For every aspect of a student\u2019s life, there\u2019s a tech company trying to digitize it. Inside the classroom, online tools proctor exams, create flashcards and submit assignments. Outside, technology coordinates school sports, helps bus drivers find the right route and maintains students\u2019 health records.<\/p>\n
California has a number of laws aimed at protecting children\u2019s data privacy, but those laws have exceptions that allow many tech companies to continue packaging and selling students\u2019 personal information.<\/p>\n
This year, Assemblymember Dawn Addis<\/a>, a San Luis Obispo Democrat, is carrying a high-profile state bill that would add new protections for students. She says it\u2019s important, especially as the Trump admin is trying to collect data about California residents\u2019 immigration status<\/a>, gender identity<\/a> and their use of certain public benefits.<\/a><\/p>\n Historically, California has been a leader in data privacy. In 2014, California passed a landmark student privacy law<\/a> that prohibited technology companies from selling students\u2019 data, targeting students in advertising or disclosing their personal information. Then in 2018, the state passed another unprecedented bill that required all companies give California users certain privacy rights, such as a chance to opt out <\/a>of data collection and delete some of their information.<\/p>\n But as technology evolved and proliferated, privacy laws repeatedly fell short in protecting California\u2019s students \u2014 at the same time that the federal government has tried to collect increasing amounts of personal information, Addis said.<\/p>\n Her bill<\/a> would restrict how AI companies use student data and create new data protections for college students. Some of Sacramento\u2019s most powerful players are paying close attention to the measure, including the California Labor Federation<\/a>, which supports the bill, and the California Chamber of Commerce<\/a>, which opposes it. Combined, these two groups spent nearly $8 million on campaign donations to state legislators or other political activities in 2024, according to the CalMatters Digital Democracy database. TechNet, a trade association that represents many of the most powerful tech companies<\/a>, also opposes the bill.<\/p>\n The proposal, Assembly Bill 1159, would close certain loopholes in the state\u2019s 2014 education privacy law, but experts say it may not be enough to prevent companies from selling students\u2019 data.<\/p>\n A privacy expert struggles to keep her information private<\/p>\n Jen King is a privacy and data policy fellow at Stanford\u2019s institute for AI, where she studies the tricks that companies use to gather users\u2019 data and prevent them from opting out, sometimes known as \u201cdark patterns.\u201d In her personal life, she\u2019s vigilant about avoiding online data tracking and maintains a landline in her Bay Area home to avoid giving out her cell phone number.<\/p>\n King doesn\u2019t want her children\u2019s information available online or for any company to sell, though sometimes it happens before she can stop it.<\/p>\n In the fall, King got an email about a platform called TeamSnap, which her 12-year-old son\u2019s cross country coaches were using to manage the team\u2019s roster. The company wanted her information, including her name, date of birth, gender, email address and phone number. Once she logged in to the platform, she could see some of her son\u2019s information, such as his name, email and date of birth, were already listed. Photos and personal information from all of her son\u2019s teammates were also available for her to see.<\/p>\n \u201cI was super irritated,\u201d she said. \u201cYou don\u2019t need my birth date \u2014 I\u2019m a freaking parent.\u201d She acknowledged some personal information could be useful for a coach but said that other questions seem designed to help the platform sell information to data brokers and ultimately, to advertisers.<\/p>\n Her 17-year-old son\u2019s data is also on TeamSnap, she later learned, because his robotics team uses it. This month, when King tried to show CalMatters her TeamSnap account, a pop-up appeared, asking her if the company could track her activity across other apps and websites.<\/p>\n Federal law requires companies to get parental consent before knowingly collecting or selling data from children 12 and under<\/a>, but once a child turns 13, their data is generally treated much like an adult\u2019s information, especially when that child is interacting with tech platforms outside of school. TeamSnap\u2019s privacy policy says<\/a> it doesn\u2019t knowingly collect personal information about users under 13 \u201cwithout express parental consent,\u201d though it says in some cases a team or organization may provide information on behalf of the child.<\/p>\n The policy also says that TeamSnap has \u201cnot sold the personal information of any consumer for monetary consideration\u201d in the last 12 months, but that its \u201cuse of cookies and other tracking technologies may be considered a sale of personal information under the CCPA (California privacy law).\u201d Information sold to advertisers and marketers included users\u2019 names, contact information, purchase history and geolocation, the policy says.<\/p>\n California privacy law specifically requires certain large for-profit companies to get consent to collect data from anyone under 16. Often, consent happens when a user first opens a website and a pop-up appears, asking if the website can sell your data or track your cookies.<\/p>\n If a teacher, coach or other authority figure tells a student that they have to use a website or an app, then the student cannot realistically opt out, King said. They may be too young to understand how to opt out, she added. \u201cMost 15-, 16-year-olds don\u2019t have any idea what this is about.\u201d<\/p>\n Even older college students may have little agency in the technology they use, especially if it\u2019s required for class or residential life. At Stanford, for example, King said her undergraduate students are often required to create Facebook accounts for student groups.<\/p>\n The same is true for parents. King said she reluctantly gave TeamSnap her personal information, including her name, email, date of birth and the landline number for her home, because it was the only way to get updates about her son\u2019s team.<\/p>\n How companies get around California\u2019s education privacy laws<\/p>\n In 2014, California became the first state in the country to regulate education technology companies directly, but being first comes with its drawbacks. \u201cWe didn\u2019t have examples of what best practice was,\u201d said Amelia Vance, the president of the Public Interest Privacy Center, a nonprofit organization. The law only applies to products that \u201cprimarily\u201d serve K-12 schools and that are designed and marketed for students.<\/p>\n Many tech companies argue that their products aren\u2019t primarily intended for students or at least that they were not designed or marketed that way. The language-learning app Duolingo, for example, has a version for schools<\/a>, but the app is also popular with adults. Apps or technologies serving extracurricular programs or sports teams can claim they weren\u2019t designed and marketed for the classroom, or that their use isn\u2019t mandatory, said Vance. \u201cYou have this sort of black hole where there haven\u2019t been protections.\u201d<\/p>\n Addis\u2019 bill expands the number of education technology companies that fall under the state\u2019s student privacy laws, but the language is murky when it comes to apps or online services used outside of class.<\/p>\n In the case of TeamSnap, Addis\u2019 communications director Alexis Garcia-Arrazola said the company would \u201cmost likely\u201d fall under the scope of the bill if its technology is marketed to schools, if schools direct students to use it, and if the sports team is sponsored by the school.<\/p>\n Public records show that Piedmont Unified School District in Alameda County, Tamalpais Union High School District in Marin County, and Santa Monica-Malibu Unified School District all purchased versions of TeamSnap, but only the Santa Monica-Malibu district responded to CalMatters\u2019 questions about any privacy restriction imposed on the company. Brandyi Phillips, the chief communications officer for the Santa Monica-Malibu schools, said the district has an annual subscription with TeamSnap, which is only available to sports staff and parents. She said there\u2019s an agreement with the company \u201cto protect District information and to prevent unauthorized access\u201d but did not clarify if that agreement prevents the district from selling students\u2019 information.<\/p>\n Berkeley Unified School District, where King\u2019s children attend school, did not respond to CalMatters\u2019 questions about any contracts, purchase orders or agreements with TeamSnap.<\/p>\n Locally, school districts and colleges have the power to negotiate the privacy terms of any contract they make with a technology company, but many websites and apps offer free versions that a teacher or coach might recommend without getting formal approval from their district.<\/p>\n Last year, the California State University system signed a nearly $17-million contract <\/a>with OpenAI, the company that operates ChatGPT, including an agreement that the company will not train its models on student data. Advocates for Addis\u2019 bill say the same privacy restrictions should apply to any AI company with access to California student data, regardless of whether the company has an agreement with the student\u2019s school district or college.<\/p>\n Are privacy laws getting stricter or looser?<\/p>\n Addis\u2019 bill comes as privacy laws in California and across the country are in flux. In 2020, California voters approved a proposition<\/a> to create a new state agency to enforce data privacy rules and regulate the businesses that collect data. Advocates for the proposition contributed over $6.7 million to the campaign, compared to just over $50,000 contributed by the opposition, according to state data<\/a>. The state agency that the proposition formed, now known as CalPrivacy, released new rules this year, restricting the use of automated decision-making technology, such as the use of AI to make admissions or hiring decisions. Those rules were originally stricter but businesses, lawmakers and Gov. Gavin Newsom pressured the CalPrivacy board to water them down<\/a>.<\/p>\n In Washington, Congress is considering changing federal law to limit how companies interact with children under 17<\/a>. Separately, Congress is considering a bill that would require social media companies to prevent and mitigate children\u2019s sexual exploitation, bullying and self-harm. California Atty. Gen. Rob Bonta is concerned that one version of the social media bill contains language that could erode existing protections<\/a> in California law.<\/p>\n Bonta\u2019s office is responsible for enforcing many of the state\u2019s existing privacy laws. In November, he said the state worked with Connecticut and New York to reach $5.1 million in settlements against Illuminate, an education technology company that uses data to track and evaluate students\u2019 progress, such as their testing scores and developmental milestones. The company had a data breach, exposing \u201csensitive information\u201d from over 434,000 California students, the state attorney general\u2019s office said in a statement<\/a>.<\/p>\n It was the first time California successfully went after a company for violating the state\u2019s landmark 2014 education privacy law.<\/p>\n To increase enforcement, Addis\u2019 bill contains a new provision \u2014 the right for students and parents to sue tech companies in certain cases for privacy violations. Business and technology groups have opposed the bill, arguing that the new regulations and the right to sue would stifle investment in AI-powered learning tools.<\/p>\n King said that giving consumers the right to sue is often the only way to increase enforcement. Otherwise, the onus is on individual consumers to find concerning practices and try to opt out.<\/p>\n Despite being an expert in data privacy, King said that she struggled at first to figure out how to delete her TeamSnap account, only later to discover that she needed to send an email to the company. She laughed at the irony, since it\u2019s these kinds of dark patterns in user design that fuel part of her research.<\/p>\n In academia, the strategy of trapping customers is sometimes called the \u201croach motel,\u201d she explained, a reference to a popular television ad from the late 1970s for a cockroach trap.<\/p>\n \u201cYou can check in,\u201d she said, \u201cbut you can never check out.\u201d<\/p>\n