Many educational software programs used in schools silently track students and share their personal information with advertisers, according to a recent multi-year study. This tracking occurs even though schools have explicit, legally binding data-privacy agreements with technology vendors. Lawmakers are now stepping in with legislation that forces school districts to police app behavior or face legal consequences.
What Happened
As we previously reported, a two-year technical investigation by the Utah State Board of Education, Brigham Young University, and the non-profit Internet Safety Labs analyzed the network traffic of 100 popular educational apps between 2023 and 2025. Rather than just reading privacy policies, researchers intercepted live network traffic while testing the apps with active student accounts.
The results showed a wide gap between vendor promises and actual software behavior. Out of the 85 tested apps with active student data privacy agreements, 52% collected at least one data element that their contracts explicitly prohibited. Also, 61% of all tested apps shared student information with third parties, and 36% sent student data directly to advertisers.
The Bigger Picture
This tracking is not limited to harmless metadata; it often involves unique digital identifiers. The BYU research team found that commercial tracking networks use these identifiers to build permanent profiles of children. This tracking can follow students across the web even when they log out of school platforms.
This behavior violates federal protections. For instance, the Federal Trade Commission's updated COPPA regulations require verifiable parental consent before disclosing children's personal data to third parties for targeted advertising. Because the FTC did not include a "school exception," school districts cannot legally consent to advertising trackers on behalf of parents.
In response to the BYU findings, Utah passed H.B. 55, which took effect on July 1, 2026. The law amends state student privacy codes. It requires districts to write strict data protections into all vendor contracts and actively notify vendors of violations. Districts must also terminate contracts immediately if a vendor fails to resolve a confirmed privacy leak within 30 days.
What This Means for Families
For parents and educators, this research shows that school districts cannot simply take software developers at their word. Many school apps contain hidden third-party trackers that operate in the background. Because of this "tech sprawl," as we discussed in our guide on how to stop school tech sprawl, schools often lose track of which tools are active and what data is being transmitted.
This has led to growing legal friction. Parents recently filed lawsuits against major education platforms, including Curriculum Associates' i-Ready program, alleging that companies exploit children's data for commercial gain. Parents are also concerned about the physical and psychological toll of excessive classroom screen time. Many now question whether these platforms are necessary for learning.
What You Can Do
First, ask your local school board if they conduct technical network traffic monitoring on classroom apps, rather than just relying on written privacy agreements.
Second, request a complete, updated inventory of all digital learning platforms, such as Canvas, Duolingo, Khan Academy, or Quizlet, currently in use in your child's classroom.
Finally, encourage your district to use federal rules like COPPA to deny school-level authorization for any software that embeds commercial advertising or profiling trackers.