PowerSchool Secretly Tracked 10 Million Students—Now It's Paying $17.25 Million

Hidden Tracking in a School Platform

PowerSchool Holdings and its subsidiary Hobsons built Naviance, one of the most widely used college and career guidance platforms in American schools. More than 10 million students used it between August 2021 and January 2026 to take assessments, complete surveys, research colleges, and communicate with counselors. What those students did not know was that PowerSchool had embedded analytics technology from a firm called Heap into the platform, quietly recording their interactions, communications, and behavior without disclosure or consent.

A proposed class action lawsuit, filed in federal court and now settled for $17.25 million, alleged that this tracking violated state and federal student privacy laws. The settlement also requires PowerSchool to delete all collected student data, ban third party tracking code from Naviance for two years, and create a web governance committee to oversee how advertising technology is used in the platform going forward.

What Heap Was Collecting

Heap is a product analytics platform that captures user interactions automatically. When embedded in a website or application, it records clicks, page views, form submissions, scroll behavior, and other user actions. In the context of Naviance, this meant Heap was capturing how students navigated the platform, what they searched for, what assessments they completed, and potentially the contents of their communications with school counselors.

The lawsuit described this as "covertly recording communications and collecting sensitive and confidential personal information about students, including academic records and associated data." PowerSchool publicly claimed to value student privacy while simultaneously running a surveillance layer underneath the platform's surface.

Heap was removed from the Illinois case and sued separately in New York, but the settlement terms require PowerSchool to direct Heap and all other vendors to delete the student data they collected.

$17.25 Million Split Among 10 Million Students

The math is not generous. Anyone who logged into Naviance between August 2021 and January 2026 is an eligible class member, representing over 10 million people. The $17.25 million settlement, after legal fees, will be distributed as a pro rata share, which means individual payouts will be minimal.

The more significant outcome is the injunctive relief. PowerSchool must establish a web governance committee to monitor advertising technology use in Naviance, refrain from using third party software or code for the next two years, and significantly enhance its privacy disclosures. Chicago Public Schools must mandate that its vendors supply annual certifications showing compliance with state and federal privacy laws.

PowerSchool stated it was "focused on providing our customers safe and secure technology" and resolved the claims with no admission of wrongdoing.

EdTech's Tracking Problem

This is not an isolated case. In March 2026, Kaplan disclosed a breach exposing 230,000 Social Security numbers after hackers spent 19 days on its servers. Educational technology platforms routinely embed analytics and advertising trackers that collect student data far beyond what is necessary for the educational purpose of the tool. A 2025 study found that 89% of edtech products recommended by schools during the pandemic sent student data to third parties, often advertising companies.

Students and parents have almost no visibility into what data is being collected. Unlike consumer websites where privacy conscious users can install browser extensions or opt out, school platforms are mandatory. Students cannot choose not to use the tools their schools require for college applications, assessments, and academic planning.

This creates an asymmetry that privacy regulations were designed to prevent. Children and teenagers are using platforms mandated by their schools, generating behavioral data that companies harvest through embedded analytics tools, with neither the students nor their parents aware that it is happening.

What This Means for Student Privacy

The PowerSchool settlement signals that courts and regulators are increasingly willing to hold edtech companies accountable for hidden tracking practices. But $17.25 million spread across 10 million students is not a deterrent for a company the size of PowerSchool. The real test will be whether the injunctive requirements, specifically the ban on third party tracking code and the mandatory governance committee, actually change how the company handles student data.

For parents, the lesson is that the platforms your children use in school may be collecting far more data than you realize. Ask your school district what analytics tools are embedded in the platforms students are required to use, whether those tools have been audited for privacy compliance, and what data deletion policies are in place. If a company publicly claims to protect student privacy while secretly running tracking infrastructure underneath, the only way to catch it is to ask the right questions.