Classrooms Without Curtains: How Ed-Tech Platforms Are Turning Student Behavior Into a Tradeable Asset
Every morning, across tens of thousands of American public schools, children as young as five open Chromebooks, tablets, and district-managed laptops and begin their school day. They read, they search, they struggle through math problems, they message classmates. What most of them—and many of their parents—do not realize is that each of those interactions is being logged, analyzed, and in many cases packaged for commercial purposes by a constellation of vendors whose business models depend on data that never belonged to them in the first place.
This is not a hypothetical threat. It is the operational reality of a multi-billion-dollar educational technology industry that has quietly embedded itself into the infrastructure of American public education, often with the tacit blessing of cash-strapped school districts grateful for free or subsidized tools.
The Architecture of Collection
The modern K–12 technology stack is rarely a single product. A typical district might deploy a learning management system, a reading assessment platform, a math tutoring application, a behavior-tracking tool, and a suite of productivity software—each from a different vendor, each governed by its own terms of service, and each capable of collecting data independently.
Researchers at the Electronic Frontier Foundation and the nonprofit Center for Democracy and Technology have documented how these platforms routinely capture far more than academic performance metrics. Keystroke patterns, time-on-task measurements, browsing histories within school networks, emotional-state inferences drawn from writing samples, and even physical location data from GPS-enabled devices are among the categories that appear in vendor privacy policies—buried in language that few parents ever read and fewer still understand.
The aggregation problem compounds the individual risk. A single data point—say, a child's reading level at age nine—is relatively benign. But combine it with behavioral flags from a classroom management tool, health disclosures entered into a district wellness portal, and demographic identifiers, and the resulting profile takes on a character that resembles the kind of dossier that data brokers compile on adults. The difference is that the subject is a minor who never consented to any of it.
The Regulatory Gap
Federal law does provide a framework. The Family Educational Rights and Privacy Act, known as FERPA, restricts the disclosure of student education records and grants parents the right to review them. The Children's Online Privacy Protection Act, or COPPA, requires verifiable parental consent before collecting personal data from children under thirteen. Several states have enacted additional student privacy statutes of their own.
But the gap between what the law says and what the market does is substantial. FERPA's school official exception permits vendors to access student records without parental consent so long as they are performing a service on behalf of the district—a carve-out that critics argue has been stretched far beyond its original intent. COPPA's enforcement relies heavily on the Federal Trade Commission, an agency with limited resources and a historically reactive posture toward ed-tech.
A 2023 review by the Electronic Privacy Information Center found that a significant proportion of the most widely used educational platforms shared data with third parties in ways that were not clearly disclosed to school districts at the point of contract. Many of those third parties were advertising technology firms and data brokers with no discernible educational mission.
What Happens After the Bell Rings
The downstream consequences of student data collection extend well beyond the school day. Data that is collected during a child's formative years does not necessarily expire when that child turns eighteen. Privacy researchers have raised sustained concerns about the persistence of behavioral profiles—the possibility that information gathered in a third-grade classroom could inform credit decisions, employment background checks, or insurance risk assessments years later.
The pathway from school device to data broker is not always direct. Vendors may sell aggregated or pseudonymized datasets to analytics companies, which in turn license insights derived from that data to other commercial actors. At each transfer, the connection to an individual child becomes more difficult to trace, and the legal accountability more diffuse. By the time a behavioral inference drawn from a ten-year-old's homework patterns surfaces in a commercial context, the chain of custody has typically been obscured beyond practical recovery.
Former ed-tech product managers who have spoken to privacy advocacy organizations describe internal cultures in which data monetization was treated as a secondary revenue stream, normalized through the framing of "product improvement" and "personalized learning." The language of pedagogy, in other words, has served as effective cover for practices that would draw immediate regulatory scrutiny in other consumer contexts.
The Parental Consent Fiction
Districts are generally required to notify parents when they deploy third-party technology platforms, but the quality of those notifications varies enormously. Consent mechanisms—where they exist at all—often take the form of passive opt-out provisions buried in annual enrollment paperwork, or blanket authorization clauses that grant the district authority to deploy any vendor tool it deems educationally appropriate.
Meaningful, informed consent—the kind that explains specifically what data is collected, by whom, for what purpose, and with what retention schedule—is the exception rather than the rule. Privacy advocates argue that this is not accidental. Genuine transparency would invite parental objection that could complicate vendor relationships and disrupt the flow of data that makes free or low-cost ed-tech products economically viable.
Pressure Points and Partial Remedies
There are signs that the political and regulatory environment is shifting. Several state legislatures, including those in California, New York, and Colorado, have moved to tighten student data privacy requirements, impose stricter vendor contract standards, and create mechanisms for data deletion upon request. The FTC has signaled renewed interest in COPPA enforcement, and congressional proposals to strengthen FERPA's consent requirements have attracted bipartisan attention, though none has yet advanced to passage.
District-level procurement reform is also gaining traction. Organizations such as the Student Data Privacy Consortium have developed model contract language designed to limit vendor data use to explicitly educational purposes, prohibit behavioral advertising, and require data destruction when a contract ends. Adoption remains uneven, but the framework exists.
For parents, the practical options are constrained but not negligible. Requesting a copy of the district's current vendor list under state public records laws, reviewing the privacy policies of any platform a child uses, and submitting formal data access and deletion requests under applicable state statutes are all steps that place modest but real pressure on an otherwise opaque system.
A Generation Observed
The children moving through American classrooms today are the first generation to have their developmental years comprehensively documented by commercial actors operating inside institutions designed to serve the public interest. The privacy implications of that reality will take decades to fully materialize—and by then, the data will long since have been copied, sold, and folded into systems that no deletion request can reach.
The surveillance capitalism model that reshaped consumer markets over the past two decades has found a new frontier in public education. The difference is that its subjects, in this case, are children who cannot evaluate the terms, cannot negotiate the conditions, and have nowhere else to go.
