PowerSchool and Chicago Public Schools have agreed to pay $17.25 million to settle a class-action lawsuit alleging they violated student privacy laws. The settlement resolves claims that the education technology giant used software to secretly track and record student interactions on its widely used platforms.
What Happened
The lawsuit, filed on behalf of a student identified only as Q.J., accused PowerSchool and its subsidiary Hobsons of unlawful "wiretapping" and eavesdropping. according to the motion for settlement approval, the companies allegedly used third-party analytics tools—specifically code from a firm called Heap Inc.—to covertly record students' digital communications while they used the Naviance college and career planning platform.
Under the proposed terms, PowerSchool and Chicago Public Schools (CPS) will create a $17.25 million settlement fund. This fund will be distributed among approximately 10 million potential class members who logged into Naviance between August 2021 and January 2026. In addition to the payout, PowerSchool must establish a "web governance" committee and stop using third-party tracking code in Naviance for two years. As part of the agreement, CPS will also mandate that its vendors provide annual certifications proving compliance with state and federal privacy laws.
This settlement comes during a difficult year for the company. In January 2025, a separate cybersecurity incident exposed sensitive data belonging to millions of students, including special education status and mental health records.
The Bigger Picture
This lawsuit highlights a growing legal trend where traditional "wiretapping" laws are applied to modern digital tracking. While parents might imagine wiretapping as listening to phone calls, in the EdTech world, it refers to "session replay" technology. According to legal analysts, these tools capture information about the transmission of data, effectively watching a student's every move on a website without their consent.
The use of these hidden trackers is widespread. Courts in California and Florida are increasingly ruling that software developer kits (SDKs) and pixels used for analytics can constitute illegal interception of communications. For schools, this complicates an already difficult procurement landscape. As we previously reported, technical glitches and oversight failures frequently expose student records to unauthorized parties.
Furthermore, the "patchwork" of state laws makes compliance difficult. While the Family Educational Rights and Privacy Act (FERPA) has been the federal standard since 1974, a data privacy revolution involving new state-level mandates is forcing districts to adopt stricter vendor vetting processes.
What This Means for Families
For parents, this settlement validates long-standing concerns that school-mandated software may be harvesting more data than necessary. The allegations suggest that even when companies claim to value privacy, they may be using advertising technology to profile students in the background.
The implications of data insecurity are severe. The separate 2025 PowerSchool hack revealed that breached data can include social insurance numbers and medical information. When vendors fail to implement basic safeguards like multi-factor authentication, student safety is directly compromised.
What You Can Do
- Check your eligibility: If your child logged into Naviance between August 2021 and January 2026, you may be eligible for a portion of the settlement. Watch for official notices from the settlement administrator.
- Ask about vendor certifications: Ask your school board if they require third-party privacy certifications from their software vendors. A signed contract alone does not guarantee compliance.
- Demand transparency: Request a list of all third-party trackers and analytics tools used on the platforms your child is required to use for school.