Utah study finds school apps sharing student data
THE BRIEF
A two-year Utah investigation found that some educational technology apps collected information not described in their privacy agreements and shared data with third parties, including advertisers. The Utah State Board of Education worked with Brigham Young University and Internet Safety Labs to compare policy promises with network traffic from 100 apps used in schools during the 2023–2025 study period. Researchers reported that vendor behavior varied: many companies engaged with questions and made corrections, while others did not respond satisfactorily. The study does not mean every school app behaves the same way, and its findings should not be generalized beyond the tested products and period. It does show why contracts and privacy policies alone are weak evidence of what software actually sends once installed. Student information can support long-lived profiles because children use education services over many years and rarely choose the vendors themselves. Schools therefore carry a special duty to test data flows, limit collection and require vendors to explain every third-party connection.
WHY IT MATTERS
Children cannot meaningfully negotiate the privacy terms of software selected by a school. If an app sends unexpected identifiers, usage details or device information to advertising and analytics services, the effect may continue beyond a single lesson. The report also exposes a governance gap: procurement can approve a product based on paperwork while the live application behaves differently. Periodic technical testing, vendor remediation deadlines and deletion requirements turn student privacy from a contract clause into an operational control.
WHO SHOULD CARE
Parents, schools, teachers, education authorities, data-protection officers, procurement teams, privacy regulators and vendors that build, supply, host or integrate classroom applications and student-information services. used by children.
WHAT TO DO NOW
- Inventory classroom apps and identify the data each one sends to third parties.
- Compare observed network traffic with contracts and privacy commitments.
- Disable unnecessary advertising identifiers, analytics and software-development kits.
- Require remediation, deletion and breach-notification terms before renewal.
VERIFICATION NOTE
Verified against the Utah State Board of Education report prepared with Brigham Young University and Internet Safety Labs. The findings concern the tested Utah EdTech apps and 2023–2025 study period; they should not be generalized to every school app.
