Fewer Than 10% of EdTech Tools Meet This 2026 Privacy Bar

Fewer than 10% of education technology products evaluated by Common Sense Education meet the criteria for its 2025 Privacy Seal, the nonprofit's toughest privacy bar yet for the tools schools and course platforms use to teach and track students. The seal, launched April 3, 2025, requires a 200-plus question review and passing marks on six criteria: no data sales, no third-party marketing, no targeted ads, no third-party tracking, no cross-app tracking, and no commercial profiling.

That low pass rate lands squarely on anyone running an online course business. Udemy-style marketplaces, Teachable and Thinkific-hosted sites, cohort programs, and membership communities all collect the same categories of data an evaluated classroom tool does: names, emails, payment details, and a stream of video-progress and quiz-response data tied to an individual learner. The sections below cover which privacy laws actually bind a course-selling platform, what recent enforcement has cost companies that got it wrong, and where a standard course business's obligations differ from a school's EdTech vendor.

How many EdTech and course tools actually meet a real privacy bar?

Fewer than 10% of companies that went through Common Sense Education's evaluation process met the requirements to earn its Privacy Seal, according to the organization's April 3, 2025 announcement. The rubric checks more than 200 privacy questions and requires quarterly monitoring plus annual policy updates to keep the seal, so it measures ongoing practice rather than a one-time policy read.

The most recent large-scale look at the wider EdTech field is older but tells a consistent story. In a September 2019 press release covering 150 products evaluated that year against 100 the year before, Common Sense Media reported that only 20% of 2019's evaluated products met the organization's minimum privacy criteria, up from 10% in 2018. That means, even after the doubling, 80% of the products reviewed in 2019 still fell short of a baseline privacy standard, and no comparable large-sample study has been published since to say whether that gap has closed.

Figure 1: Share of evaluated EdTech products meeting Common Sense's minimum privacy criteria, by year. Source: Common Sense Media, "EdTech Industry Taking Steps to Improve Privacy Policies" (September 4, 2019).

The same 2019 report broke down specific data practices among the products it reviewed: 47% used contextual advertising, 41% of web-based services used tracking technologies, 33% used post-visit tracking, 33% used behavioral advertising, 32% shared data with third parties for marketing, and 23% built ad profiles from user behavior. A course platform that runs standard ad-retargeting pixels or a third-party analytics script on its checkout and lesson pages is doing the same categories of collection this data describes.

Figure 2: Share of evaluated products using each data practice, 2019. Source: Common Sense Media, "EdTech Industry Taking Steps to Improve Privacy Policies" (September 4, 2019).

Does FERPA apply to an online course platform?

Usually not directly. FERPA governs education records held by schools, colleges, and other agencies that receive funding from the US Department of Education, and it extends to a third-party vendor only when that vendor is formally designated a "school official" acting on the institution's behalf, per the Department's Student Privacy Policy Office guidance for education technology vendors. A platform that sells courses straight to individual adult learners, with no school or district as the paying customer, is not the kind of entity FERPA was written to cover.

That line moves the moment a school, district, or university becomes the customer. A cohort platform selling seats to a university continuing-education program, or an LMS licensed to a K-12 district, can become a FERPA-obligated "school official" the moment a signed data-sharing agreement makes it one, even though the same platform's direct-to-consumer product line stays outside FERPA entirely. Course sellers who serve both audiences from one codebase need to track which contracts trigger FERPA duties rather than assuming the law applies uniformly across their whole user base.

More than 20 US states have gone further than FERPA for the K-12 market specifically, adopting laws modeled on California's original Student Online Personal Information Protection Act (SOPIPA), which took effect in 2016 and now operates under the renamed Pupil Online Personal Information Protection Act (KOPIPA). These state laws bar covered EdTech operators from selling student data or using it to build advertising profiles, and they apply through a school contract in the same way FERPA does, not through a platform's own terms of service to a general consumer.

When does COPPA apply to a course platform with young learners?

COPPA applies the moment an operator has actual knowledge that a registered user is under 13, or when a course's content is directed at children, regardless of whether the platform is a giant like Udemy or a single-instructor membership site. The FTC's amended COPPA Rule took effect June 23, 2025, with full compliance required by April 22, 2026, and it expanded the definition of covered personal information to include biometric identifiers, added a separate verifiable-parental-consent requirement for any use not integral to the service, and mandated a written information security program and data retention policy for every covered operator. Civil penalties can run up to $53,088 per violation, adjusted for the specific facts of the case.

Figure 3: A working test for which privacy law binds a given course platform. Source: FTC COPPA Rule amendments (effective June 23, 2025); GDPR and CCPA/CPRA statutory scope.

Recent enforcement shows regulators are not limiting this to household-name platforms. Disney agreed to pay $10 million to settle FTC allegations that it let children's personal data be collected from kid-directed YouTube videos without the required parental notice and consent, an order a federal judge approved on December 31, 2025. Course platforms that host or embed video lessons, especially any aimed at younger learners, carry the same category of exposure the FTC cited against Disney: mislabeled content, missing parental notice, and third-party tracking running on pages children can reach.

What has student-data enforcement actually cost platforms?

A 2022 breach at EdTech vendor Illuminate Education, discovered after a hacker used a former employee's leftover credentials, exposed sensitive records belonging to more than 4.7 million students across the states involved in a multistate settlement. Connecticut, New York, and California jointly secured $5.1 million from the company in a November 2025 settlement, split roughly $150,000 for Connecticut (28,610 affected students), $1.7 million for New York (1.7 million affected students), and $3.25 million for California (3 million affected students). That settlement was the first enforcement action under California's KOPIPA and Connecticut's own student data privacy law. Our full write-up of the FTC's parallel federal order covers the separate, larger federal case, finalized June 5, 2026, which put the nationwide breach total at 10.1 million student records and required Illuminate to build an ongoing data-minimization program rather than pay a fine alone.

Figure 4: Combined penalty dollars across three student and children's privacy enforcement actions, 2025 to 2026. Sources: FTC (Disney), New York Attorney General (Illuminate Education multistate settlement), Holland & Knight summary of the CPPA's PlayOn Sports order.

California's newer privacy regulator, the California Privacy Protection Agency, issued a separate $1.1 million fine against youth-sports ticketing platform PlayOn Sports in early 2026, the agency's first enforcement action touching students and California schools. The order found that PlayOn's GoFan platform, used by roughly 1,400 California schools, offered only phone and email opt-out routes that could not actually stop the tracking technologies running on its site, and that a mobile cookie banner effectively forced ticket buyers to click "Agree" before they could reach tickets they had already purchased. The violation period ran from January 1, 2023, through December 31, 2024, and the company's privacy policy had gone nearly two years without an update.

Figure 5: Timeline of the four enforcement actions covered in this post. Sources: New York Attorney General, FTC press releases, Holland & Knight summary of the CPPA order.

What does GDPR or CCPA actually require of a course seller?

Once a course platform has learners in the EU or UK, GDPR applies the same way it does to any other online business: it needs a documented lawful basis for processing enrollment and payment data, a privacy policy that discloses what it collects and why, and a process for handling data subject requests like access and deletion. CCPA and its CPRA amendments apply once a business crosses California's revenue or data-volume thresholds and serves California residents, requiring an opt-out mechanism for data sale or sharing and specific disclosures in the privacy policy itself. Neither law cares whether the seller is a single instructor or a platform with millions of users; both apply based on where the learners are and what the business does with their data, not the seller's size. Our broader look at small business privacy compliance found the same size-based documentation gap holds outside EdTech specifically, so a solo course creator is not an unusual case, just a small business with an added layer of student and payment data to account for.

A working terms of service for a course platform needs to cover more than refunds and content licensing: it should state how video-progress and quiz data get used, whether third-party analytics or advertising tools run on lesson pages, and what happens to a learner's data if the course or the platform shuts down. Course creators who host directly through WordPress or a custom cart, rather than a hosted platform like Teachable or Thinkific, carry that documentation obligation entirely on their own rather than inheriting boilerplate from a platform's terms. Our guides to writing a privacy policy for an online course and terms and conditions for a course or membership site cover the clause-by-clause detail this section only summarizes.

Law	Applies to a course platform when	Maximum penalty	2025-2026 enforcement example
FERPA	The platform is contracted as a school official by a funded institution	Loss of federal education funding for the institution	Not directly applicable to most direct-to-consumer platforms
COPPA	Any learner is known to be under 13, or content targets children	$53,088 per violation	Disney, $10 million, December 2025
GDPR	The platform has learners in the EU or UK	EUR 20 million or 4% of global turnover	General statutory scope; no course-platform-specific 2025-2026 fine found
CCPA / CPRA	California learners plus a revenue or data-volume threshold	Per-violation civil penalties, case-specific	PlayOn Sports, $1.1 million, 2026

The Bottom Line

The privacy bar for course-selling platforms is not set by whether a business calls itself an "EdTech company." It is set by what data gets collected, who the learners are, and where they live, which is exactly why fewer than 10% of formally evaluated EdTech products currently clear Common Sense Education's Privacy Seal and why regulators kept finding fault with student-data handling through 2025 and into 2026. A solo instructor selling a cohort course to adult professionals faces a different obligation set than a platform under contract with a school district, but neither gets a pass on the baseline: a clear privacy policy, an honest accounting of what video, progress, and payment data gets collected, and a documented answer for what happens if a learner asks for their data to be deleted. Getting that documentation in place before a regulator or a learner asks for it is the cheaper version of every case in this post.

Frequently Asked Questions

Does FERPA apply to my online course platform? Usually not directly. FERPA binds educational agencies and institutions that receive funding from the US Department of Education, plus the vendors those institutions formally designate as school officials. A platform that sells courses straight to individual adult learners, rather than through a school contract, generally falls outside FERPA, though it can still pick up FERPA duties the moment a school or district becomes the paying customer.

Do I need to comply with COPPA if I sell online courses? Yes, if you have actual knowledge that any registered learner is under 13, or if your course content is directed at children. The FTC's amended COPPA Rule took effect June 23, 2025, with full compliance required by April 22, 2026, and civil penalties of up to $53,088 per violation for platforms that collect children's personal information without verifiable parental consent.

How many EdTech and course platforms actually meet a real privacy bar? Fewer than 10% of evaluated companies met the requirements for Common Sense Education's Privacy Seal, a 200-plus question rubric launched April 3, 2025. In Common Sense's last full-scale evaluation cycle in 2019, only 20% of 150 evaluated products met even the organization's minimum privacy criteria, up from 10% of 100 products the year before.

What happens when a course or student data platform mishandles data? Recent penalties run into the tens of millions. A 2022 breach at EdTech vendor Illuminate Education cost the company $5.1 million in a November 2025 settlement with Connecticut, New York, and California, while the FTC's separate federal order over the same breach, finalized June 5, 2026, covered 10.1 million student records nationwide. California's privacy regulator separately fined youth-ticketing platform PlayOn Sports $1.1 million in 2026 over tracking roughly 1,400 California schools' ticket buyers.

Where the Numbers Come From

1. Common Sense Education. (2025). "Introducing the Common Sense Privacy Seal: A New Standard in Digital Privacy Protection." Published April 3, 2025. Fewer than 10% of evaluated companies met the seal's requirements; 200-plus question rubric.
2. Common Sense Media. (2019). "EdTech Industry Taking Steps to Improve Privacy Policies but Much Work Still Needed to Ensure Student Safety." Published September 4, 2019. 150 products evaluated in 2019 versus 100 in 2018; 20% versus 10% met minimum criteria.
3. Federal Trade Commission. "Complying with COPPA: Frequently Asked Questions." Amended Rule effective June 23, 2025, full compliance required April 22, 2026, penalties up to $53,088 per violation.
4. Federal Trade Commission. (2025). "Court Approves Order Requiring Disney to Pay $10 Million to Settle FTC Allegations." Order approved December 31, 2025.
5. New York Attorney General. (2025). "Attorney General James and Multistate Coalition Secure $5.1 Million from Education Software Company for Failing to Protect Students' Data." Published November 2025. Settlement breakdown by state and affected student counts.
6. Federal Trade Commission. (2026). "FTC Gives Final Approval to Order Against Illuminate Settling Allegations It Failed to Secure Students' Personal Data." Order approved June 5, 2026. 10.1 million student records affected nationwide.
7. Holland & Knight. (2026). "CalPrivacy Fines PlayOn Sports $1.1M for CCPA Opt-Out and Notice Violations." Summary of the California Privacy Protection Agency's order, decided February 2026, announced March 2026.
8. US Department of Education, Student Privacy Policy Office. "Education Technology Vendors." FERPA's scope over institutions and their designated school-official vendors.
9. Parent Coalition for Student Privacy. "State Student Privacy Laws." More than 20 states have adopted laws modeled on California's original SOPIPA, now KOPIPA.

Note: All figures verified as of August 2026. The Common Sense Media 2019 data-practices breakdown is the most recent large-sample study of its kind and is dated accordingly; the 2025 Privacy Seal pass rate is a separate, current metric from the same organization. This post will be refreshed if Common Sense Education publishes an updated Privacy Seal pass rate or a new large-scale EdTech evaluation.