The 2026 Student Data Crackdown: 3 Changes Every K–12 IT Admin Should Know
This year’s crackdown on student data practices followed a string of vendor breaches, and lawmakers are now writing AI into student privacy rules. Some vendors districts approved years ago turned out to hold more student data than districts realized, and regulators and lawmakers have responded.
Looking back, here are 3 industry-wide changes in 2026.
1) Risk of data breaches now extends way outside the building
For over a decade, district security meant defending what you own: the network, the devices, the accounts.
But in early May 2026, Canvas went offline. Instructure had detected unauthorized access on April 29, then found a second intrusion tied to the same actor on May 7. The attackers claimed data from 8,809 institutions, a figure Instructure has not publicly confirmed.
Doug Levin, co-founder and director of the K12 Security Information Exchange, told Education Week the attack had echoes of the 2024 PowerSchool breach and that "the odds of experiencing an incident are quite high."
Walt Powell, a Lead Field CISO at CDW, pointed to the structural problem: a learning platform wired into the student information system and single sign-on carries exposure well beyond its own walls.
Most districts approve integrations one at a time, but the risk doesn't divide that neatly. Everything wired together shares the exposure, so contract terms need to be backed by technical controls like least-privilege access and regular credential rotation.
2) The federal government is taking existing vulnerabilities (that used to be overlooked) more seriously
On June 5, the FTC finalized its order against Illuminate Education, whose systems exposed data on 10.1 million students.
The FTC alleged that a vendor warned the company about network vulnerabilities nearly two years before the breach, that they were not adequately fixed, and that schools were not told in time.
In some ways, the remedies read like a return to basics: a written security program, deletion of data the company does not need, and independent assessments for ten years.
What stands out is how ordinary the allegation sounds: a security warning left unaddressed for almost two years. Self-regulation has faded as a benchmark, too. The Future of Privacy Forum retired the Student Privacy Pledge in April 2025, after most states had written its principles into law.
Self-attestation carries less weight now; districts expect commitments backed by contracts, audits and law.
3) What vendors put in writing is about to be read more closely, by more people
On the positive side, more than 40 states now have student privacy laws that apply to edtech providers, and legislators keep adding to them.
As of March, MultiState was tracking 134 AI-in-education bills introduced in 31 states.
In September, California enacted AB 1159, which bars edtech companies from using identifiable student data to train or build AI systems, expands which companies and products are covered, and gives families a limited right to sue. Its stricter rules start next year.
Emory Roane, associate director at the Privacy Rights Clearinghouse, which sponsored the bill, put it simply: "EdTech companies have extraordinary access to students’ lives through the tools they use for class, and that access comes with a responsibility to protect them, not to turn their personal information into a product to sell."
The family enforcement piece is what we'd watch. Once a parent can act on the law directly, every sentence in a vendor's privacy policy can end up as an exhibit, critiqued by anyone. Vague sentences are more scrutinized.
How Deledao handles student data
Deledao’s products analyze web activity in real time to block harmful content, keep students on task, and alert designated school staff to possible signs of cyberbullying or self-harm.
We don’t use identifiable student information to train AI models. Our filtering models may be improved with de-identified data that our team selects and reviews.
The district stays in control: it owns student records and decides how they’re used, and Deledao processes that data only on the district’s behalf.
We never sell or rent personally identifiable information. We share student data only in the limited cases our privacy policy describes, mainly with service providers who need it to run the service and are contractually limited to that use.
Our student extensions and school-facing portals contain no third-party tracking or analytics, and Deledao never shows ads to students.
Our products are built to support districts’ obligations under FERPA, COPPA, CIPA and PPRA, and to meet vendor requirements under state laws including New York Education Law 2-D, Illinois SOPPA, Nevada NRS 388 and Texas HB 18.
Data is encrypted in transit and at rest and stored in U.S. data centers. Student activity logs are purged one year after they’re created, including from backups, and account data needed to run the service, like rostering and sign-in, is kept for the length of the district’s contract.
Our security program is certified to ISO/IEC 27001, with regular audits by an independent certification body.
The EdTech Awards 2026, from EdTech Digest, named Deledao the winner for Networking / IT / Connectivity / Access Solution. Deledao first won in 2020 for Student Data Privacy Solution and was a finalist every year from 2021 to 2025.
Questions about any of it can be sent to privacy@deledao.com.
Two checks IT admins should conduct for the year ahead
1. Audit where sensitive data is actually going
This might sound obvious. But the Canvas incident exposed names, email addresses, student ID numbers, course and enrollment data, and inbox messages.
And those messages can hold anything staff and students wrote to each other. Few districts keep track of what’s in them.
So audit where sensitive data actually goes, including what staff and students write in messaging tools and paste into AI tools. You will learn more than a policy review can tell you.
2. Ask each vendor how it handles serious security findings.
A current certification and outside audits show that a vendor has a security program, but not how quickly it closes a known problem. In the Illuminate case, the FTC alleged the company left a vendor’s security warnings unaddressed for almost two years before a breach exposing data on 10.1 million students. Ask how findings are tracked, who is accountable for fixing them, and what happens when a critical issue is found.
"Vendor trust cannot be a one-time procurement decision," FusionAuth CEO Brian Bell told Dark Reading, adding that in edtech, trust has to be earned continuously.
As scrutiny grows, districts will favor AI tools that can show, not just say, how they protect student data.
