How Athletic Programs Stay Compliant in a Digital Age

Most coaches reach families the way everyone else does: a group text from a personal phone, a GroupMe thread, a BCC list pasted from a spreadsheet. It works, which is why it persists. It is also the exact pattern that every rule in this article was written to prevent, and the athletic director is the person accountable for it.

That accountability is the uncomfortable part. An AD is responsible for communications they cannot see. When a parent says they were never told about a schedule change, or when a coach's private messages with a student surface in a complaint, the AD is asked for a record. Today, in most programs, there isn't one.

This is not legal advice, and the rules vary by state and by sport governing body. But the frameworks below are public, they overlap more than they conflict, and together they describe something a program can actually build toward.

The five layers of rules, and what each one asks

1. SafeSport: “open and transparent”

The U.S. Center for SafeSport's Minor Athlete Abuse Prevention Policies (MAAPP) bind adults within the U.S. Olympic and Paralympic Movement, and many state associations and clubs adopt the same language. The core requirement for electronic communication is a single sentence.

“Open and transparent” has a specific meaning: another adult is included on the message. SafeSport lists who qualifies: the athlete's parent or guardian, another adult family member, or another adult participant such as an assistant coach. The policy applies to all electronic communication, including direct messages on social media. A text from a coach's personal phone to one player, with nobody copied, fails this standard regardless of its content.

2. State educator standards

Licensed educators are also bound by their state's professional-conduct rules, and these increasingly name electronic communication explicitly. Utah's educator standards rule is a representative example. It describes boundary violations that may include exchanging personal email or phone numbers with a student for a non-educational purpose, and interacting privately with a student through social media, a computer, or a handheld device. The same rule directs educators to use social media with students responsibly, transparently, and primarily for teaching and learning under school and district policy, and to keep professional and personal profiles separate.

Note what this does and does not prohibit. It does not prohibit a coach from emailing a team. It prohibits the private, personal-device, one-adult-one-student channel. Team logistics sent to everyone, from a platform the school can see, is squarely inside the line.

3. FERPA: who is allowed to hold the roster

A roster with student names, grades, and parent contact information is an education record. Under FERPA, a school can share education records with an outside vendor without parental consent only if the vendor qualifies as a “school official.” The regulation sets three conditions. The vendor must perform an institutional service the school would otherwise use its own employees for, must be under the school's direct control with respect to the use and maintenance of the records, and must be bound by FERPA's limits on redisclosure.

In practice this is the question to put to any app a coach wants to load a roster into: does the vendor accept the school-official role in writing, agree not to redisclose, and agree to return or delete the data when the school says so? A consumer group-messaging app generally does not. That is the difference between a tool the district can sanction and one it has to pretend not to know about.

4. COPPA: the middle school problem

The Children's Online Privacy Protection Act governs online collection of personal information from children under 13, which covers a meaningful share of middle school athletes. The FTC finalized amendments to the COPPA Rule in January 2025, with compliance required by April 22, 2026. The amendments tightened consent, data retention, and security obligations. They did not adopt a proposed exception that would have let schools consent on parents' behalf for education technology.

The clean way through this for an athletic program is structural: students do not get accounts, and the people who do are adults acting in a professional capacity. Communication goes to parents and guardians, with athletes reached through them. A platform that asks a 12-year-old to sign up is a platform that has taken on COPPA obligations most districts have no interest in auditing.

5. State student-privacy laws

Layered on top of FERPA, every state and the District of Columbia have passed their own student-privacy legislation since 2013, tracked by the Future of Privacy Forum. These vary widely but commonly prohibit vendors from selling student data, using it for targeted advertising, or building profiles for non-educational purposes, and many require a signed data-privacy agreement before a district may use a product at all.

The email rules nobody tells coaches about

Even a program that gets every policy above right can be undone by the mailbox providers. Since February 1, 2024, Google has required senders of 5,000 or more messages a day to authenticate with SPF, DKIM, and DMARC, to support one-click unsubscribe on marketing and subscribed messages, and to keep spam complaint rates below 0.30%. Senders who fail land in spam or are rejected outright.

A single school is unlikely to hit 5,000 messages a day. But a platform sending on behalf of hundreds of schools is, which means the vendor's domain authentication and unsubscribe handling determine whether a coach's bus-time change reaches the primary inbox or the spam folder. Ask to see it.

The CAN-SPAM Act applies primarily to commercial email, and a practice-cancellation notice is not an advertisement. But its baseline obligations are worth adopting regardless: accurate “From” and “Reply-To” headers, a working opt-out, and honoring that opt-out within ten business days. The FTC is explicit that an organization cannot contract away responsibility by hiring a vendor to send for it.

Text messaging carries its own layer. Bulk texts from a business to U.S. phone numbers require the recipient's consent under the Telephone Consumer Protection Act, and carriers require the sending organization to register its messaging campaign before traffic is allowed through. That registration is reviewed by the carriers on their own timeline, which is why any vendor promising a texting launch date is promising something they do not control.

What a compliant practice actually looks like

Read the five frameworks together and they converge on a short list of properties. None of them is about message content. All of them are about the channel.

• Broadcast, not direct message. A coach message goes to a team or a defined audience, never to one student alone. The strongest version of this is a tool with no one-to-one code path at all, because a rule that cannot be broken is better than a rule people are trained on.
• Another adult is always in the loop. SafeSport's “copy a parent or another adult” requirement is met automatically when every message is logged where the athletic director can see it. The log is the other adult.
• The roster is the recipient list. Contact data lives in one place the school controls, under a school-official agreement, and messages resolve their audience from it. No personal spreadsheets, no exported BCC lists, nothing to go stale or walk out the door when a coach leaves.
• No personal contact information changes hands. The coach's cell number stays private. Parents never see each other's addresses. The channel belongs to the program, not the person.
• There is a record. Who sent what, to which team, when, and whether it was delivered. This is the artifact an AD hands to a principal, and it is the thing group texts and BCC lists can never produce.
• Students are not the account holders. Adults sign in. Athletes are reached through their parents. This keeps the program out of COPPA's scope by design rather than by policy.

No software makes a program compliant on its own. Written policy, preseason training, and an AD who actually reviews the record still matter. But the tool decides whether those practices are easy or heroic, and most coaches will do what is easy at 4:05 PM when the bus time moves.

A preseason checklist for athletic directors

• Name the sanctioned channel in writing. If the policy does not say which tool coaches use, they will use whatever is already on their phone.
• Get the vendor's school-official commitment on paper. Direct control, no redisclosure, return or deletion on request. If they will not sign it, the roster does not go in.
• Ask where the data lives and who processes it. A published subprocessor list and a stated hosting region are reasonable to expect. “We take privacy seriously” is not an answer.
• Ask whether student content trains AI models. Get the answer in the privacy notice, not in a sales call.
• Confirm there is no one-to-one path to a minor. Not a setting, not a training point. Ask the vendor to show you that it cannot be done.
• Review the record once a month. Ten minutes with the communication log is the whole oversight program. It is also what you will wish you had been doing when a complaint arrives.
• Re-onboard every season. Volunteer and part-time coaches turn over constantly, and most have never read the educator-conduct rule that applies to them.