A School Can Consent for Its Students. It Cannot Consent to Your Ad Stack.
A licensed game catalogue meets two gates in schools: the web filter's Games category, and the ad SDKs inside builds you didn't compile. Price fixes neither one. Both fire long before anyone reads your pitch deck, and if you are planning an education line off the back of an arcade that pays for itself with rewarded video, the monetization model is the product problem, not a footnote to it.
I keep seeing the same plan. A portal operator has 500 casual titles, notices that a third of them are arithmetic drills, word games and memory puzzles, and decides education is an obvious adjacent market. Schools have devices. Devices have browsers. The games run in browsers. The maths looks easy right up to the point where someone tries to load the portal on a district Chromebook and gets a block page.
🚧 The Filter Fires Before Anyone Reads Your Pitch
No regulator anywhere requires schools to block games. What regulators require is filtering, and filtering is sold as category subscriptions. Once a district buys categories, the categories decide.
Look at how a mainstream taxonomy actually defines the relevant bucket. Fortinet's public FortiGuard web filter category list describes Games as "Sites that provide information about or promote electronic games, video games, computer games, role-playing games, or online games," and then adds the line that should stop you cold: "time consuming mathematic game sites that serve little education purpose are included in this category."
Read that again. The classifier's own definition contemplates educational-looking maths games and files them under Games anyway. Whether your portal lands on the right side of "little education purpose" is a judgement made by a crawler and a category analyst who will never see your curriculum mapping document.
The consequences are not marginal. The Center for Democracy & Technology's 2025 survey, reported by The Markup in January 2025, found that roughly 70% of both teachers and students said web filters get in the way of completing assignments, and 75% of teachers said students use workarounds to reach the unfiltered internet. That is the environment your product is walking into: filtering that is already over-broad, already resented, and already routed around by the users you are trying to reach.
England has the same shape with different paperwork. Under Keeping Children Safe in Education 2025, statutory from September 2025, schools and colleges must meet the Department for Education's filtering and monitoring standards, senior leaders and designated safeguarding leads have to understand how the systems work, and — per UK Safer Internet Centre guidance on the 2025 changes — schools must actively test that filtering works in practice rather than assert it on paper. None of that mandates blocking games. All of it means a school with an untested allowlist will default to the vendor's categories, because the vendor's categories are the defensible position at inspection.
🧾 A School's Consent Has a Ceiling Written Into It
Suppose you clear the filter. Now the harder gate.
In the United States, under-13 users trigger COPPA, and COPPA needs verifiable parental consent. Ed-tech has always leaned on a workaround: a school can provide that consent on behalf of parents. Most operators treat this as a blanket permission slip. It is not. The long-standing FTC position, still the operative one, is that a school may consent where the service is solely for the use and benefit of the school and for no other commercial purpose.
"No other commercial purpose" is the whole ballgame. An ad-funded arcade has a commercial purpose that is not the school's. The advertising is not a side effect of the service; it is the revenue model. A district counsel who reads that sentence and then reads your rate card is not going to be talked around.
There is a wrinkle worth knowing because a lot of vendors got it wrong. The FTC proposed codifying the school authorization exception directly into the Rule in its January 2024 notice of proposed rulemaking — with formal definitions of "school" and "school-authorized education purpose" — and then declined to finalize any of it, citing possible changes to the Department of Education's FERPA regulations. The Public Interest Privacy Center, writing in January 2025, called that a setback for exactly this reason: the school-consent pathway still lives in FAQ guidance rather than in rule text. If your legal position depends on it, you are relying on guidance, not regulation. Price that risk accordingly.
📦 You Inherit Every SDK in a Build You Did Not Compile
This is the part specific to licensed catalogues, and it is the part most licensees discover late.
When you license finished game builds, you typically get distribution rights and a packaged artefact. You do not get the source, you did not choose the analytics library, and you frequently cannot enumerate what the build calls out to on load. In a consumer portal that is an acceptable trade. In a school it is the liability.
The FTC made the point explicitly in September 2025. In its action against Apitor Technology, a toy robot maker, the allegation was not that Apitor collected children's geolocation data — it was that a third-party SDK embedded in Apitor's app did, sending location to servers operated by the SDK vendor, for purposes including advertising. Apitor paid a $500,000 civil penalty without admitting or denying the allegations, and agreed to ten years of compliance monitoring. The FTC published business guidance alongside it under a title that leaves nothing to interpretation: using a third party's software in your app? Make sure you're (all) complying with COPPA.
Translate that to a catalogue deal. You license 400 HTML5 titles. Eighty of them ship with an analytics or ad SDK you did not select. One of those SDKs sets a persistent identifier and reports it to an ad network. Under COPPA you are the operator of the service the child used. The licensor's contract does not move that.
The practical consequence: an education SKU cannot be your consumer catalogue with the header swapped. It has to be a separately built, separately audited subset where you can state, per title, what the build loads and what it transmits. That is a real engineering and due-diligence cost, and it is the cost most education pitches quietly omit.
🗓️ The April 2026 Deadline Already Passed
The FTC's amendments to the COPPA Rule were published in the Federal Register on 22 April 2025, took effect on 23 June 2025, and carried a full compliance deadline of 22 April 2026 for most provisions. That date is behind us.
The changes that matter for a games catalogue:
- Separate consent for third-party disclosure. Operators must obtain separate verifiable parental consent before disclosing children's personal information to third parties for purposes that are not integral to the service. Ad targeting is the textbook non-integral purpose. You cannot bundle it into the consent that lets the child play.
- Written data retention policy. Retention has to be documented and bounded, not indefinite. If your ad partners' retention windows are unknown to you, that is a gap in your own policy.
- Expanded personal information. The definition now reaches biometric identifiers, which matters more than it sounds for anything doing camera or voice input.
- A written information security programme. Required, not advisory.
Enforcement is not theoretical. In January 2025 the FTC settled with Cognosphere, developer of Genshin Impact, for $20 million over children's privacy and lootbox allegations. The dollar figures in this area have moved from nuisance to material.
📄 The Contract Is Already Written, and It Names Targeted Advertising
Here is the thing operators new to education find genuinely surprising: you do not get to propose your own terms.
The Student Data Privacy Consortium publishes the National Data Privacy Agreement, a standard contract districts hand to vendors. Version 2.2 was published on 19 November 2025. The consortium's registry of signed agreements runs into six figures across thousands of districts and thousands of providers, which tells you how entrenched the instrument is. If you sell into US K-12 at any scale, you will sign a version of this document, not a document your lawyer drafted.
Its advertising clause prohibits using, disclosing or selling student data to inform, influence or enable targeted advertising, or to build a profile of a student for any purpose other than delivering the service, or for any commercial purpose other than providing the service to the district. Targeted advertising is defined as serving an ad selected on the basis of student data or behaviour observed over time.
Read that precisely, because the precision is where the opportunity sits. The NDPA prohibits targeted advertising. It does not, in terms, forbid every advertisement in existence. Genuinely contextual, non-personalised inventory — no identifier, no behavioural signal, no retention — is a different object under that definition.
I would still not build a business on it. Contextual-only inventory for a kids' audience prices at a fraction of behavioural, and you now need to prove the absence of targeting across every ad call in every licensed build, in a market where the buyer's default answer to ambiguity is no. The distinction is worth understanding so you can answer the question in a procurement meeting. It is not worth betting the P&L on.
🔌 Allowlisting Your Portal Does Not Allowlist Your Games
A practical failure that costs pilots. Say you win the argument and a district IT administrator agrees to allowlist your domain. The portal loads. The games do not.
Most licensed catalogues serve game builds from the licensor's CDN, embedded in an iframe on your page. Filters operate on the requested host. Allowlisting portal.yourcompany.com says nothing about cdn.licensor.example, the analytics host, the font host, or the ad host. From the administrator's console the portal is unblocked; from the classroom the tiles spin forever, and nobody files a ticket because a game that does not load is not perceived as broken infrastructure. It is perceived as a bad product.
Before any education pilot, produce the full list of hosts a session touches — portal, game CDN, every third-party call — and hand it over as part of onboarding. It is a ten-minute job with the network tab open, and it is the difference between a pilot that renews and one that dies silently in week two. Check your licence terms too: if you cannot self-host the builds, that host list is permanently outside your control, and every licensor CDN migration is an outage in every district you sold.
💰 Price It as a Site Licence, Not as Inventory
If advertising is closed off, what is left is the model education buyers already understand: they pay you.
Per-seat or per-site annual licensing, invoiced to a district or a school, with no ads, no third-party identifiers, and a signed data privacy agreement. This is a smaller top line per user than a consumer portal at scale and a far better business than most operators expect, for three reasons. Renewal is annual and administrative rather than won afresh each month. Churn is governed by budget cycles, not by retention curves. And the compliance work you do once — the audited subset, the host list, the signed NDPA — is reusable across every subsequent district, which is precisely the shape of cost that rewards volume.
It also changes what you should license in. A 1,000-title arcade is the wrong shape for a school. A curated set of 60 to 100 titles that you can fully account for, tagged by age band and subject, sold with a teacher-facing landing page, beats catalogue size every time in this market. Buyers here are not comparing library counts. They are comparing risk.
Forestry Games licenses HTML5 titles as builds you can host yourself, which is the part that matters for education work: self-hosting is what lets you control the host list, strip third-party calls, and answer a district's questions with evidence rather than a licensor's assurance. If you are scoping an education line, the school games selection and the wider catalogue are the place to start, and the questions to bring are about build access and SDK inventory, not price per title.
🧭 What to Do Before You Pitch a District
Three things, in order, before you take an education meeting.
- Run the block test. Load your portal from behind a commercial K-12 filter — most vendors offer a trial — and record what is blocked at portal level and at asset level. If you cannot do that, ask a friendly district IT lead to try it and screenshot the result. Do this before you build a pricing model, not after.
- Inventory the SDKs. Open the network tab on twenty titles you intend to sell and list every third-party host. Anything you cannot explain is a title that does not go in the education SKU. Your HTML5 titles are only as sellable here as your ability to describe what they load.
- Read the NDPA before someone hands it to you. It is public. Read the advertising and data-retention clauses against your actual stack and find out now which sentences you cannot sign, rather than in week six of a procurement cycle.
Education is a real market for licensed casual games and a slow one. The operators who do well in it are the ones who accepted early that the ad-funded model does not travel, rebuilt a narrow SKU around that constraint, and priced accordingly. The ones who do badly spend two quarters trying to convince a district that their rewarded video is basically fine, and lose to a competitor charging $4 a seat with nothing to explain.
