The legal environment surrounding EdTech vendors has grown substantially more perilous. In mid-2026, California parents filed a major lawsuit against Curriculum Associates, alleging improper student data collection practices. The complaint focused on the vast quantities of granular behavioral metrics gathered by the platform, including keystroke rhythm, response latency, and mouse-movement tracking across millions of public school minors.
The lawsuit raised red flags for district legal teams across the country. School boards that once signed enterprise agreements without hesitation began submitting their vendor contracts to stringent third-party cybersecurity and privacy audits. While Curriculum Associates maintains that its diagnostics comply with federal frameworks like FERPA and COPPA, the threat of legal liability caused several districts to pause renewals pending regulatory clarification. Each public discussion of a frozen contract added fuel to the student rumor machine.
