Dance studio data privacy comes down to five habits: collect only what you need, limit who can see it, get clear consent for photos and livestreams, delete what you no longer need, and have a written plan for the day something goes wrong. Your studio holds names, birthdates, home addresses, health notes, pickup permissions and payment details for children. That is sensitive data, and U.S. regulators expect you to treat it that way.
This guide walks through what you collect, which U.S. rules matter, how to run livestream classes without exposing students, what to look for in your management software, and what to do after a breach. It is general information, not legal advice. For decisions about your state's law, talk to a business attorney.
TL;DR
- Collect only what you need to teach, bill and keep students safe, and set a deletion schedule for the rest.
- Children's data gets extra attention from the FTC. Keep student accounts under parent control and keep information only as long as necessary.
- Livestreams need written consent, access limited to enrolled families, and a clear rule on recording. Some states require every participant's consent to record audio.
- Give staff access by role, not by default, and move away from spreadsheets and group texts that spread data widely.
- Write a breach plan now: who decides, who is notified, and which state deadlines apply.
Table of Contents
- What personal data a dance studio actually holds
- Collect less, keep it for less time
- U.S. rules that touch dance studios
- Livestream and recorded class privacy
- Protect student and parent data day to day
- What to check in your management software's privacy terms
- If student or family data is exposed
- A simple privacy checklist for your next staff meeting
- Put your data in one place
- FAQ
- Sources
What personal data a dance studio actually holds
Before you can protect data, you need a list of it. Most studios hold more than they realize:
- Student details: name, age or birthdate, grade, class history, skill level, costume sizes.
- Parent and guardian details: names, emails, phone numbers, home addresses, emergency contacts, authorized pickup names.
- Health information: allergies, injuries, medical conditions entered on registration forms or waivers.
- Payment information: tuition history, autopay status, card or bank details handled by a payment processor.
- Media: photos, performance videos, recorded or livestreamed classes.
- Staff records: time clock entries, pay rates, tax forms.
- Communications: texts, emails and group chat history, which often contain all of the above.
The FTC's guide for businesses on protecting personal information starts with the same exercise: take stock of what you have, scale down to what you need, lock it, pitch what you no longer need, and plan ahead. Those five steps are a good skeleton for a studio privacy program, and the rest of this article follows them.
Do the inventory in one afternoon
Open every place student data lives: your registration software, the spreadsheet a former manager built, the shared inbox, the front-desk binder, the phone that holds the parent group text. Write down what is stored where and who can reach it. Then ask two questions of each item: do we still need this, and does everyone who can see it need to?
Most studios find three problems: old spreadsheets with full family records that nobody uses, medical notes copied into text threads, and logins shared between front-desk staff. Fixing those three removes much of your real-world risk.
Collect less, keep it for less time
The single most useful privacy habit is not collecting data you will not use. If you do not need a student's school name to run a ballet class, do not ask for it. If a form asks for a Social Security number, it almost certainly should not.
Retention matters just as much. Regulators have been explicit that keeping children's data forever is a problem. In a January 2025 statement, FTC Commissioner Alvaro Bedoya pointed out that the agency has repeatedly sued companies that never deleted children's data, naming cases from 2022, 2023 and 2024. Those cases involved apps and tech companies rather than studios, but the principle is the same: data you do not need becomes a liability.
A workable retention schedule for a studio might look like this:
| Data | Suggested approach |
|---|---|
| Registration and contact info for active students | Keep while enrolled |
| Info for students who left | Archive, then delete after a set period you choose (for example, after your accounting needs end) |
| Medical notes and allergy info | Keep only for the current season; delete when the student leaves |
| Payment records | Keep what your accountant and tax rules require; your processor holds the card data |
| Livestream and class recordings | Set an expiry, such as the end of the term |
| Incomplete registrations and trial inquiries | Delete after a short window |
The periods are yours to set with your accountant and attorney. What matters is that you have one and follow it.
U.S. rules that touch dance studios
There is no single federal privacy law for dance studios. Instead, several rules overlap, and which ones apply depends on how you collect data and where your families live.
Children's data and COPPA
The Children's Online Privacy Protection Act (COPPA) is the main federal rule on children's data online. According to the FTC's COPPA FAQ, it applies to websites and online services directed to children under 13, and to general-audience services that have actual knowledge they collect personal information from children under 13. Covered operators must give parents direct notice, get verifiable parental consent before collection, let parents review and delete their child's information, keep it secure, retain it only as long as reasonably necessary, and not require more information than reasonable for participation.
What does that mean for a studio? Many studios register children through a parent, which is different from a child signing up on their own. Still, the practical lessons apply whether or not COPPA technically covers you:
- Let parents, not kids, create and control accounts.
- Ask only for what class participation requires.
- Give parents a simple way to see and correct their child's information, and to ask you to delete it.
- Do not use student data for anything unrelated to running the studio.
If you run an app, a kids' video library or any feature where children interact online directly, ask your attorney whether COPPA applies. The rule was amended, and the amended rule was published in the Federal Register on April 22, 2025. One law firm summary notes that covered companies had until April 22, 2026 to bring their data retention policies in line, including a written policy stating the purpose and timeframe for keeping children's data.
The stakes for covered companies are real. The FTC obtained a $20 million civil penalty against Cognosphere in January 2025 for COPPA and FTC Act violations. That was a large game company, not a neighborhood studio, but it shows how seriously children's privacy is enforced.
State laws
Privacy law in the U.S. is increasingly set by states. Two kinds matter most to a studio:
- Breach notification laws. Every state has one, and they apply based on where your families live, not where your studio is. If you hold data on residents of another state, for example families who drive across a state line, that state's rules can apply too. Deadlines and requirements differ, so the shortest deadline among your families' states is the safest planning target.
- Recording laws. Federal law allows recording when one party to a conversation consents, but a number of states, including California, Florida, Illinois, Maryland, Massachusetts, Pennsylvania and Washington, require the consent of everyone being recorded. This matters for livestreams, which we cover next.
Because these laws change, check your state attorney general's website for the current version of your state's breach notification and consumer privacy rules before you finalize your policies.
Livestream and recorded class privacy
Livestreaming lets students who are traveling, injured or learning at home join class. It also puts children's faces, voices and often their living rooms onto a screen. A few decisions make it safe.
Get consent before anyone is on camera
In-person students appear in the frame of a classroom camera, and remote students appear in everyone else's view. Collect written consent from a parent or guardian that explains:
- whether classes are streamed, recorded, or both;
- who can watch (enrolled families only, or anyone with a link);
- how long recordings are kept;
- what happens if a family opts out.
In states that require all-party consent for audio recording, a recorded class captures every student's voice, so a teacher needs agreement from every student's parent before recording. Even in one-party-consent states, getting consent from everyone is the better policy, because families care about this regardless of what the law minimally allows. Our guide to a livestream class policy for dance studios and the companion piece on a photo and video policy cover what to write.
Control who can watch
A public link is the most common way livestream privacy fails. Better practice:
- Tie access to enrollment, so only families registered for that class can view it.
- Avoid links that can be forwarded and still work for strangers.
- Give each class its own access rather than one shared link for the whole studio.
- Remove access when a student leaves or a term ends.
Plan the camera angle and the rules
Point cameras at the teaching space, not at waiting areas or changing rooms. Tell remote families not to record or screenshot the stream, and say in your policy that sharing class video on social media is not allowed without every featured family's permission. Offer an opt-out that still lets a child take class, such as a seat outside the frame.
Protect student and parent data day to day
For a small business, good security is mostly habit, not expensive technology. The FTC's guidance for businesses points to a few basics worth applying directly.
Limit access by role
The front desk does not need payroll data. A substitute teacher does not need parents' home addresses. Give every staff member only what their job requires, and remove access the day someone leaves. If you need a model, see how a studio can set staff access levels for billing, check-in and livestreams.
Stop spreading data through spreadsheets and group texts
A spreadsheet emailed to three teachers is now four copies, none of them under your control. A parent group text puts every parent's phone number in front of every other parent. Keep rosters, health notes and contact data in one system with logins, and send messages through tools that reach parents individually or in a controlled group. Our parent communication guide describes how to do this without losing the personal touch.
Secure the basics
- Use unique passwords and a password manager, with two-step verification where it is offered.
- Do not share staff logins.
- Keep devices that open student records locked and updated.
- Shred paper forms you no longer need, and keep current ones in a locked cabinet.
- Do not store card numbers yourself. Let a payment processor handle them.
Collect consent and signatures properly
Waivers, media releases and medical forms are where you gather the most sensitive information. Digital forms with a clear record of who signed what and when are easier to protect and to retrieve than paper in a binder. See our guides on online consent forms: what to collect, digital signatures for studios and registration form templates and policies.
Publish a plain-language privacy policy
Parents should be able to read, in a minute or two, what you collect, why, who sees it, how long you keep it, and how to ask for changes. Include a real contact address. Put it on your registration page, not buried in a footer.
What to check in your management software's privacy terms
Your studio software is your biggest data custodian, so its terms are part of your privacy posture. Before you sign up or renew, read the privacy policy and terms and look for answers to these questions:
- Who owns the data? You should keep control of your student and family records.
- Is data sold or used for advertising? The answer should be a clear no.
- What happens when you cancel? Look for how long records are kept after an account is closed and whether you can export your data first.
- How are payments handled? Card details should be processed by a payments provider rather than stored in the studio's own files.
- Can you control access by role? Staff, instructors and parents should see different things.
- How are livestreams and recordings protected? Check whether viewing is tied to enrollment.
- What is the breach process? The vendor should say how and when it notifies customers.
- Can parents see and correct their data? A parent portal should make this easy.
- Does the vendor charge for historical records? Pricing that counts only active students gives you less reason to hold on to old data.
We keep our own privacy policy on our site so you can read how we handle data before you decide anything.
Our perspective: privacy is an operations problem
We built StudioFlare for dance studios, and we see the same pattern in studio after studio: privacy problems rarely start with hackers. They start with a spreadsheet on a teacher's laptop, a group text with every parent's number, or a livestream link that anyone can forward.
That is why we think the best privacy tool is a single place for the work. When registrations, billing, attendance, waivers, messaging and livestreaming live in one platform, you control who sees what, and you stop making copies. Our livestreaming is built in and tied to class registration and access control, so viewing follows enrollment rather than a link passed around.
We also charge only for active students, not historical records. We think that is the right incentive: it means you are not paying to hold on to data you no longer use. Billing runs through Stripe, so tuition collection is automated without you keeping payment details in a spreadsheet.
Privacy is never finished, but a studio that has one system, role-based access and a written policy is far ahead of one running on spreadsheets and texts.
StudioFlare Team
If student or family data is exposed
Even careful studios can have an incident: a laptop lost, an email sent to the wrong list, a vendor account compromised. What you do in the first hours matters more than the incident itself. The FTC's data breach response guide for businesses advises moving quickly to secure your systems, mobilizing a response team, and fixing the vulnerabilities that caused the breach so it does not happen twice.
A studio-sized plan can be short:
- Contain it. Change passwords, remove access for compromised accounts, lock down the affected device or account.
- Write down what you know. Note when and how you discovered it, what data was involved and whose.
- Work out who is affected and where they live. State laws apply by the residents' state, so sort families by state.
- Get advice. Call your attorney, and your insurer if you have cyber coverage. Consider an independent forensic investigator if the cause is unclear.
- Notify. Notify affected families and, where your state requires it, the state attorney general, within the deadline of the strictest state involved. Say plainly what happened, what information was involved and what families can do, such as watching accounts or placing a fraud alert.
- Keep records. Keep a log of the incident, decisions and notices.
- Fix the cause. Close the gap and tell families what changed.
Notification deadlines differ by state. Some states set a fixed number of days, and others use language like "without unreasonable delay." Check your state attorney general's page for the current rule, and do not wait to be sure of every detail before you start preparing the notice.
Practice the plan once a year. Spend 20 minutes with your front-desk manager walking through a made-up scenario: a teacher's laptop is stolen with a roster on it. Who do you call first?
A simple privacy checklist for your next staff meeting
Use this list as a one-page agenda:
- We know every place student and parent data is stored.
- We collect only what each form needs.
- We have a written retention schedule and delete on time.
- Parents control student accounts and can request changes.
- Staff access matches job roles, and departing staff lose access immediately.
- Livestream and media consent are collected in writing, and viewing is limited to enrolled families.
- Payments go through a payment processor, not our own files.
- We have a breach plan and know which attorney to call.
- Our privacy policy is public, current and readable.
Twenty minutes on this list once a term will do more for your families than any single tool.
Put your data in one place
StudioFlare is a studio management platform made for dance studios. It brings online registration, automated tuition billing through Stripe, attendance and check-in, digital waivers and forms, parent messaging and built-in livestreaming into one system, so you can stop passing data through spreadsheets and group texts. Plans start at $29 per month for Starter and $49 per month for Pro, plus $1 per month per active student. There is no setup fee and no contract. Livestreaming has no published price. See the plans and pricing or create your studio to look around.
If you are moving from another system, our Dance Studio Pro alternative page explains what the switch looks like.
FAQ
Does COPPA apply to my dance studio?
It can, depending on how your tools work. The FTC says COPPA covers online services directed to children under 13 and general-audience services that actually know they collect information from children under 13. If parents register their children and control the accounts, your exposure looks different than if kids create their own logins, so ask your attorney to review your setup. Either way, collecting little and deleting on schedule are good practices.
Can I record a livestream class without asking parents?
You should not. Recording captures students' faces and voices, and some states require everyone's consent to record audio. Get written consent from parents before streaming or recording, tell them how long recordings are kept, and limit viewing to enrolled families.
How long should I keep former students' records?
Keep what your accountant and legal obligations require, and delete the rest on a schedule you set and write down. Regulators have criticized keeping children's data indefinitely, so a defined period is better than keeping everything forever. Medical notes and recordings usually do not need to outlast the student's enrollment.
What should I do first if I think data was exposed?
Contain it by changing passwords and cutting off the affected account or device, then write down what happened and when you found out. Contact your attorney and sort affected families by state, since each state's breach notification law sets its own rules. The FTC's breach response guide for businesses is a good checklist to keep on hand.
Is a group text a privacy risk?
It can be. Every member sees every other member's phone number, and the thread can hold health or payment details that were never meant to be shared. Messaging tools that reach parents individually, or in controlled groups, keep that information contained.
Sources
- Protecting Personal Information: A Guide for Business (FTC)
- Data Breach Response: A Guide for Business (FTC)
- Complying with COPPA: Frequently Asked Questions (FTC)
- Statement of Commissioner Alvaro M. Bedoya on the COPPA Rule (FTC, January 16, 2025)
- Children's Online Privacy Protection Rule (Federal Register, April 22, 2025)
- What the Amended COPPA Rule Means for Data Retention Practices (Fenwick)
- Cognosphere civil penalty filing (FTC, January 2025)