Private tutoring is the unlicensed one, and that is the trap
Nurseries register and are inspected. Clubs and daycare are licensed. Private tutoring of children, in most of the English-speaking world, is not a licensed trade at all, and tutors reasonably conclude that none of this touches them.
Three things then bite. Vetting: nobody forces you to hold a check, but the terminology differs by country and claiming the wrong one is a misrepresentation. Claims: promises about grades and results are advertising, and advertising is regulated everywhere. And data: a tutoring site collects a child's name, year group, school, sometimes a diagnosis, and possibly a recording of the child's face, which is the most sensitive material a small business is likely to hold.
What follows is orientation, not legal advice. Your regulator and a local adviser are the authorities.
United Kingdom
Vetting. Tutors are not registered, but the checks have names parents recognise: an enhanced DBS check in England and Wales, PVG scheme membership in Scotland, AccessNI in Northern Ireland. Eligibility for the enhanced level depends on the nature of the work, so confirm which level you can lawfully obtain rather than claiming the strongest sounding one. If you run a centre with staff, safer recruitment practice is what parents expect to see described.
Claims. The CAP Code applies to your website. Grade improvement claims, success rates and comparisons need evidence you hold before you publish them. Vague superlatives about being the best in town are the usual problem.
Data. UK GDPR and PECR. A privacy notice covering the child's details, session notes, and any recordings, with retention periods. ICO registration applies to most businesses processing personal data. Marketing texts and emails to parents need consent and an opt-out.
Consumer and company law. Consumer Rights Act and Consumer Contracts Regulations for anything agreed online, including cancellation rights on distance contracts, plus Companies Act details on the site for a limited company.
Accessibility. Equality Act; WCAG 2.1 AA as the practical standard.
United States
Vetting. State background check requirements vary and often bite only where tutoring happens on school premises or under a school contract. Fingerprint-based checks are common in that context. Name the state check you actually hold.
Claims. FTC rules on deceptive advertising and endorsements. Testimonials from parents need to reflect typical experience, and any results claim needs substantiation. State consumer protection acts add to this.
Data. No general federal privacy law; state privacy laws apply above their thresholds. COPPA matters if children under thirteen use your site or portal themselves rather than the parent filling in the form, which is a real risk with a student login. FERPA can be relevant where you contract with a school. TCPA governs marketing texts to parents.
Accessibility. ADA applied to websites through litigation; WCAG 2.1 AA is the standard used.
Canada
Vetting. Vulnerable sector checks are provincially administered through police services. Requirements differ by province and by whether you work in a school setting.
Data. PIPEDA federally, with provincial equivalents in Alberta, British Columbia and Quebec. Quebec's Law 25 adds consent, transparency and privacy officer obligations, and French-language requirements apply to sites serving Quebec.
Marketing. CASL is strict on commercial electronic messages. Consent and a clear unsubscribe on every email to parents.
Accessibility. AODA in Ontario; the Accessible Canada Act federally.
Australia
Vetting. A Working with Children Check by state or territory, plus Child Safe Standards in most jurisdictions and mandatory reporting duties under state law. Say which state's check your tutors hold, since parents check the right one.
Claims. Australian Consumer Law on misleading or deceptive conduct. Results claims and testimonials are enforced. ABN, and ACN for companies, on the site.
Data. The Privacy Act, with the small business threshold, though a site holding children's details and recordings should behave as though it applies. Spam Act consent rules for marketing.
Accessibility. Disability Discrimination Act; WCAG 2.1 AA.
European Union
Vetting. Criminal record checks for work with children exist in every member state under national law, with an EU mechanism for exchanging records across borders. Terminology varies, so use the national term.
Data. GDPR, and here it is unavoidable. A lawful basis, a privacy notice in the local language, retention periods for session notes and recordings, and consent from the holder of parental responsibility for anything that needs consent. National law sets the digital consent age between thirteen and sixteen, which matters if teenagers log into a portal directly.
Cookies and consent. The ePrivacy rules mean a real consent banner: no non-essential scripts, including analytics and any embedded video, before consent.
Consumer law. Distance selling rights and a fourteen-day withdrawal period for services bought online, plus imprint requirements in Germany and Austria.
What is the same everywhere
Say only what is true about checks, qualifications and results. Publish who is responsible for safeguarding and how to raise a concern. Get written, evidenced consent before a child's face or work appears on a page. Keep session notes in one system, not scattered across an inbox. Give parents a real way to reach a person. And keep the site accessible, because a parent reading on a phone at midnight is the person you are building for.
Where this sits
Getting the vetting language, claims, consent and privacy right for the country you operate in is part of building a children's tutoring website, and it runs through the rest of our childcare and family websites. The packages are on pricing. Check the detail locally before you publish it.