Popular School Apps May Be Sharing Student Data with Advertisers, Investigation Finds
A two-year investigation into educational technology apps used by Utah schools revealed that over half collected data beyond their privacy agreements, with many transmitting student information to advertisers.
An extensive two-year investigation into educational technology (EdTech) applications utilized by schools in Utah has uncovered significant privacy concerns, with a substantial portion of these apps reportedly sharing student data with third parties, including advertisers, often in ways that appear to contradict their stated privacy commitments.
The study, a collaboration between the Utah State Board of Education, Brigham Young University, and Internet Safety Labs, meticulously examined the network traffic of 100 EdTech apps between 2023 and 2025. Unlike traditional assessments that rely solely on privacy policies or vendor assurances, this research delved into the actual data transmissions occurring while the applications were in use, providing a more accurate picture of data handling practices.
Researchers found that out of 85 apps with relevant data privacy agreements, more than half (52%) were observed collecting at least one type of student data that was explicitly prohibited by their agreements. Across the entire sample of 100 apps, a striking 61% were found to be sharing data with third parties, and a concerning 36% were transmitting data directly to advertisers.
This divergence highlights a critical gap between contractual obligations and actual application behavior. While a school district may have a robust data privacy agreement with an EdTech provider, the app itself might embed third-party analytics, advertising services, or other components that surreptitiously transfer data without the school's knowledge or explicit consent.
The investigation underscored the necessity of technical testing, such as analyzing live network traffic, to uncover data handling practices that might be missed by reviewing privacy policies alone. The report concluded that such in-depth technical scrutiny is essential for exposing potential non-compliance that standard review processes often overlook.
In response to these findings, Utah has enacted new legislation, H.B. 55, Privacy Compliance for Education Technology Vendors (2026), which took effect on July 1. This law mandates stronger student data protections within vendor contracts, requires notification to vendors of unauthorized data use, and allows for contract termination if privacy violations are not rectified after notification.
The implications of this investigation extend far beyond Utah. It serves as a critical reminder for all school systems to rigorously assess the data practices of the EdTech tools they employ. Protecting student data requires a multi-faceted approach that includes maintaining accurate inventories of software, establishing clear contractual boundaries, and possessing the technical expertise to verify vendor compliance.
This research emphasizes that relying solely on privacy policies is insufficient for safeguarding sensitive student information. Proactive technical validation and ongoing monitoring are paramount to ensuring that educational technology serves its intended purpose without compromising student privacy.