"We'll Fix It Later": Education, AI, and the Deferral of Student Privacy in EdTech

Synthesis: Across 12 interviews with EdTech professionals and an audit of 48 platform privacy policies, this study finds that student privacy is not overlooked but deferred: recognized as important, then postponed behind pilots, growth, and visible product outcomes, with responsibility handed to cloud providers, policy documents, and schools. The audit mirrors that structure: platforms describe collection well (mean 1.81 of 2) while consent, AI disclosure, and accountability lag; 33% make no meaningful AI disclosure despite visible AI features. The authors conclude that enforceable AI Regulation in Education and procurement standards, not voluntary commitments, must make Privacy a condition of EdTech deployment.

Key Findings

1. Privacy is deferred, not overlooked. All 12 interviewees treated privacy as important yet sequenced it after pilots, growth, or core functionality; P10 said "security was going to become a second base layer."
2. Delegation makes the delay look managed. Responsibility moved to cloud providers, policy documents, compliance functions, or schools, until privacy was everyone's responsibility in principle and no one's job in practice.
3. Feedback loops are weak. Participants received usability, engagement, and learning-outcome feedback but little privacy feedback, so silence read internally as proof that nothing was urgent.
4. Collection is disclosed; downstream governance is not. Across 48 platforms, data collection scored highest (mean 1.81; 79% at the top score), while children's consent (1.05), AI disclosure (0.90), and accountability (1.07) trailed.
5. A third of platforms say nothing about AI. 33% (16 of 48) made no meaningful AI disclosure despite visible AI features, and 73% offered only a generic contact, vague breach language, or "industry-standard" claims.
6. Regulation raises only what it names. US K-12 platforms scored highest overall (M=7.47, versus 5.50 for US higher education and 4.77 for India K-12; H=20.634, p<0.001) but gained nothing on AI disclosure or accountability.

Privacy is postponed, then delegated across the lifecycle

The qualitative core is 12 interviews of 30-45 minutes, drawn from roughly 100 contacts across US and Indian startups, nonprofits, research organizations, and public K-12 districts; three practitioners dropped out over NDA or compliance restrictions. Coding produced more than 80 initial codes in eight categories, dominated by privacy deferral and delegation. Startups faced market-speed pressure; nonprofits and schools had to justify privacy work against visible program costs. Delegation gave the delay structural form: encryption and two-factor authentication were common, but threat modeling, provenance tracking, and systematic privacy review were treated as desirable, not required.

What the 48-platform audit shows: disclosure without governance

Two coders scored 48 platforms — US K-12 (n=18), US higher education and adult learning (n=14), India K-12 and exam preparation (n=11), India higher education (n=2), and AI-native tools (n=3) — on data collection, third-party sharing, children's consent, AI decisions, and accountability. Reliability was strong overall (mean Cohen's κ = 0.781; total scores correlated at r=0.865), with the weakest agreement in AI and accountability language. Data collection averaged 1.81 and third-party sharing 1.46, but AI disclosure reached only 0.90 and accountability 1.07, with 73% of platforms on the middle accountability score. The result is a compliance-practice gap: organizations satisfy visible disclosure expectations without building mechanisms that govern downstream use.

Why EdTech's corrective mechanisms are weaker

The authors do not claim EdTech uniquely neglects Privacy; software teams generally postpone privacy work too. What differs is the absence of correctives. Students usually do not choose their LMS or classroom applications, and families may not know which services are in use, so user exit, reputational pressure, and ordinary market feedback are unreliable. Profiling, secondary use, and altered learning trajectories accumulate quietly and resist attribution to a single decision. Procurement compounds this: schools rely on trust because they cannot verify vendor claims, and P10 described companies bypassing districts — going straight to a school and saying, "you're going to give me the data." Capacity is uneven, and some commercial models treat data-intensive personalization as part of the product's value.

AI as a governance frontier, not the origin of the problem

AI appears as an amplifier rather than a new failure mode. P7 asked how to use AI "to actually teach kids to think deeper," while P3 described a school with no designated AI or privacy specialist, where the principal was the go-to technology person. Participants described reactive governance, with tools restricted only after problems emerged, and uncertainty about teachers uploading student information into general-purpose models. The audit supplies the structural analogue: a third of platforms gave no meaningful AI disclosure, so a parent may know grades are stored without knowing that a spreadsheet upload transmits student data to a third-party model, or that an automated recommendation shapes a pathway. That opacity weakens already-limited feedback: users cannot tell what processing occurred, which actor decided, or where to raise a concern.

What this means for practice

• Educational technology developers. Make privacy a release criterion: require a one-page data-flow summary from the feature owner before student-facing deployment — retention and model-training use, what is decided automatically, incident ownership.
• Instructors. Treat the moment of upload as the decision point: confirm whether AI use is disclosed and which institutional channel owns approval before putting student information into a general-purpose model.
• Administrators. Use the five audit dimensions as a lightweight procurement rubric and demand operational evidence — subprocessors, consent practice, retention, breach timelines — rather than accepting a privacy policy's existence as sufficient.
• Policymakers and researchers. Write specific enforceable obligations, since disclosure improves only where a rule directly governs, and stop treating privacy as a single maturity score.

Limitations

• The interview sample is small (n=12), primarily US-based, and shaped by NDA restrictions; large commercial platforms and regulators are not represented, and the authors claim neither saturation nor generalizability.
• The audit is a snapshot of publicly accessible documentation, not proof of internal behavior: a zero means no disclosure was reachable within one or two clicks of the homepage, not that no internal commitment exists.
• The India segment is smaller than its market importance and DPDPA enforcement was still developing, so cross-country differences are patterns within a purposive sample, not national privacy estimates.

Connected Concepts

• Privacy
• AI Governance
• AI Regulation in Education
• Educational AI Policy
• Edtech Platform
• AI Use and Disclosure Statements
• Legal Issues and Risks
• K-12
• Higher Education
• Mixed-Methods Research
• Qualitative Research
• Administrators
• Stakeholders
• Personalized Learning
• Learning Analytics

Connected Articles

• Rethinking data privacy for AI adoption in African higher education: A meta-synthesis of stakeholder perceptions and policy implications — Rethinking data privacy for AI adoption in African higher education: A meta-synthesis of stakeholder perceptions and policy implications
• Beyond Compliance: A Proposed Framework for Ethical Governance of Student Data in Learning Analytics — Beyond Compliance: A Proposed Framework for Ethical Governance of Student Data in Learning Analytics
• Governing generative AI in higher education: Emerging policy approaches and support ecosystems at innovative U.S. universities — Governing generative AI in higher education: Emerging policy approaches and support ecosystems at innovative U.S. universities
• Policy Fragmentation or Institutional Alignment? Institutional Governance of AI in Universities and Business Schools — Policy Fragmentation or Institutional Alignment? Institutional Governance of AI in Universities and Business Schools
• Zero-Shot Governance: General-Purpose AI in Policy — Zero-Shot Governance: General-Purpose AI in Policy
• Co-designing AI with youth partners: Enabling ideal classroom relationships through a novel AI relational privacy ethical framework — Co-designing AI with youth partners: Enabling ideal classroom relationships through a novel AI relational privacy ethical framework

Citation

Meghna Manoj Nair, & Rachel Greenstadt (2026). "We'll Fix It Later": Education, AI, and the Deferral of Student Privacy in EdTech. arXiv preprint.