In early April, many students across the world received an email about a lawsuit settlement involving PowerSchool, a platform commonly used to manage school records. The email explained that students who logged into PowerSchool’s Naviance platform—a widely-adopted college and career readiness platform—between August 18, 2021 and January 23, 2026, may be entitled to a payment if their data was compromised.
The lawsuit accuses Naviance of embedding the third-party tracking software Heap within the site, which harvested private communications and student data. Keystrokes, clicks, mouse movements, and private messages to counselors were alleged to have been recorded before being sent to Google, Microsoft, and Hotjar. Additionally, the suit claimed that this digital wiretapping was done without student, parent, or school district consent.
“I feel scared, my data could just be out there, like someone random could just have all my information,” freshman Emiliano Cardenas Gaona said. “It’s just something to worry about.”
The lawsuit was filed by an unnamed student in Chicago in August 2023, accusing Naviance’s of violating multiple state and federal privacy laws, including the Electronic Communications Privacy Act, which protects communications while in transit, and the California Invasion of Privacy Act, which safeguards individuals from the recording of private communications. PowerSchool quickly denied the accusations.
In February 2026, a settlement was reached. PowerSchool and City of Chicago School District agreed to pay $17.25 million in damages, split among eligible students. As part of the settlement, Heap, Google, Microsoft, and Hotjar agreed to delete all stored student data. The settlement is scheduled for final approval at a hearing on August 19, 2026.
This isn’t the first time PowerSchool has been the subject of controversy. PowerSchool was involved in another high profile privacy scandal in late December 2024, where 19-year-old college student Matthew Lane hacked into PowerSchool’s systems using a stolen password, stealing the information of millions of students and educators. The data breach was thought to be resolved after a $2.85 million ransom; however, another malicious actor used the same data to extort individual school districts just months later.
These incidents are part of a recent growing pattern of education technology (EdTech) companies failing to protect children’s privacy.
EdTech usage has rapidly expanded in recent years, and so have the hacking attempts targeting it. Surveys of digital learning found that EdTech usage among K-12 schools has nearly doubled since 2020. The increase brings convenience and efficiency to schools, but also carries significant privacy risks.
Students acknowledge these risks as well. “I think education tech is necessary and helps students and teachers a lot, but for it to actually be functional and working we need to increase security,” freshman Manu Srinivasan said.
Additionally, M-A’s learning management system, Canvas, was breached by the hacking group known as the ShinyHunters in late April, and again in early May. The group stole around 275 million records and extorted Canvas’ owner, Instructure, threatening to leak the data. The attack resulted in a worldwide Canvas shutdown, during hectic finals at many high schools and universities. The crisis ended when Instructure paid ShinyHunters an undisclosed amount to delete the information.
In any case, though many online platforms provide convenience, they also raise major privacy concerns to students, teachers, and administrators. With data breaches becoming more prevalent, caution should be encouraged for schools and individuals to avoid future security risks.
Students eligible for the PowerSchool settlement can file a claim by July 27, 2026, right here.
