A lawsuit accusing education technology company Curriculum Associates of improperly collecting student information through its i-Ready platform has intensified debate over how schools handle student data and whether existing privacy laws are keeping pace with the rapid expansion of educational technology.

Two California parents filed suit alleging the company collected students’ personal information and shared it with third parties for commercial purposes without obtaining proper parental consent.

The company holds a $20 million contract with the Los Angeles Unified School District (LAUSD).

One of the plaintiffs, Lila Byock, has two children in LAUSD. The other, Nicki Petrossi, has children who attended class in the Fullerton School District.

“Like most parents, I assumed the software was simply helping teachers assess academic progress,” Petrossi told The Defender. “I had no idea that the program was collecting extensive information about my children.”

The complaint alleges violations of California privacy laws and the federal Children’s Online Privacy Protection Act. It also claims the company was unjustly enriched through its data-collection practices.

Petrossi added:

“I never consented to a private company collecting extensive personal information about my children while they were attending public school. I certainly never believed that participation in a public education would require my children to surrender their personal information without my informed consent. Parents should never have to choose between their child’s education and their child’s privacy.”

Curriculum Associates, which denied the allegations, did not respond to numerous requests for comment from The Defender. Lawyers for the company did not answer questions either.

The company published a statement on its website:

“A civil lawsuit has been filed involving i‑Ready. A number of education technology providers have been targeted by similar civil lawsuits. The claims in the litigation against us are legally meritless. We do not sell student data to third parties, use student data for advertising, or build commercial profiles on students.”

The case has nonetheless rekindled arguments over how student information is collected, stored and shared.

What is i-Ready?

Since the private-equity-backed Curriculum Associates released its i-Ready application in 2011, it has dominated public school classrooms across America. The technology is used by nearly one-third of kindergarten to 12th graders nationwide, reaching nearly 14 million students.

The platform targets children who are trailing in their studies. The application adapts math and reading assessments to customize questions based on students’ responses. The platform then identifies these students so they can get tailored help before taking standardized tests with the stated goal of raising scores.

According to the lawsuit, the company also collects information that includes students’ race, gender, grade level, assessment responses, time spent answering questions, IP addresses, school names, disability status and eligibility for free or reduced-price lunches.

The plaintiffs argue they were not adequately informed about the scope of the data collection.

Curriculum Associates maintains that it discloses its data practices to school districts and obtains consent through its school customers.

EdTech firms prey on fears around school shootings, suicide and bullying

The i-Ready app is only part of a larger ecosystem of student data collection.

A 2022 report from the nonprofit Internet Safety Labs (ISL) found that 96% of apps used in K-12 classrooms share student data with third parties, raising concerns about the privacy practices of educational technology and the need for stronger vetting by school districts.

The ISL’s “K-12 EdTech Safety Benchmark: National Findings — Part 1” analyzed 1,357 apps recommended across 663 schools in all 50 states and the District of Columbia, representing an estimated 455,882 students. Researchers collected roughly 88,000 data points on apps and more than 29,000 data points on schools.

The report found schools recommended an average of 125 technologies each, with schools that had formal vetting processes averaging 172 apps.

About 78% of the apps that shared data did so with advertising or data analytics companies, often without users’ consent, according to the report. Researchers found some of the greatest privacy risks in customized school district apps.

In 2023, the American Civil Liberties Union (ACLU) released a report on educational technology, urging schools to reconsider the use of student-monitoring applications. The report, “Digital Dystopia: The Danger in Buying What the EdTech Surveillance Industry is Selling,” documented significant privacy, mental health and equity concerns.

The ACLU contends that education technology companies have capitalized on fears surrounding school shootings, suicide and bullying to market surveillance products to school districts.

The ACLU said more than $300 million in federal funding has been directed toward school safety initiatives, creating a growing market for student-monitoring software and surveillance systems.

Chad Marlow, a senior policy counsel at the ACLU, helped author the report. He said educational technology companies often fail to disclose the potential harms of collecting extensive student data, particularly for vulnerable populations. Meanwhile, schools divert funding from proven interventions such as counselors and other student supports.

“It’s not because the technology is better,” Marlow told The Defender. “It’s because it’s better marketed.”

Marlow said school districts should first identify the specific problem they are trying to solve before considering whether technology is the appropriate solution.

“Too often these technologies approach schools in a marketing context: ‘Here’s this great product. Do you want to buy it?’” he said. “Instead, schools should thoughtfully identify the problem they’re trying to solve and ask whether this technology actually solves that problem.”

Marlow said the ACLU began researching student surveillance before the COVID-19 pandemic, but the use of education technology accelerated dramatically as schools shifted to remote learning.

“The concern with these technologies is they come in under the guise of helping students and helping teach them,” he said. “They make huge promises about their effectiveness, but there’s very little independent evidence verifying they actually do what they claim.”

Marlow also urged schools to scrutinize how much student information is collected and whether all of it is necessary.

If a student needs “more education on a subject,” then teachers can collect the data to help them, but “the company does not need to collect it or share it,” he said.

Not all privacy experts agree

Not all privacy experts believe school technology itself is harmful, and some suggested that the legal facets of the i-Ready lawsuit should be scrutinized fully before making assumptions.

Data privacy consultant Linnette Attai cautioned against concluding the facts in the lawsuit are established, noting that assertions against i-Ready remain unproven.

“It’s important to remember that allegations are not facts, and we don’t have real substance behind claims in the i-Ready lawsuit yet,” said Attai, founder of PlayWell LLC. “Time will tell where the facts lie and if there has been wrongdoing.”

Attai said laws allow schools to share student information with education technology providers but only under limited circumstances.

“Federal and state student data-privacy laws are designed to ensure that school districts are authorized to share student data with technology and other third-party service providers without parent consent only in very limited circumstances, never for a commercial purpose, and with notice to parents,” she said.

She added that education technology companies should collect only the information necessary to provide their services.

“The data elements required by any education technology provider should be the minimum needed to provide the services,” Attai said.

Attai also said criticism of a product’s design or implementation should not be confused with evidence of legal violations.

“It’s OK to not like a particular product or the way it’s implemented, and sometimes that criticism is warranted,” she said. “That doesn’t mean there’s been legal wrongdoing or privacy malfeasance. Right now, we have one side making allegations that the other side denies.”

‘Student data should never be sold, monetized or repurposed’

The lawsuit comes as U.S. schools continue to rely heavily on digital learning platforms, a trend accelerated during the COVID-19 pandemic.

The global education technology market has grown into a multi-billion-dollar industry, with companies providing online assessments, instructional software and learning analytics to school districts nationwide.

Some legal experts believe the student information economy is being reshaped.

Attorney John Whitehead, president of The Rutherford Institute, said the programs like i-Ready are “turning America’s classrooms into data-collection environments.”

He added:

“From a civil liberties standpoint, the danger is not limited to one company or one lawsuit, but to a national system that allows private vendors to build detailed digital profiles of children with inadequate transparency and oversight.

“Student data should never be sold, monetized or repurposed beyond a clearly defined educational need. Schools should be places where children learn the meaning of freedom — not where they are conditioned to accept surveillance as the price of participation.”

Parents should have right to know what’s happening with their kids’ data

Kevin A. McGrail, a cybersecurity expert, said the U.S. already has several strong privacy statutes, but their implementation remains inconsistent.

“Privacy laws are good,” McGrail said. “But they need people pushing the enforcement.”

McGrail said lawsuits involving education technology companies are likely to continue and cautioned that consumers often unknowingly consent to broad data-sharing provisions buried within terms and conditions.

“If that clause is there, we then say, ‘Too bad, so sad, you agreed to having your information sold,’” McGrail said, noting that courts frequently enforce contractual terms users have accepted.

Whether the California lawsuit ultimately succeeds may depend on how courts interpret parental consent requirements under federal and state privacy laws. Regardless of the outcome, legal experts and privacy advocates say the case reflects increasing public scrutiny of how educational technology companies collect, retain and use children’s personal information.

For Petrossi, who co-founded Tech-Safe Learning Coalition, the issue revolves around transparency and accountability.

“This case is bigger than one company or one educational product,” she said. “It is about whether parents have the right to know what is happening with their children’s data in school and whether they have meaningful control over those decisions. I believe the answer is yes.”

[…]

Via https://childrenshealthdefense.org/defender/how-much-data-are-edtech-firms-collecting-from-kids-schools-who-owns-it-lawsuit-iready/?utm_id=20260809