BYU Research Finds Privacy Concerns in K-12 Apps: Why Schools Need to “Trust but Verify”

School districts put a lot of trust in the technology they approve for students.

They review privacy policies, sign data privacy agreements, ask vendors questions, and do their best to make sure student information will be protected.

But what happens when an EdTech vendor's actual data practices don't match those promises?

Recent research from Brigham Young University provides a good reason for districts to take a closer look.

What the BYU Researchers Found

Researchers from BYU, working with Internet Safety Labs, analyzed network traffic from 100 of the most commonly used applications in Utah schools.

Using test student accounts, researchers simulated student use of each application and looked at what was happening with data behind the scenes.

The results were concerning.

According to BYU:

• 52% of EdTech companies with data privacy agreements were collecting student data.
• 36% were sharing data with advertisers, often using unique identifiers that could be used for digital profiling.

The research was originally commissioned by the Utah State Board of Education to investigate concerns about student data privacy.

Importantly, the researchers didn't simply identify problems and stop there. Vendors found to have privacy compliance issues were given an opportunity to work with Utah's digital analysis team to correct them.

Some did.

That is an important part of this story because protecting student privacy doesn't have to mean eliminating useful technology. It means identifying problems and giving schools and vendors an opportunity to address them.

A DPA Is Important, But It Isn't the End of the Process

Data privacy agreements have become an important part of how school districts protect student information.

They establish what information a vendor can collect, how it can be used, how it must be protected, and what happens to that information when the relationship ends.

But a signed agreement cannot tell a district everything that may happen after the contract is signed.

Applications change.

Privacy policies change.

Vendors add new features and subprocessors. Tracking technologies change. Companies are acquired. And increasingly, AI functionality is being added to products that may have been approved before that functionality existed.

That's why the BYU researchers recommend that schools take a “trust but verify” approach to EdTech.

We think that's good advice.

Utah HB 55 Raises the Stakes

Utah has already responded to these concerns.

HB 55, Privacy Compliance for Education Technology Vendors, took effect July 1, 2026 and strengthens Utah's existing student data privacy framework.

Among other changes, the law establishes additional requirements for responding when an education technology vendor violates applicable student privacy requirements.

When a covered violation is discovered, the education entity must notify the contractor. The vendor then has an opportunity to remedy the violation and establish processes designed to prevent it from happening again.

If the vendor fails to do so, the contract may be required to be terminated under the conditions established by the law.

HB 55 also provides for additional oversight of vendor compliance, including audits and investigations.

We recently covered the specific requirements of HB 55 in our guide, “Utah HB 55: 5 Things K-12 Schools Need to Know About New EdTech Privacy Requirements.”

For Utah school districts, however, the larger message is straightforward:

Vendor vetting needs to continue after an application is approved.

The Challenge for School Districts

That sounds simple. Doing it across an entire school district is not.

A district may have hundreds or even thousands of applications, websites, browser extensions and other technologies being used by teachers and students.

Someone has to determine which tools are appropriate for student use.

Someone has to review the privacy policies.

Someone has to determine what student information is being collected.

Someone has to manage the agreements.

And now districts increasingly need to understand whether a product introduces AI risk or creates accessibility concerns for students.

Then, after all of that work is completed, things change and some of those applications need to be reviewed again.

For most district technology teams, there simply aren't enough hours in the day to manually monitor every vendor.

How EdPrivacy Helps

This is the problem we started Education Framework to solve more than a decade ago.

EdPrivacy helps K-12 districts create a consistent process for reviewing the technology being used in their schools.

Instead of relying on scattered spreadsheets, emails, privacy policies and agreements, districts can manage EdTech vetting in one place.

EdPrivacy helps districts:

• Review applications for student data privacy concerns
• Evaluate AI risk and accessibility alongside privacy
• Manage teacher technology requests and approvals
• Store and manage vendor agreements and supporting documentation
• Monitor changes that may require a vendor to be reviewed again
• Give teachers and administrators visibility into which technologies have been approved for use

For Utah districts, that kind of ongoing oversight is becoming increasingly important.

HB 55 gives schools additional responsibilities when vendor practices don't comply with applicable privacy requirements. The BYU research demonstrates why those responsibilities matter.

Trust, But Verify

Technology has become an essential part of education. The answer isn't to stop teachers from finding new tools or to assume every vendor presents a privacy problem.

The better approach is to give districts a practical way to understand the technology being used with students and make informed decisions about it.

Trust the agreements.

Trust vendors that demonstrate good privacy practices.

But continue to verify.

Because protecting student data isn't something a district does once when an application is approved. It is an ongoing process.

And as EdTech, AI, privacy requirements and accessibility expectations continue to change, that process is only becoming more important.

Read the BYU article:
https://news.byu.edu/intellect/new-utah-law-protects-student-privacy-after-byu-research-found-k-12-apps-were-collecting-and-sharing-data

Learn more about Utah HB 55:
https://edprivacy.com/blogs/utah-hb-55-5-things-k-12-schools-need-to-know-about-new-edtech-privacy-requirements

‍