More than half of the software used in school classrooms violates privacy contracts by tracking students, according to a new technical audit. The study, conducted by Brigham Young University (BYU) researchers in partnership with the Utah State Board of Education and Internet Safety Labs, analyzed the network traffic of 100 commonly used educational apps. In response, Utah lawmakers passed a strict new privacy law to hold educational technology (EdTech) vendors accountable.
What Happened
According to the BYU study, researchers examined the actual digital traffic sent by popular classroom apps used by K-12 students. Even though 85 of these apps had legally binding student data privacy agreements in place, 52% of those contracted apps collected student data they were legally forbidden from gathering.
The audit found that 61% of all tested apps shared student data with third parties, and 36% sent this data directly to advertising networks. The tested software included major platforms utilized nationwide, such as Canvas, Duolingo, Khan Academy, Quizlet, YouTube, coolmathgames.com, and Loom.
The Bigger Picture
The tracking rarely involves a child's name or address. Instead, companies gather unique digital identifiers. According to the BYU research team, these identifiers allow commercial tracking networks to build permanent digital profiles of children. This profiling lets companies track students across the web and target them with ads long after they log out of their school accounts.
This data sharing is often accidental. Many EdTech companies embed free third-party analytics software or software development kits (SDKs) into their apps to monitor performance. These pre-packaged tools transmit student information back to commercial networks without the school's or the developer's knowledge.
Some data collection is far more invasive. A class-action lawsuit in California alleges that the popular digital learning platform i-Ready collected and shared detailed student behavior with outside data brokers. The lawsuit claims the app tracked mouse movements, click rates, and learning disability flags without parental consent.
This issue is not isolated to classroom apps. As we previously reported, mandatory state programs and online financial literacy tools have also exposed student demographics and digital habits to third-party marketing companies.
What This Means for Families
To combat these leaks, Utah enacted H.B. 55, which took effect on July 1, 2026. The law sets strict privacy baselines for school technology contracts. Most importantly, it gives school districts the power to terminate a contract within 30 days if an EdTech provider fails to fix a confirmed data leak.
Federal rules are also shifting. The Federal Trade Commission (FTC) updated its Children's Online Privacy Protection Act (COPPA) regulations. EdTech vendors can no longer rely on school-level consent to bypass parental authorization to share student data for commercial advertising.
What You Can Do
Parents can take several steps to protect their children's data. First, ask school administrators how they audit digital tools. Under laws like Utah's H.B. 55, schools must actively monitor if apps comply with privacy pledges.
Second, check the privacy settings when children use school-issued devices at home. See if you can opt out of personalized tracking or limit the data shared with third-party analytics.
Finally, encourage the use of privacy-focused browsers. If your child accesses school portals on a personal computer, use browsers or extensions that block third-party trackers and advertising networks.