", and separately includes biometric identifiers such as voiceprints. A recording of a child speaking is covered whether or not it contains their name.

Does the FTC's audio-file exception apply to a pronunciation scoring app?

Almost certainly not. The FTC's 2017 enforcement policy statement says it will not take action over the parental consent requirement where audio is collected solely as a replacement for written words — to perform a search or fulfil a verbal instruction — and is kept only for the brief time necessary for that purpose. A pronunciation scoring product analyses the child's voice as the subject of the interaction rather than as a substitute for typing, and typically retains recordings for progress tracking. Both of those fall outside the exception, so the full notice and verifiable parental consent requirements apply.

Is ArticScore COPPA certified?

There is no such thing as COPPA certification, and any vendor claiming it should be asked what they mean. The FTC does not certify products. The only formal status that exists is membership in good standing of an FTC-approved Safe Harbor program under 16 CFR 312.11 — CARU, ESRB, iKeepSafe, kidSAFE, PRIVO, or TRUSTe. The FTC has brought enforcement action against a company for claiming COPPA certification after its Safe Harbor membership had lapsed. We are not making a certification claim; we describe our practices and our contractual terms, and we recommend you evaluate them on that basis.

Who is responsible for parental consent — us or ArticScore?

If you operate the product a child uses, you are the operator under COPPA and the notice and consent obligations are yours. ArticScore processes audio on your behalf. That does not remove our obligations to handle the data properly, and it does not transfer yours to us. This division should be written into the agreement between us rather than assumed.

What about FERPA and school deployments?

If you deploy through a school, a different framework often applies: student records are covered by FERPA, several US states have their own student privacy statutes, and schools frequently rely on the school-consent mechanism the FTC recognises for educational use. School procurement will normally want a data processing agreement and a subprocessor list. This is a question to route through your own counsel, and the specifics belong in a contract rather than on a web page.

Do you use our audio to train your models?

Not unless it is separately and explicitly agreed. Audio submitted through the developer API is scored and deleted, and is not retained for training. The published fine-tuning behind ArticScore's benchmark figures was carried out on licensed public research corpora, which are named on the benchmark page along with their licensing terms.

Does SpeechTherapyMagic keep recordings from its own app?

Only where a guardian has signed a media release that specifically authorizes it. Practice recordings are deleted immediately after scoring by default; keeping them to improve scoring accuracy is its own item on the release form, separate from the publicity permissions and unticked unless the guardian ticks it. Retained recordings are stored privately, are never published or shown to other families, and are not used to identify a child. The guardian can revoke the release at any time, and revoking it deletes the recordings already kept. This applies to the SpeechTherapyMagic app only — audio submitted through the ArticScore developer API is never retained under any circumstances.