California Pushes to Tighten Student Data Rules as Apps, AI and Loopholes Multiply

Tech companies are digitizing nearly every part of a student’s life: inside classrooms tools proctor tests, generate study materials and collect homework; outside school hours apps coordinate sports teams, route buses and store health records. While California has been a national leader in student privacy, growing use of consumer apps and AI has exposed gaps that allow companies to collect, track and sometimes monetize student and parent data.

What The Bill Would Do

Assemblymember Dawn Addis (D-San Luis Obispo) introduced Assembly Bill 1159 to expand student privacy protections. The proposal would:

• Broaden the range of education technology covered by state law, closing some 2014-era loopholes
• Restrict how companies that build or use artificial intelligence may train models on student data
• Create new protections for college students and extend enforcement tools, including a private right of action for students and parents in certain cases

Why Advocates Say It’s Needed

Privacy experts and parents cite real examples of how data can be exposed or used. Jen King, a Stanford privacy and data policy fellow, found both her children’s information on TeamSnap, a popular tool for sports and extracurriculars, and encountered tracking prompts when logging into her account. She and others argue that when teachers or coaches require apps, students and parents often lack a realistic way to opt out.

'I was super irritated. You don’t need my birth date — I’m a freaking parent,' King said, noting that some requested fields seem aimed more at advertising and data brokerage than team management.

Legal Landscape And Enforcement Gaps

California passed a landmark student privacy law in 2014 that barred ed-tech companies from selling student data or targeting students with ads. The state also expanded general privacy rights in 2018 and created a data-privacy enforcement agency, CalPrivacy, following a 2020 ballot measure. Still, the 2014 law only applies to products that primarily serve K–12 schools and are designed and marketed for students, leaving a loophole for apps used in extracurricular or nonmandatory contexts.

Federal law (COPPA) requires parental consent before companies knowingly collect or sell data from children under 13. California law additionally requires some large for-profit companies to obtain consent for data collection from users under 16. But when platforms are required by a school or team, or when consumer apps have school-oriented use cases, those protections can be unclear or hard to enforce.

Real-World Stakes And Controversies

• TeamSnap: Public records show several California districts purchased TeamSnap licenses. Parents and privacy advocates say the app can surface student and parent birthdates, photos and contact information and may use tracking technologies that could be deemed a sale under state law.
• Illuminate Settlement: California, Connecticut and New York secured a roughly $5.1 million settlement after a data breach at Illuminate exposed sensitive information for more than 434,000 California students, marking the state’s first enforcement action under the 2014 education privacy law.
• CSU/OpenAI Deal: The California State University system signed a nearly $17 million contract with OpenAI that includes a promise not to train models on student data — advocates say similar commitments should be required across the board when AI vendors access student information.

Politics, Pushback And Next Steps

AB 1159 has drawn attention from major state stakeholders. The California Labor Federation supports the bill; the California Chamber of Commerce and TechNet oppose it. Business groups argue stricter rules and a private right of action could chill investment in AI-driven education tools, while advocates counter that private litigation is often the most effective enforcement mechanism.

Supporters say clearer rules are needed to prevent companies from exploiting ambiguous definitions about whether an app is "primarily" for students or merely marketed to schools. Addis' communications team says services like TeamSnap would likely be covered if they are marketed to schools, required by schools, or used by school-sponsored teams.

Design, Dark Patterns And Usability

Privacy researchers point to common user-experience tricks — called "dark patterns" — that make it easy to sign up and hard to delete accounts. King described the experience as a "roach motel": you can check in, but you can’t easily check out.

As the legislature considers AB 1159, the key questions remain: how broadly to define covered products, how to regulate AI training on student data, and how to balance strong enforcement with the needs of educators who rely on technology.

Reporting note: CalMatters reporters Khari Johnson and Ryan Sabalow contributed to the original reporting on which this piece is based.