The Moment I Realized We Had a Problem
It was a Tuesday afternoon in September. Ella came home from school, dropped her backpack in the hallway—right where Emily had asked her not to—and pulled out a gray Chromebook.
"Dad, we got these today. Everyone in my class has one."
I looked at the device. Standard school-issued Chromebook. Managed by the district. Probably had some filtering software installed. Nothing unusual.
Then Ella said something that made me pause.
"I already signed in with my school account. Can I show you what we did today?"
She opened the Chromebook, and I watched her navigate to a learning platform I'd never heard of. The site asked for her name, her grade, her teacher's name, and her date of birth. She typed it in without hesitation.
I asked: "Did anyone explain what happens to that information?"
She shrugged. "We just use it for math."
That's the moment I realized: we had a school-issued device in our house. It was connected to our home Wi-Fi. It was collecting information about our daughter. And we hadn't had a single conversation about what that meant.
The Gap Between School IT and Home Privacy
Here's what I've learned since that Tuesday afternoon.
School districts are generally good at protecting student data within their systems. They have policies. They have contracts with vendors. They have compliance requirements.
But there's a gap—and it's the gap between what the school manages and what happens in your home.
When a Chromebook comes home, it's still a school device. But it's operating in your environment. It's on your Wi-Fi. It's used at your kitchen table. It's exposed to your family's habits, accounts, and attention.
Here's what that actually means:
The Chromebook may collect data that goes beyond school purposes
Educational apps often have privacy policies that parents haven't read
The device is connected to your home network—which has its own risks
Your child may be using the device in ways the school didn't anticipate
Account sharing or family logins can create unexpected data linkages
The result: your child's privacy is being managed by a system that doesn't have "your family's privacy" as its primary goal. The school's job is education. Privacy is secondary.
What Data Is Actually Being Collected?
Let me walk you through what happens when your child uses a school-issued device.
Personal Information
Every educational app or platform typically collects:
Full name
Date of birth
Grade level
School name
Teacher name
Email address
Account usage data
Device identifiers
IP address
Location data (often at the city level)
Browser activity — including what they do before and after the school platform
Usage Data
The platform tracks:
Time spent on the platform
Pages visited
Answers given
Performance data
Login times
Logout times
Interaction patterns
Behavioral Data
Some platforms track more than just academic performance:
Click patterns
Time spent on each question
Pauses or hesitations
Device orientation
Typing speed
Why this matters: This data can be combined, analyzed, and shared. It can be used to build profiles, target advertising, or even be sold to third parties. Most parents don't know this is happening—and they're not given the choice to opt out.
The Real Risk for Families
The data collection itself isn't the only issue. Here's what concerns me most.
Data Breaches Are Common
Educational data is valuable. It's detailed. It's stable (kids don't change their date of birth). And it's often not as well-protected as financial or medical data.
If a school platform is breached, attackers get:
Name and date of birth
School and grade information
Behavioral data
Parent contact information
Device information
Data Is Shared With Third Parties
Most educational platforms share data with third parties. That includes analytics companies, advertising networks, and service providers.
Example: A platform might use a third-party analytics tool. That tool tracks user behavior across multiple sites. It builds a profile of the user that goes beyond the school platform. That profile can be used for targeted advertising—even for children.
I'm not saying this to alarm you. I'm saying it because most parents don't realize that their child's "learning platform" and a commercial website might use the same tracking infrastructure.
Data Can Be Combined With Other Data
Your child's school data might be combined with other data about your family. If you use the same email address for school and personal accounts, or share accounts across family members, the school data becomes linked to your household profile. This is how a school device creates a window into more than just school activity.
Long-Term Storage Is Unclear
What happens to the data when your child leaves the school? When they graduate? When the platform changes?
Most parents don't know. Most schools don't have clear answers.
What Parents Should Ask the School
Let me give you practical steps you can take right now. Here's what I did after Ella brought home that Chromebook.
A Simple List of Questions for Your School District
Start with these questions:
What educational apps and platforms is my child using?
What data does each platform collect?
Is this data shared with third parties? If so, with whom?
How is the data stored and secured?
How long is the data retained?
Can I review or request deletion of my child's data?
Are these platforms COPPA-compliant?
How to Ask Without Being Difficult
I know this can feel awkward. I'm a former security professional and even I hesitated before sending an email to the school district. Here's how I approached it.
A template you can use:
"Hi [Teacher or School Admin],
Our daughter [Name] brought home a Chromebook this week and we're excited she'll be using it for school. I had a quick question about the platforms she'll be using—specifically [Platform Name]. Could you tell me what data is collected and whether that data is shared with any third parties?
We're just trying to understand what protections are in place for student data.
Thanks for your help!"
I sent this email and got a thoughtful response. The teacher didn't have the answers herself, but she forwarded it to someone who did. That's a good outcome.
What to Do With the Chromebook at Home
Here are practical steps you can take in your own environment.
1. Understand the Device
Ask the school:
Who manages the device? (School IT or a vendor?)
What filtering or monitoring software is installed?
Is the device tracked or monitored when at home?
Are there any parental controls available?
Look for yourself:
Open the settings and see what accounts are signed in
Check for installed apps or extensions
Look at the privacy and security settings
2. Teach Your Child the Basics
Ella is eight. She doesn't need to understand data privacy laws. But she does need to understand simple rules.
What I tell Ella:
Only use school accounts for school devices
Don't click on anything that asks for personal information
Ask before entering any information online
Don't sign into personal accounts on the school device
If something seems weird, ask
This doesn't make her paranoid. It makes her aware.
3. Manage the Home Wi-Fi
This is where the "not just a school device" part really matters.
Suggestions:
Consider putting the Chromebook on a separate Wi-Fi network—a guest network or VLAN
If you can't separate it, review the security settings on your router to ensure it's secured
Make sure your home Wi-Fi uses WPA2 or WPA3 encryption
Change the default router password if you haven't already
Monitor devices connected to your network periodically
4. Keep Personal Accounts Separate
The simple rule:
School accounts are for school
Personal accounts are for personal
Never the two shall meet
Why this matters:
If your child uses a personal Gmail account to log into a school platform, that platform now has a link to your family's personal data. That's not a link I want created.
A Note on the "Opt-Out" Option
I want to be honest about something.
Opting out isn't always possible. In many school districts, there's no opt-out for educational platforms. They're required for participation.
But that doesn't mean you have no choice.
Here's what I look for:
Alternatives: Is there an offline option for children whose families aren't comfortable with the platform?
Parental permission: Are there forms to sign? Is the data use transparent?
Privacy policy: Are you given clear information about how data is handled?
Support staff: Is there a point of contact for parent questions?
If a platform is non-negotiable:
Review the privacy policy yourself
If there's a data breach, check the school's communication policy
Check how long data is retained
Continue to maintain the separation between school and home accounts
The Conclusion: You Don't Need to Be a Privacy Expert
Let me be clear about something.
You don't need to become a privacy expert to protect your child's data.
You need to ask questions, set boundaries at home, and teach your child simple habits. That's it.
The post you just read is not meant to make you panic. It's meant to show you where the gaps are and what you can do about them.
Protect the front door before you build a taller fence.
The front door in this case is:
Knowing what platforms your child is using
Separating school accounts from personal accounts
Securing your home Wi-Fi
Teaching your child the basics of skepticism
That's not technical. That's practical.
Next Week: I'll walk you through a specific scam breakdown in our house—the fake package text that almost caught Emily. I spent years analyzing these patterns professionally, and I'll show you exactly how that attack worked and how to spot it in your own family.
Dave C. — Five minutes now beats five hours later.
No notes on this sheet yet.