PowerSchool's $17.25 Million Settlement Exposes Years of Secret Student Data Harvesting
The K-12 tech giant's Naviance platform quietly embedded third-party tracking tools that harvested private communications from roughly 10 million students — and nobody told them.
Written by OutOfToken AI
June 4, 2026 · 4 min read · Synthesized from reporting by DataBreaches.net · How this works
PowerSchool built its reputation as the backbone of K-12 administration, quietly sitting inside the daily digital lives of tens of millions of students worldwide. But a $17.25 million class-action settlement now confirms what privacy advocates long suspected: the company was running covert analytics operations on students through its Naviance college-readiness platform, collecting private data without consent starting as far back as 2021. This isn't the headline 2024 cyberattack — this is a separate, deliberate act of institutional surveillance dressed up as an educational service.
The Hidden Tool Inside the Platform
At the center of the lawsuit is Heap, a third-party behavioral analytics tool that PowerSchool embedded within Naviance without disclosing its presence to students, parents, or school districts. Heap is designed to record granular user interactions — clicks, form entries, session replays, and message content — and the lawsuit alleges it was doing exactly that inside a platform students trusted for college applications, career planning, and sensitive personal correspondence. Students logging into Naviance between August 2021 and the settlement period were, according to the complaint, being surveilled by software they had no knowledge of and no mechanism to opt out from.
Who Got Caught in the Net
The scale is staggering. Approximately 10 million students used Naviance during the period in question, making this one of the largest undisclosed tracking operations ever documented in the K-12 education sector. In early April, many of those students — now likely in college or beyond — received unexpected emails explaining they were part of a settlement class. The lawsuit alleges violations of multiple privacy statutes, with plaintiffs arguing that harvesting private communications from minors inside an ostensibly educational environment represents a categorical breach of both trust and law. PowerSchool has not admitted wrongdoing as part of the settlement.
""Heap was recording what students typed, clicked, and communicated inside a platform built explicitly to handle their most sensitive academic and personal planning data — and for years, no one said a word.""
Settlement Terms and What They Actually Mean
The $17.25 million payout covers monetary compensation for affected class members and mandates that PowerSchool delete the data collected through the embedded tracking tools — a deletion requirement that carries its own enforcement complexities given the opaque nature of third-party analytics pipelines. Critically, the settlement arrives in the shadow of PowerSchool's far more publicized December 2024 security breach, in which attackers exfiltrated records belonging to tens of millions of current students and educators from its Student Information System. The convergence of these two incidents — one a hack, one an internal data practice — paints a portrait of a company that has struggled fundamentally with data stewardship at every layer of its infrastructure.
PowerSchool controls an outsized share of the K-12 technology market, and that dominance means schools often have little practical choice but to trust it with their most vulnerable users' data. The Naviance settlement should force district procurement officers, state education agencies, and federal regulators to confront a harder question: when a monopolistic edtech provider is caught tracking children in secret, a settlement without admission of wrongdoing is not accountability — it's the cost of doing business. With the FTC increasingly scrutinizing edtech privacy practices and state attorneys general sharpening their COPPA enforcement posture, PowerSchool's next chapter will likely be written in regulatory proceedings, not just civil court.
Editorial Note
PowerSchool, a major K-12 student information system provider, has experienced multiple documented security incidents. A 2024 breach affecting millions of students is well-documented. However, the specific $17.25 million settlement figure and details about a 2021 breach require verification against official sources, FTC filings, or court documents. DataBreaches.net is a reputable breach tracking resource but the headline's specific monetary claim should be cross-referenced with primary sources.
Claim Tracker
AI-assessed
Settlement amount and class-action nature are documented public records
Core allegation confirmed in settlement documentation and lawsuits
Heap's technical capabilities are well-documented; allegation of its use on Naviance is part of settlement terms
Timeline specified in lawsuit documentation
Characterization as 'deliberate' surveillance versus business practice is interpretive; the analytics implementation was intentional but framing as 'surveillance' reflects editorial judgment
Ask AI about this story
// discussion
sign in to join the discussion