How a BYU study led Utah lawmakers to pass a student data privacy law

PROVO — These days, education is inseparable from technology, and their convergence is only expanding with the introduction of AI into classrooms.

K-12 schools throughout the Beehive State currently harness thousands of educational apps, including the widely known Canvas, Duolingo, Khan Academy, Quizlet, YouTube, coolmathgames.com and Loom.

While the inclusion of technology brings many benefits to the academic experience, it also poses major risks to data privacy.

What's more, research from Brigham Young University found that education technology vendors don't always meet their student privacy obligations, a realization that has prompted legislation to address some of these privacy issues.

The findings come from a report presented to the Utah State Board of Education last year after the board commissioned BYU to investigate concerns about student data privacy.

"It's a massive market — data brokers and resellers market — and the technology is increasing faster than people are aware of, as companies tie together data in ways that make it more useful without anybody knowing," Mark Keith, BYU information systems professor and report author, said in a release.

Keith, along with fellow information systems professor and study author Justin Giboney, hired three BYU student researchers and partnered with the nonprofit Internet Safety Labs to analyze network traffic generated by the 100 most commonly used apps in Utah schools.

Through test student accounts, researchers simulated 15-20 minutes of use in each app while conducting analyses, finding many apps not only collected information but shared it beyond what users agreed to when signing up.

More specifically, the research revealed that, of the education technology companies analyzed, 52% with data privacy agreements were collecting student data, and 36% of companies with data privacy agreements were sharing data with advertisers, often using unique identifiers for digital profiling.

That last part, Keith said, is a big deal.

"Once a person is associated with a unique identifier, logging into a website is no longer necessary for profiling to continue," Keith said in a release. "The likelihood is high that nearly every website you visit afterward contributes to your overall profile."

The companies were then classified into three categories based on compliance status.

"There were three general groups of results," Keith said in a release. "First, those companies that were completely safe. Second, those who didn't realize they were breaking the law. Third, those who knew what they were doing and ignored our requests."

Companies found in violation of privacy requirements were given the opportunity to work with the USBE digital analysis team through a reconciliation process. Upon successfully addressing the problems, the vendors' names were redacted from the list of companies identified as being out of compliance.

It's safe to say Utah's lawmakers were paying attention to what BYU and the State Board of Education were uncovering through the study, as HB55 passed out of the 2026 legislative session and took effect July 1.

Sponsored by Rep. Tiara Auxier, R-Morgan, HB55 established stricter privacy terms in education technology contracts, gives educational entities the right to perform audits, and requires contracts to be terminated if privacy violations are found and not remedied within 30 days.

"I give credit to the state of Utah for caring enough to find out if the COPPA-certified (U.S. Children's Online Privacy Protection Act) apps were living up to their data privacy promises," Keith said in a release.

Related topics