Student data privacy is about what information schools and their technology vendors collect about students, who can see it, how long it is kept and how well it is protected. Schools now collect far more than most families realize. Nearly every part of the school day leaves a digital record, much of it stored by private companies, and the risks became concrete in December 2024, when a breach at the student information system provider PowerSchool exposed records of tens of millions of students.
What data do schools collect?
Academic data. Beyond grades and test scores, learning platforms can record how long a student spends on each question, the order in which they work through tasks and which passages they reread.
Behavior and discipline records. Schools log suspensions, tardies and behavior notes. Some systems include narrative descriptions that follow students from school to school.
Device and network activity. When students use school-issued laptops or district Wi-Fi, filtering and monitoring tools can log browsing history, search terms and app activity. These tools are usually installed for safety, but they collect far more than families tend to expect.
Communications. Email, chat and messages inside learning platforms are archived, and monitoring software may scan them for warning signs.
Biographical and demographic information. Enrollment systems store addresses, family contacts, languages spoken, race and ethnicity, disability status and income-related information needed for federal reporting.
Health and wellness data. Records include immunizations, nurse visits, counseling notes and special education documents. Some districts use outside screening tools that collect students’ answers to mental health surveys.
Campus security data. Cameras, door-entry systems and bus trackers create records of where students go. A few districts have tried facial recognition: Lockport City School District in New York switched on a $1.4 million system in 2020 and stopped using it later that year, and New York banned facial recognition in schools in 2023 after a state report found the risks may outweigh the benefits.
Family information. Parent contact details, custody documents and financial forms for meal or fee programs are often stored in the same systems.
Why districts gather all this information
Districts usually collect data for practical reasons: to comply with state and federal reporting rules, to run attendance, transportation and meal programs, to improve instruction and to watch for threats or signs of self-harm. Each system makes sense on its own. Together, they create detailed records that few districts have the staff or safeguards to manage well.
The laws that protect student data
Three federal laws set the baseline:
- FERPA, the Family Educational Rights and Privacy Act, gives parents the right to see their children’s education records, to ask for corrections, and to some control over who receives personally identifiable information from those records. The rights transfer to the student at age 18 or when they enter college.
- PPRA, the Protection of Pupil Rights Amendment, covers surveys and evaluations that ask students about eight protected areas, including political beliefs, mental health, sexual behavior, religious practices, family relationships and income.
- COPPA, the Children’s Online Privacy Protection Act, governs online services that collect personal information from children under 13. The Federal Trade Commission’s amended COPPA rule took effect June 23, 2025, with most companies required to comply by April 22, 2026. It requires separate parental consent before children’s data is shared with third parties such as advertisers, bars keeping children’s data indefinitely, and adds biometric and government-issued identifiers to the definition of personal information. The FTC did not adopt proposed changes aimed specifically at education technology.
Many states have added their own student privacy laws, often limiting how education technology companies may use student data. The Future of Privacy Forum keeps a state-by-state tracker.
The risks to students and families
Data breaches. Schools are frequent targets. The Center for Internet Security analyzed more than 5,000 K-12 organizations and found that 82 percent of reporting schools experienced cyber threat impacts between July 2023 and December 2024, with 9,300 confirmed incidents. The PowerSchool breach exposed data on 62.4 million students and 9.5 million teachers from 6,505 school districts; the 19-year-old responsible was sentenced in October 2025 to four years in prison and ordered to pay $14 million in restitution. Districts reported that grades and medical information were among the records accessed, TechCrunch reported.
Oversurveillance. Monitoring tools can flag innocent searches or ordinary teenage behavior, and those flags can lead to discipline. In a 2022 Center for Democracy and Technology survey reported by The 74, 89 percent of teachers said their schools used monitoring tools. Among teachers in those schools, 78 percent said the tools had flagged students for discipline, and 44 percent of all teachers said students had been contacted by police because of monitoring.
Unclear data sharing. Vendors may use de-identified data for product development or research, and districts may share records with outside agencies. Families are rarely told when this happens.
Long-term consequences. Old behavior notes, inaccurate flags or archived messages can follow students through school if they are not reviewed and deleted on a schedule.
Equity concerns. Students from low-income families depend more on school-issued devices, so more of their activity is logged. In the same CDT survey, 48 percent of Black students and 55 percent of Hispanic students said they or someone they knew had gotten in trouble for something monitoring software flagged, compared with 41 percent of white students.
Loss of trust. When families learn how much is collected, many feel blindsided, and students may change how they research or communicate because they believe someone is always watching.
What strong protection looks like
- Collect only what is needed for teaching, safety or operations.
- Write strict vendor contracts: encryption, breach notification, deletion timelines and a ban on using student data for advertising or unrelated purposes.
- Invest in cybersecurity basics: multifactor authentication, regular updates and tested backups.
- Tell families plainly what is collected, who sees it and how long it is kept.
- Set clear rules for monitoring tools: what is flagged, who reviews flags, and when police may be involved.
- Teach students how their data is used and how to protect themselves online.
Frequently asked questions
What is FERPA? A federal law that gives parents, and students once they turn 18, the right to see and request corrections to education records and some control over who receives them.
Does COPPA apply to schools? COPPA applies to companies that collect personal information online from children under 13, including many education technology providers. The FTC’s 2025 update did not add new school-specific rules.
Can my school see what I do on my personal account at home? Monitoring software on a school-issued device or school account can record activity on that device or account wherever it is used, including at home. What a school can see beyond its own devices and accounts depends on the tools it uses, so families can ask the district for its monitoring policy.
Who owns student data? Under FERPA, education records are maintained by the school, but parents and eligible students have rights to see, correct and control the disclosure of them. Vendor contracts should state that the district, not the vendor, controls student data.
Student data privacy: the bottom line
Schools hold some of the most detailed records that exist about children and their families. Most of it is collected for good reasons, but the risks are real, as the PowerSchool breach showed. Protecting student data privacy takes careful collection, strong contracts, real security and honest communication with families.
Subscribe to edCircuit to stay up to date on all of our shows, podcasts, news, and thought leadership articles.
Related reading
More on Cybersecurity
