In 2023, the FTC fined Edmodo $6 million for collecting children's personal information and using it for advertising. At its peak, Edmodo served over 100 million K-12 users. The FTC's order broke new ground: it was the first time the agency alleged that a company had outsourced its COPPA compliance to schools, making teachers responsible for privacy protections the company itself should have maintained.
Edmodo wasn't unusual. It was just the one that got caught first.
96% of School Apps Share Data
The most comprehensive study of student data sharing in American schools was published in December 2022 by Internet Safety Labs (ISL). The researchers examined 1,722 apps used across 663 schools in all 50 states, covering 455,882 students.
Ninety-six percent of apps recommended or required by K-12 schools shared student data with third parties. Of that shared data, 78% went to advertising or analytics entities. Not educational partners. Not research institutions. Companies whose business model is tracking people and selling attention.
The data access was broad. Seventy-nine percent of the apps could access student location information. Fifty-two percent could access calendar or contact data from the device. And when ISL traced where the outbound data actually went, 68% flowed to Google and 36% to Apple. The students were the product, and the schools were the distribution channel.
How "Free" Becomes Profitable
EdTech companies that offer free tiers are not running charities. They operate on well-understood business models, and student data plays a role in most of them.
Advertising and data monetization. The Edmodo case is the most prominent example, but it is far from the only one. IXL Learning faces a class action lawsuit for allegedly monetizing children's data without parental consent. The pattern is consistent: collect behavioral data from students, package it, and either serve targeted ads or sell the data to entities that do.
Freemium acquisition. Free tiers serve as customer acquisition channels. Once a school is locked into a platform, paid upgrades follow. Subscriptions typically account for 40-60% of revenue, with transaction fees covering another 20-30%. The free tier is not the product. It is the funnel.
AI model training. This is the newest and least transparent revenue stream. Consumer AI tools routinely use input data for model training. Education-specific tools like ChatGPT Edu, MagicSchool, and Khanmigo claim they do not train on student data, but claims are not contracts, and oversight is thin. A 2025 survey by the Consortium for School Networking (CoSN) found that 43% of school districts lack any formal policy governing AI use, meaning there is no institutional framework for verifying vendor claims about data handling.
- "We don't sell student data"
- "Data is used only for educational purposes"
- "We comply with FERPA and COPPA"
- "Student privacy is our top priority"
- 96% of school apps share data with third parties
- 78% of shared data goes to ad/analytics companies
- Only 26% of edtech products meet minimum safeguards
- 89% of pandemic edtech surveilled children outside school
When Collected Data Gets Stolen
Data collection is one problem. Data theft is another, and the breach record in education is brutal.
PowerSchool: The Largest Children's Data Breach in U.S. History
In December 2024, attackers gained access to PowerSchool's systems. By the time the breach was disclosed in January 2025, 62 million student records and approximately 10 million teacher records had been compromised. The stolen data included Social Security numbers, medical conditions, Individualized Education Programs (IEPs), and disciplinary records. These are the most sensitive categories of student information that exist.
The perpetrator was ultimately sentenced to four years in prison and ordered to pay $14 million in restitution. But the damage was done. Social Security numbers cannot be changed. Medical information cannot be un-leaked. For millions of students, some of them children in elementary school, their most private data entered the permanent ecosystem of stolen records.
Illuminate Education: Two Years of Silence
In a separate incident, Illuminate Education suffered a breach affecting 10.1 million students. The company had stored student data in plain text, without encryption. Worse, Illuminate delayed notifying affected school districts for nearly two years. The company became the first to be removed from the Student Privacy Pledge, a voluntary commitment that had been managed by the Future of Privacy Forum since 2014.
Enforcement Actions in 2024
State regulators have begun to act more aggressively. In 2024, New York State levied penalties against rSchoolToday ($120,000) and Raptor Technologies ($167,000) for student data privacy violations. These amounts are modest compared to the scale of the data involved, but they signal a shift toward treating student data breaches as enforcement priorities rather than administrative footnotes.
The Global Picture
In May 2022, Human Rights Watch published an investigation of 164 EdTech products endorsed by governments in 49 countries during the COVID-19 pandemic. Of the 163 products they examined in detail, 89% (145 products) either actively surveilled children or had the capability to do so outside of school hours.
These 145 products collectively sent data to 196 third-party companies, the overwhelming majority of which were advertising technology firms. The products had been endorsed by governments, recommended by education ministries, and in many cases made mandatory for students during pandemic lockdowns. Students could not opt out of surveillance because they could not opt out of school.
Google in the Classroom
Google Classroom deserves its own examination, because its dominance is unmatched. Nearly 70% of K-12 schools in the United States use it.
Google's position has drawn sustained scrutiny. In December 2015, the Electronic Frontier Foundation filed an FTC complaint alleging that Google was data mining school children through its education products. Google has maintained that "none of the information in Workspace for Education is used for targeted advertising."
But in April 2025, the lawsuit Schwarz v. Google LLC raised new concerns: the complaint alleges that Chrome creates hidden digital "fingerprints" that track users, including students, in ways that extend beyond what Google discloses. The case is ongoing, but it illustrates a recurring pattern. The gap between what companies say about student data and what they actually do with it tends to widen under legal scrutiny.
The Voluntary Era Is Over
The voluntary era of student data privacy is ending. The Student Privacy Pledge, which was the industry's primary self-regulatory mechanism, was retired in April 2025 by the Future of Privacy Forum after ten years. Its retirement was not a sign of success. It was an acknowledgment that voluntary commitments had failed to prevent systematic data misuse.
Federal regulators are stepping in. The FTC issued a policy statement in 2022 explicitly warning that it would increase COPPA enforcement against EdTech companies. Updated COPPA rules took effect in June 2025, with full compliance required by April 2026. These updates expand the definition of personal information, tighten consent requirements, and impose new obligations on how companies handle children's data.
Meanwhile, Common Sense Media's Privacy Program has evaluated over 400 EdTech products. The results are sobering: only 26% met minimum safeguards and earned a "Pass" rating. The remaining 74% received a "Warning," meaning the majority of tools used in schools today do not meet a basic standard of data protection as defined by an independent evaluator.
What Schools Can Do Right Now
Teachers and administrators aren't powerless here, but they need to be more skeptical than most have been trained to be. These recommendations draw from guidance by the Electronic Frontier Foundation, the Future of Privacy Forum, Common Sense Media, and Human Rights Watch.
Minimize data collection at every level. Before adopting any tool, ask what data it collects and whether that data is necessary for the educational purpose. If a flashcard app wants access to location, contacts, and the camera, the answer should be no.
Use Common Sense Media's Privacy Seal as a trust signal. It is not perfect, but the Common Sense evaluation process is the most rigorous independent assessment available. A product without a passing rating should face additional scrutiny before adoption.
Vet AI tools using the Future of Privacy Forum's guidance. FPF published specific guidance in October 2024 for evaluating AI tools in education. Key questions include: Does the tool train on student input? Where is data stored? What happens to data after the contract ends? If a vendor cannot answer these questions clearly, the tool should not be used with students.
Establish formal AI policies. With 43% of districts lacking any AI use policy, the most basic step is also the most urgent. Teachers are already inputting student information into AI tools. A 2024 Chalkbeat investigation found that educators routinely share student data with AI platforms without understanding the data practices involved. A district-level policy creates accountability and provides teachers with the institutional backing to push back on tools that do not meet privacy standards.
Demand transparency from vendors. Ask for a clear, written explanation of the company's data practices. Not marketing language, but the actual data processing agreement. If a vendor's terms of service are longer than their privacy policy, that is a red flag.
Paying for the Product vs. Being the Product
The EdTech industry has a structural problem: the most common business models depend on extracting value from student data. The alternative is to pay for products that treat student data as a liability to be minimized rather than an asset to be monetized.
At Limudi, we built our platform on a simple premise: student work belongs to students. We do not sell data, we do not serve ads, we do not train AI models on student input, and we do not share information with third-party analytics companies. Our typing-pattern analysis for authenticity verification is processed in real time. The behavioral data is used to generate a score, not to build a profile.
We made these decisions at the architecture level, not as features bolted on later. When 96% of school apps share student data with third parties, not sharing should be the baseline, not a selling point. Read our full privacy policy or try Limudi free.