Assemblymember Dawn Addis, a San Luis Obispo Democrat, is carrying Assembly Bill 1159 to strengthen privacy protections for California students’ data as technology companies increasingly collect information through school sports apps, learning platforms, and other services. The bill would restrict how artificial intelligence companies use student data and create new protections for college students.
The measure addresses concerns that California’s existing education privacy laws contain loopholes allowing companies to continue packaging and selling students’ personal information—a concern deepened as the Trump administration moves to collect additional data on California residents’ immigration status and other personal details.
How Tech Companies Collect Student Data
The scope of data collection became evident through Jen King’s experience. King, a privacy and data policy fellow at Stanford’s institute for AI who studies how companies gather and retain user data, learned what information apps collect when her 12-year-old son’s cross country team began using TeamSnap, a sports management platform. TeamSnap requested her name, date of birth, gender, email address, and phone number. Once she logged in, she discovered her son’s information—including his name, email, and date of birth—was already listed on the platform, along with photos and personal information from all team members.
“You don’t need my birth date—I’m a freaking parent,” King said. Her 17-year-old son’s information was also on TeamSnap through his robotics team, she later learned.
Federal law requires companies to obtain parental consent before knowingly collecting or selling data from children 12 and under. Once a child turns 13, their data is generally treated much like an adult’s information, particularly when using platforms outside of school. California law additionally requires certain large for-profit companies to obtain consent before collecting data from anyone under 16—though often this consent comes through pop-up windows users click without fully understanding, and many students cannot realistically opt out when a teacher, coach, or authority figure requires the platform’s use.
California’s Protection Gaps and the Proposed Solution
California was the first state in the nation to regulate education technology companies, enacting a landmark privacy law in 2014 that prohibited technology companies from selling students’ data, targeting students in advertising, or disclosing their personal information. In 2018, the state passed the California Consumer Privacy Act requiring all companies to give California users certain privacy rights, including the ability to opt out of data collection and delete some of their information.
However, many tech companies argue their products are not primarily designed for students or were not marketed that way. Duolingo, for example, has a school version but is also widely used by adults. Apps and services serving extracurricular programs or sports teams can claim they were not designed for the classroom or that their use is optional. This creates what privacy experts describe as a “black hole” where many student-facing technologies fall outside existing protections.
Assembly Bill 1159 would expand the scope of California’s existing student privacy laws to cover more technology companies and services, particularly those used in extracurricular programs and sports contexts. The bill would also establish a new provision giving students and parents the legal right to sue tech companies in certain cases for privacy violations—a change advocates say is necessary for enforcement when regulators lack resources to pursue companies on their own.
Addis said the bill’s provisions address this gap, particularly where schools purchase or direct students toward platforms for sports, extracurricular activities, or other purposes outside the traditional classroom.
Support and Opposition
The California Labor Federation supports Assembly Bill 1159, while the California Chamber of Commerce and TechNet, a trade association representing major technology companies, oppose it. In 2024, these two groups combined spent nearly $8 million on campaign donations and other political activities directed toward California legislators.
Business and technology groups argue that new regulations and the private right to sue would stifle investment in AI-powered learning tools. King countered that the right to sue is often the only way to increase enforcement. “Otherwise, the onus is on individual consumers to find concerning practices and try to opt out,” she said.
Enforcement and Precedent
California has begun enforcing its existing education privacy laws. In November, the state Attorney General’s office reached a $5.1 million settlement against Illuminate, an education technology company that uses data to track and evaluate students’ progress. The settlement marked the first time California successfully sued a company for violating the state’s 2014 education privacy law. Illuminate had suffered a data breach exposing sensitive information from over 434,000 California students.
Despite her expertise in data privacy, King struggled to figure out how to delete her TeamSnap account, eventually discovering she needed to send an email to the company. She acknowledged the irony, given that her research focuses on these “dark patterns” in user design intended to trap customers. “You can check in,” she said of such patterns, “but you can never check out.”
Human review: not_triggered. License: CC0.