FERPA Violation Examples in EdTech Integration Contexts

FERPA doesn't regulate EdTech vendors. It regulates schools that take federal money. That single fact explains almost every compliance failure in the K-12 tech stack, because the company holding the data is often the one with zero direct legal obligation to protect it.

Vendors get into student records through something called the "school official exception," a rule that lets a district treat a company like an employee for data purposes, as long as three boxes get checked: the vendor performs a service the school would otherwise do itself, the school keeps "direct control" over how the data gets used, and the vendor sticks to the purpose it was hired for. Miss any one of those three, and the disclosure is unlawful, no matter how much paperwork both parties signed. The exception either holds or it doesn't.

The vendor has no statutory FERPA obligation of its own. If something goes wrong, the institution eats the liability, even though the institution rarely has the technical ability to check what the vendor is actually doing with the data behind the login screen. Schools sign the contract, and vendors run the server, but the regulator calls the school first.

This exact same legal mechanism, the school official exception, is what lets a teacher pull up a gradebook and what lets an EdTech company ingest 40,000 student profiles. Same rule, wildly different risk profile, and that conflation is where a lot of well-meaning IT directors get tripped up.

How a Vague DPA Becomes a Loophole

A Data Processing Agreement is the document that turns "we handed a vendor our students' data" from a violation into something legal. To do that job, a DPA needs three things: a clearly stated permitted purpose, a flat prohibition on redisclosure, and audit rights for the district. Skip one of those, and the school has no lawful basis for the sharing, no matter how many signatures are on the document.

Per TechPolicy.Press (2025), fewer than 25% of school-vendor agreements actually specify the purpose of data disclosures. Three out of every four contracts leave the legal basis for handing over student data completely undefined. Undefined purpose means no enforceable limit on what happens next.

The gaps tend to repeat across procurement cycles:

• Purpose clauses that say "educational purposes" and stop there, defining nothing

• No language ruling out product improvement, ad targeting, or building profiles for non-educational use

• No deletion schedule, no requirement to return or destroy data when the contract ends

• No audit or inspection rights, meaning the district takes the vendor's word for it

Even a well-drafted DPA has a structural weakness, since it depends on the vendor to self-report when something has gone wrong. Districts almost never have the technical means to verify compliance independently.

When Vendors Use Student Data Unauthorized

Some uses fall outside the school official exception no matter what the contract says: advertising, product improvement, building a profile of a student that has nothing to do with their education. A DPA cannot authorize these uses, because they were never available to authorize in the first place.

The Edmodo case, brought by the FTC in May 2023, is the example every compliance officer should study carefully. The FTC alleged Edmodo collected personal data from kids under 13 without verified parental consent and used it for advertising. Edmodo argued that its terms of service made teachers solely responsible for COPPA compliance. The FTC called that argument "nonsensical" and rejected it. A $6 million civil penalty followed, suspended because Edmodo couldn't pay it.

The more significant consequence was the remedy: the FTC ordered Edmodo to delete "Affected Work Product," meaning any AI model or algorithm trained on the unlawfully collected data. Not audit it, not disclose it, but delete it entirely. That order established that a model trained on tainted data is itself tainted, and the vendor does not get to keep the model simply because the underlying data collection has stopped.

A platform cannot outsource its compliance obligation to a teacher's checkbox or a parent's consent form. The platform owns its own data practices. Free and freemium EdTech tools also carry a structural incentive to monetize student data, because the school is not paying enough, or anything, to sustain the business model otherwise.

AI Model Training Raises Unresolved FERPA Questions

The school official exception lets a vendor use education records for the "authorized purpose" of the service it is contracted to deliver. But if a company is hired to build an adaptive tutoring tool, does training an AI model on student performance data count as delivering the service, or is that a separate use requiring its own authorization?

No clear FERPA guidance has been issued on this question. The closest signal is the Edmodo deletion order, which strongly implies regulators treat model training as its own distinct act, not a natural extension of providing a contracted service.

The risk here is worse than a typical data leak, because once student information is incorporated into an AI training set, removing it is extraordinarily difficult and expensive. Unlearning is not a mature technology, and the harm does not reverse because someone catches the mistake after the fact. There is also a secondary risk: large language models trained on general internet data can inadvertently absorb student information if an EdTech platform never sanitized its inputs before feeding them into a training pipeline.

For districts negotiating contracts, "educational purposes" is no longer a phrase specific enough to be enforceable. DPAs need explicit language on whether student data can be used to train, fine-tune, or improve an AI model. Most contract templates currently in circulation were written before generative AI was integrated into EdTech products, which means most of them do not address the question at all.

Insecure Vendor Infrastructure Turns Gaps Into Exposures

A paperwork problem combined with an unencrypted database produces a much larger failure. The Illuminate Education breach illustrates exactly how that combination plays out.

Unauthorized access ran from December 28, 2021 to January 8, 2022, hitting student data across New York City and Los Angeles. In New York City alone, personal data belonging to 820,000 current and former students was exposed, which Education Week described as possibly the largest cyberattack on a school district in U.S. history. The exposed data included racial and ethnic profiles, test scores, disability status, behavioral incident records, and migrant status.

The FTC's investigation, resolved in December 2025, identified the specific failures:

• Student data was stored in plaintext in AWS S3 buckets, unencrypted, until at least January 2022

• No comprehensive incident response plan existed until November 2022

• No policy for inventorying or deleting unnecessary data existed until March 2022

• A third-party vendor had flagged security vulnerabilities as early as January 2020, and Illuminate failed to take adequate corrective steps

Two years of documented warnings went unaddressed. The FTC's order required Illuminate to build an actual data security program and delete data it did not need. The FTC's action had alleged hackers accessed data belonging to more than 10 million students. Separately, California, Connecticut, and New York reached a $5.1 million settlement with the company. The Future of Privacy Forum also removed Illuminate from the Student Privacy Pledge, the first company ever removed from that list. A voluntary privacy pledge is not a security audit and was never a substitute for one.

PowerSchool Breach Exposes Vendor Concentration Risk

Disclosed December 28, 2024, the PowerSchool breach compromised data tied to 62 million students and 9.5 million educators worldwide. The scale is notable, but the more important issue is what PowerSchool represents structurally.

PowerSchool serves roughly 75% of the K-12 education market, operating across more than 90 countries and over 18,000 schools in North America. When a vendor at that level of market penetration is breached, a district's own security posture becomes largely irrelevant, because there is no alternative system to fall back on.

The root cause was a single compromised credential on a customer support portal with no multi-factor authentication protecting it. That one password was the entry point for the exposure of names, birthdates, Social Security numbers, contact details, and limited medical information for millions of students and educators, with some districts reporting records going back more than 20 years.

PowerSchool paid a ransom to secure deletion of the stolen data. Months later, the Toronto District School Board, serving over 240,000 students, reported being extorted by a threat actor holding data samples that matched the December breach. The data was supposedly deleted, but it was not. That sequence illustrates why ransom payments provide no reliable assurance of deletion. PowerSchool's CEO had spoken at a White House cybersecurity summit in 2023, and the company had publicly positioned itself as a leader in K-12 data security. That reputation and the actual security posture diverged significantly, which is precisely why contractual audit rights matter more than public positioning.

Routine Workflow Failures Also Trigger FERPA Violations

Most FERPA violations have nothing to do with external attackers. They come from ordinary workflow failures: a teacher hits reply-all on a grade report, an administrator emails a transcript to the wrong address, a school publishes an honor roll without checking who opted out.

EdTech environments introduce additional failure points:

• Former students or staff who retain login access to systems holding active student records

• Roster syncs that lag behind actual enrollment, exposing data for students who have already left the district

• Missing export controls that allow any administrator to download and share student records with no logging or restriction

• Multi-system data chains where an LMS feeds a reporting tool, which feeds an AI system, which feeds a support platform, and no one has documented the agreements covering each handoff

Modern school technology stacks rarely operate within one system; student data moves through learning management systems, analytics tools, AI tutoring platforms, assessment software, and third-party integrations, often simultaneously. A DPA with the primary vendor covers that vendor specifically. It does not automatically extend to other tools that vendor connects to. Each node in the chain requires its own authorization, and in practice almost no one tracks this across a full district deployment.

Surveillance tools like GoGuardian and Gaggle generate a continuous stream of student data through real-time screen monitoring, message scanning, and behavioral flagging. The retention rules, access limits, and secondary-use policies governing that data stream are rarely defined in procurement agreements, because the questions are not asked and nothing is written down.

Delayed Breach Disclosure Creates a Second Violation

FERPA itself sets no notification deadline, but state laws increasingly do, and the FTC has shown it will act on delayed disclosure regardless. The Illuminate case is relevant here: the FTC alleged the company failed to notify districts within the timeframe it had promised, in some cases waiting nearly two years after the breach to communicate anything.

A 2024 to 2025 investigation by The 74, looking across more than 300 K-12 cyberattacks, found a recurring pattern: districts routinely gave families "incomplete, misleading or downright inaccurate information" about breaches, according to the Public Interest Privacy Center (July 2025). Two examples are instructive.

In Los Angeles, officials initially denied that student psychological evaluations were exposed in a 2022 ransomware attack, calling reports of exposure "absolutely incorrect." Later, they acknowledged that roughly 2,000 of those evaluations had been published online. In Minneapolis, officials first told families there was "no evidence" personal information had been compromised, then waited nearly two weeks to correct that statement, then took months more to send direct notification letters to affected families.

Delayed or inaccurate disclosure does not erase the original breach. It creates a second violation on top of the first, and in states with mandatory notification laws, that second failure carries its own separate liability. What most districts underestimate: whatever is communicated publicly in the first 48 hours after discovering a breach is not only a communications decision. It is a compliance decision, and regulators treat it as one during any subsequent investigation.

Where FERPA Enforcement Actually Lands

The Department of Education has never terminated funding over a FERPA violation, and every case has ended in corrective action rather than financial penalty. Under Gonzaga University v. Doe, individual students cannot sue a school to enforce FERPA directly, which removes the litigation pressure that keeps other privacy regimes accountable.

The FTC has become the more consequential enforcement body, using its own jurisdiction over the same conduct FERPA nominally governs: the $6 million Edmodo penalty and model-deletion order in 2023, and the data security program and mandatory deletion imposed on Illuminate in 2025. State attorneys general are also active; the $5.1 million Illuminate settlement came from California, Connecticut, and New York. State privacy statutes carry independent enforcement authority; California's SOPIPA operates on its own terms, and CalPrivacy fined PlayOn Sports $1.1 million in March 2026 over conduct touching roughly 1,400 California schools. Removal from the Student Privacy Pledge, as happened to Illuminate, also functions as a market consequence by closing procurement opportunities with privacy-focused buyers.

Federal FERPA enforcement is limited, but the same underlying conduct exposes vendors, and often institutions alongside them, to the FTC, to state attorneys general, and to civil penalties under state law. That gap between federal enforcement and everything operating behind it is why DPAs, security audits, and contractual audit rights are substantive legal protections rather than administrative formalities.