Many classroom educational apps secretly share student data with advertisers and third-party brokers. A multiyear investigation into school technology has revealed widespread violations of student privacy agreements. The findings have now led to a strict new enforcement law in Utah to hold tech vendors accountable.
What Happened
The issue came to light during a two-year study commissioned by the Utah State Board of Education to see if school apps actually protected student data. According to the Utah State Board of Education's investigation report, researchers from Brigham Young University and the nonprofit Internet Safety Labs analyzed the network traffic of 100 commonly used educational apps.
The results showed a large gap between vendor promises and actual practices. Researchers found that 61% of the tested apps shared student data with third parties, and 36% sent data directly to advertising networks, as reported by Malwarebytes. Also, 52% of the apps that signed formal data privacy agreements with school districts collected data they were contractually forbidden from gathering, according to the Malwarebytes tracking report.
The Bigger Picture
These leaks rarely expose a child's physical address or full name. Instead, as explained in our coverage of Utah's classroom app crackdown, commercial tracking networks focus on gathering unique digital identifiers. These identifiers allow brokers to build permanent digital profiles of students as they grow.
Much of this tracking occurs quietly through free embedded software development kits (SDKs) that developers use to monitor app performance. Popular apps such as Canvas, Duolingo, Khan Academy, and Quizlet rely on these tools. While platforms like Khan Academy offer valuable free educational resources, the underlying tracking mechanisms often operate without the knowledge or consent of school administrators.
In extreme cases, tracking monitors specific student behaviors. For instance, a recent class-action lawsuit against the testing platform i-Ready alleges that the software logged mouse movements, user behavior, and predicted learning disabilities without parental consent.
What This Means for Families
While adults can decline privacy terms or avoid tracking, K-12 students rarely have a choice. Because teachers assign these digital tools as part of the curriculum, students must log in and use them to complete their schoolwork.
To address this forced exposure, Utah lawmakers passed H.B. 55, "Privacy Compliance for Education Technology Vendors," which took effect on July 1, 2026. According to the Orion Policy Institute, the law increases student privacy protections by giving schools the right to audit EdTech vendors. Under the rules, if an audit reveals a violation and the vendor fails to correct it within 30 days, the school district must terminate the contract, as reported by KSL.com.
What You Can Do
Parents can take a few steps to protect their children's information. First, ask your school district if they actively audit the live network traffic of approved classroom apps, rather than just relying on written contracts. You can also review your child's school-issued devices to disable personalized advertising and limit permissions for location, camera, and microphone access. Finally, ask teachers about low-tech or offline alternatives for required software programs that carry high privacy risks.