If you are building a web application to be used by US schools, you will probably have to worry about COPPA compliance.
Children's Online Privacy Protection or COPPA is new to me, probably because it was passed in 1998 and then quickly forgotten. However, it has a number of very strict rules about storing identifying information of children under the age of 13 and the penalty is $11,000 per violation, so this is not something to ignore.
Here is quick summary of requirements:
- Provide direct notice to parents and obtain verifiable parental consent, with limited exceptions, before collecting personal information from children;
- Give parents the choice of consenting to the operator’s collection and internal use of a child’s information, but prohibiting the operator from disclosing that information to third parties;
- Provide parents access to their child’s personal information to review and/or have the information deleted;
- Give parents the opportunity to prevent further use or online collection of a child’s personal information;
- Maintain the confidentiality, security, and integrity of information they collect from children.