The Homework Apps Are Taking Notes Too: A Parent's Field Guide to School Data

Ask your kid how many apps they touched during a school day and you'll probably get a shrug. Ask the school district, and the honest answer is somewhere north of a dozen. There's the gradebook portal, the lunch payment system, the behavior-tracking app, the reading platform, the bus route tracker, the messaging tool the teacher swears by. Each one is a small business with a data collection habit — and your child is the product being logged.

Most parents never think about this until something goes wrong. But the reality is that American classrooms have quietly become one of the biggest edtech data markets in the world, and the paperwork you signed in August — if you read it at all — probably didn't tell you much.

What These Apps Actually Gather

Start with the obvious stuff: names, birthdays, student ID numbers, class schedules. That's just the entry fee. Then it gets more interesting.

Lunch payment platforms often link directly to payment cards and purchase histories, which means there's a record of what your kid eats every day. Reading and math programs log keystroke-level performance data — how long a student hesitated, which problems triggered frustration, how many attempts it took. Behavior apps like the classroom points systems popular in elementary schools track discipline events in real time, sometimes with notes attached.

None of this is automatically sinister. Teachers genuinely use this data, and a well-run platform can flag a struggling reader before anyone else notices. The problem is what happens to the data after it does its job. Many vendor contracts allow "service improvement" uses, which is corporate-speak for analysis that may never stay inside the district. Some platforms have shared data with advertisers or analytics firms. Others have simply been breached — and student records don't come with a credit freeze option.

The Laws That (Sort of) Have Your Back

Two federal laws matter here, and both have gaps big enough to drive a yellow school bus through.

FERPA — the Family Educational Rights and Privacy Act — covers actual education records held by the school. You have the right to inspect them, request corrections, and file complaints. The catch: FERPA was written in 1974, long before cloud software, and its exceptions for "school officials" let districts hand data to vendors as long as there's a contract. That contract is usually where your visibility ends.

COPPA — the Children's Online Privacy Protection Act — applies to apps serving kids under 13. It requires verifiable parental consent for data collection, and it's enforced by the FTC, which has actually fined edtech companies. But enforcement is complaint-driven, understaffed, and easy to route around with vague consent language buried in enrollment forms.

State laws fill some holes. California, New York, Illinois, and a growing list of others have student privacy statutes that restrict selling data and require deletion. If you live in one of those states, you have more leverage than you might realize — but only if you use it.

Your Before-School-Year Privacy Checklist

You don't need a law degree to shrink your kid's digital footprint. You need one free afternoon and this list.

1. Ask for the list. Email the school or district office and request the names of every third-party service that touches student data, plus copies of the contracts. Districts are often required to provide this, and the request itself signals you're paying attention.

2. Read the privacy policies — the short version. Look for three things: whether data is sold or shared with third parties, how long records are retained, and whether there's a deletion process. If a policy says "we may share data with trusted partners," treat that as a red flag worth an email.

3. Lock down the accounts you control. For parent-facing apps, use a strong unique password and turn on two-factor authentication wherever it's offered — preferably with an authenticator app rather than text messages. Lunch payment systems hold real card numbers; use a virtual card number if your bank offers one.

4. Opt out of what's optional. Many districts let families opt out of directory information sharing — yearbooks, honor rolls, media releases — under FERPA. It's usually a form buried in the enrollment packet. Fill it out and keep a copy.

5. Talk to your kid. If they're old enough, explain that school accounts aren't for signing into random games or quizzes that promise to "check your grades." Look-alike phishing sites targeting students are a real thing, and kids are a soft target.

6. Set a calendar reminder. Data practices change. A quick annual review — same time as the back-to-school paperwork — keeps you from discovering a new tracking app a year after it launched.

When You Find Something sketchy

If a platform's practices bother you, escalate in order: teacher, then school administrator, then district technology director. Frame it as a contract compliance question rather than a complaint — districts respond faster when you reference FERPA or your state's student privacy law by name. The Student Privacy Policy Office at the Department of Education accepts FERPA complaints, and state attorneys general handle COPPA-adjacent issues.

You won't fix the edtech industry from your kitchen table. But districts do respond to engaged parents, and every opt-out form and pointed email makes the next negotiation a little harder for vendors who've been coasting on fine print. Your kid's data is being collected either way — the only question is whether anyone's watching the watchers.