Utah Ed-Tech Privacy Test Finds Contract Gaps in School Apps

Utah's test of school technology apps found that written privacy promises often failed to match product behavior, GovTech reported after reviewing a multiyear inquiry commissioned by the Utah State Board of Education.

The state inquiry followed 2022 research by Internet Safety Labs into more than 1,700 apps connected to a representative sample of 663 U.S. schools.

That earlier review found third-party data transfers in 96 percent of the apps and advertising or marketing destinations in 78 percent of those transfers, giving USBE a reason to test products actually used by Utah students.

The Utah project moved beyond contract language.

USBE asked for a comparison between vendor data privacy agreements, or general privacy policies when no school agreement existed, and the traffic generated by the products themselves.

Brigham Young University associate professor Mark Keith helped build the app list, Internet Safety Labs handled the network testing, and USBE later used the results in discussions with vendors.

The inventory stage exposed the administrative burden behind school privacy oversight.

The research team built a statewide list of more than 3,000 apps from state records, privacy databases, district material and school websites.

Keith said the work took roughly 18 months and left Utah ahead of many peers, though approval and documentation practices still were not standardized.

The technical tests used student accounts for licensed school versions, not public consumer editions.

In the group of 85 applications that had standard data privacy agreements, 44 products — 52 percent of the sample — gathered at least one data category outside the permission listed in the agreement.

Researchers left room for benign explanations, including incomplete contract forms or app changes made after a deal was signed.

Third-party movement created a separate concern.

Eleven applications, equal to 13 percent of the tested set, transmitted at least one data element to an outside party without permission under the relevant agreement.

Overall third-party sharing appeared in 61 percent of tested apps, a category that can include ordinary service providers.

Advertising-linked recipients appeared in 36 percent of the apps, most often receiving unique user identifiers that can support online recognition and profiling.

The investigation did not make legal findings under state or federal privacy law.

Katy Challis, USBE's director of privacy, described collection beyond agreement terms and third-party sharing as documented results, not proof that companies deliberately mishandled student data.

Lisa LeVasseur, Internet Safety Labs' founder and executive director, pointed to some gaps as disclosure failures, including agreements that omitted IP addresses even though those addresses are part of routine Internet communication.

Routine does not mean harmless in a school setting.

An IP address can approximate location, and student logins can expose patterns of use even when no single field looks sensitive.

The final numbers came down before publication because USBE approached vendors during the review; some vendors revised privacy agreements or made product changes before the inquiry closed.

The findings later entered Utah's legislative process.

Keith and USBE officials brought recommendations to the Legislature's Education Interim Committee in September 2025.

S.B.

267, enacted in the next session, requires USBE to examine software and digital-service practices for public schools and produce statewide guidance.

Earlier language that would have created a statewide privacy agreement, a master software inventory and periodic compliance audits did not survive in the final bill.

The operating question is who can perform that verification at scale.

Teachers and districts generally lack the training and capacity to inspect network traffic before an app is approved.

Challis said other states have shown interest in Utah's model while asking how similar reviews would be funded, and USBE meeting minutes put the initial August 2022 Brigham Young University research agreement at $195,600.