The file starts before the kid can read the contract
A five-year-old gets a school laptop login before they can spell their own name. A fingerprint or a palm scan buys their lunch before they understand what a fingerprint is. A badge scan logs when they get on and off the bus. None of it asks the child anything, and in practice, very little of it asks a parent for real, informed, opt-in consent either -- most of these programs run opt-out, bundled into enrollment paperwork, not a standalone yes-or-no.
That's the actual shape of this story. It runs through four separate paths that mostly don't talk to each other -- the school itself, the commercial apps layered on top, the safety and law-enforcement pipeline, and the parents trying to watch back -- and the most alarming thing any of them has produced, a 13-year-old arrested over a joke, is one branch of that tree. Not the root of it.
This school breakdown is one place on a bigger map. See the full interactive picture at /USA -- car, phone, home, work, store, street, and airport all work the same way.
Path 1: The school building itself is an enrollment form
Cafeteria biometrics. Vendors including identiMetrics (fingerprint) and, on some contracts, Fujitsu's PalmSecure (palm-vein) sell lunch-line payment systems to U.S. school districts. identiMetrics markets its reach as "more than 2 million students... in 48 states" -- that's the vendor's own undated claim, not an independently verified count, and no reliable nationwide figure exists for how many districts actually run these systems. What is documented is how consent tends to work in practice. At Caribou High School in Maine, a proposed fingerprint rollout in February 2024 relied on a single parental email; a parent told local reporters "no permission form was needed. It was assumed that because I didn't reply to an email that I was granting permission." The ACLU of Maine's public-records review also found the vendor's own contract language was internally contradictory about whether student data stayed local or could be shared. The district reversed the rollout within a day of the backlash. In Oak Harbor, Ohio, in 2023, a parent objected that the initial notice never actually asked permission; the district said an opt-out PIN existed and conceded its communication "could have been better." Illinois's biometric privacy law, BIPA, explicitly excludes government agencies -- meaning public school districts generally sit outside the one state law with real teeth on this, which likely explains why no lawsuit against a cafeteria-biometrics vendor specifically was found in this reporting.
Bus tracking. Vendors including Zonar ("Z Pass") and Synovia ("Here Comes the Bus," now part of CalAmp) issue students RFID cards that a bus-mounted reader scans on boarding and exit, tied by card ID to the specific enrolled student, with GPS logging where and when. Synovia's own service agreement says it retains six months of location "breadcrumb" data and 24 months of ridership reports, deleted only after a district's contract ends. In December 2023, security researchers at Tenable disclosed that a routing vendor, Edulog, had access controls enforced only on the client side -- meaning anyone who knew how could pull names, assigned bus routes, parent contact information, and real-time GPS location for roughly 6 million student riders across more than 85,000 buses. Edulog wasn't legally required to, and didn't, notify the affected districts or parents. Separately, leaked internal documents reported by 404 Media in May 2026 describe BusPatrol -- whose AI stop-arm cameras, by the company's own account, watch more than 2 million students on 40,000-plus buses -- planning to convert those cameras into automatic license-plate readers and share vehicle-location data with law enforcement, "likely without a warrant," in partnership with Axon; BusPatrol's own internal materials reportedly flagged the risk that ICE could obtain access. BusPatrol has not confirmed this plan on the record.
Hallway and classroom cameras. This part of school life is no longer the exception: 93% of U.S. public schools ran security cameras as of 2021-22, up from 61% in 2009-10, and 86% of students ages 12-18 say they've noticed one, per the federal government's own School Survey on Crime and Safety. A smaller number of districts have layered facial recognition on top. Marion County, West Virginia became the state's first county to do so, spending a $2.7 million grant on a system called ROC Watch, built by Rank One Computing, planned for nine of its 21 schools and checking visitors against the sex-offender registry. Lockport City School District in New York ran a similar system starting in 2020 until an independent audit found its algorithm was 16 times more likely to misidentify Black women than white men; New York's governor signed a statewide moratorium that December, later made permanent, banning facial recognition in every K-12 school in the state. Weapons-detection AI has its own failure record: the FTC took action against vendor Evolv Technology in November 2024 for deceptively marketing a system, installed in roughly 800 schools across 40 states, that functions more like a metal detector than the company claimed -- it missed a 7-inch knife used in an actual stabbing at a school that had the system running. At Kenwood High School in Baltimore County, Maryland, on October 20, 2025, a different vendor's AI gun-detection system -- built by Omnilert -- misidentified a 16-year-old's bag of Doritos as a firearm; police handcuffed him at gunpoint. Omnilert told CNN it regretted the incident but said "the process functioned as intended: to prioritize safety and awareness through rapid human verification." The ACLU puts the K-12 surveillance-technology market at $3.1 billion a year, growing roughly 8% annually, while noting that eight of the ten deadliest K-12 shootings since Columbine happened at schools that already had camera surveillance installed.
Path 2: Where it goes once it leaves the building
Federal student-privacy law, FERPA, has a carve-out that makes most of this legal without asking a parent each time: the "school official exception" lets a district hand student data to a vendor -- an app, a monitoring tool, a payment processor -- without individual consent, as long as the vendor is doing something the school would otherwise do itself. FERPA also has no private right of action; the Supreme Court settled that in Gonzaga University v. Doe (2002). The only enforcement path runs through a Department of Education complaint office that, per the department's own 2018 Inspector General audit, couldn't even precisely count its backlog -- officials estimated it was running about two years behind on investigations.
That gap is where the money is. A nonprofit called Internet Safety Labs tested 1,357 apps used across 663 randomly sampled public schools and found 96% of them shared student data with third parties, most of it flowing to advertising and analytics companies, typically without the school or the family ever being told. The average district now uses roughly 2,739 distinct ed-tech tools in a school year, according to industry tracker LearnPlatform -- an 8% increase from the year before. Two federal cases show what that ecosystem can produce when it goes wrong. The FTC settled with Edmodo, a classroom platform, in 2023 after finding it had retained data tied to roughly 36 million student accounts and used children's information for advertising without verified parental consent -- a $6 million penalty, suspended based on the company's documented inability to pay. A larger case is still resolving: education-software vendor Illuminate Education left student data, including names, birthdates, and disciplinary and health-related records for more than 10 million students, sitting in plain text through a 2021-2022 breach; the FTC's final order came down in June 2026, and a separate multistate settlement in November 2025 -- $5.1 million from California, Connecticut, and New York -- marked the first-ever enforcement of two states' student-privacy laws.
Path 3: The most alarming example -- when a flag becomes a police response
This is the part that actually went viral, and the viral version is wrong about which case is real.
The video everywhere shows a 22-year-old student teacher in Illinois led out of an elementary school in handcuffs, hours after venting to friends in a group chat that she wanted to "shoot" a kid who deleted her lesson plan. The story that spread with it -- that Snapchat's AI read her private message and reported her to the FBI -- has never actually been confirmed. Kristen Volpe, 22, was arrested at John L. Hensey Elementary in Washington, Illinois, on January 29, 2025, and charged with disorderly conduct, per local NBC affiliate WAND-TV; deputies concluded she'd spoken out of "exasperation" with no intent to harm anyone. What the credible local reporting never establishes is how the message actually got out. That detail -- Snapchat's AI, a call to the FBI within the hour -- comes only from viral aggregators quoting each other. It might be true. It has never been established.
The system that is documented, and pointed squarely at kids, is different. An Associated Press investigation found that thousands of U.S. school districts run AI monitoring software -- Gaggle and Lightspeed Alert are the two most-named -- that scans what students write on school accounts and school-issued devices, and escalates anything it reads as violence, self-harm, or drugs to school officials and often directly to police. Adoption expanded fast after Parkland and Uvalde. In August 2023, an eighth-grader in Tennessee made a dark joke to friends -- "on Thursday we kill all the Mexico's," riffing on her own tanned skin, after a friend asked what she was doing that day -- on a school-monitored platform. Gaggle flagged it. She was pulled from class, arrested, interrogated, strip-searched, and held overnight; her mother wasn't allowed to see her until the next day. She got eight weeks of house arrest, a psychological evaluation, and 20 days in an alternative school. "I thought you hated me," she told her mother afterward.
The false alarms aren't the exception. In Lawrence, Kansas, nearly two-thirds of about 1,200 Gaggle alerts over ten months were judged non-issues, including more than 200 that turned out to be students' own homework; a photography class got flagged for "nudity." In Polk County, Florida, roughly 500 alerts over four years led to 72 involuntary psychiatric holds under the state's Baker Act. Lawrence has since dropped Gaggle -- for a competitor, ManagedMethods, which a separate student lawsuit alleges offers "the same kind of surveillance." A federal judge ruled in April 2026 that the district violated Kansas's open-records law by stonewalling requests about the switch; in July 2026, the same judge ordered the district to pay $113,000 in attorney fees and costs, finding its handling of the request "was not in good faith and lacked a reasonable basis in fact or law." Even Gaggle's own CEO, Jeff Patterson, told the AP he wished one flagged case "was treated as a teachable moment, not a law enforcement moment."
Path 4: The people watching are being watched back
Parents get their own window into this system, and it isn't a safe one either. Parent portals like PowerSchool typically show grades, attendance, and discipline records; PowerSchool disclosed in January 2025 that a hacker had used a stolen contractor credential to pull data out of its systems. How many students that touched is genuinely disputed and shouldn't be reported as a single settled number: the hacker's own extortion claim was 62.4 million students and 9.5 million teachers; PowerSchool itself has never confirmed a total; federal prosecutors' account of the case, reported by CyberScoop after the hacker's October 2025 sentencing, put it near 70 million. Texas alone confirmed more than 880,000 affected in a state lawsuit accusing PowerSchool of skipping multi-factor authentication and encryption. The hacker, Matthew Lane, was sentenced to four years in prison and $14.1 million in restitution.
Separately, GoGuardian -- software districts install to monitor school-issued devices -- gives administrators what the Electronic Frontier Foundation's 2023 investigation called "nearly unfettered access" to roughly 27 million students' real-time browsing history, search terms, and sometimes location and webcam footage, assigning each student a "risk score" that regularly flags benign content: LGBTQ resources, health information, counseling sites.
Consumer apps marketed straight to parents carry their own trade-off. Life360, once used by 33 million people, was found by The Markup in 2021 to be selling precise family location data to roughly a dozen data brokers -- revenue from those sales grew from $693,000 in 2016 to $16 million in 2020, close to a fifth of the company's total revenue that year. Life360's CEO called the practice "an important part of our business model" before the company scaled it back. Apps like Bark and Qustodio say in their own privacy policies that they don't sell data to third parties -- self-reported claims this reporting could not independently audit. No FTC action against any of the four most-named consumer parental-monitoring apps turned up in this research; the closest real precedent is a September 2025 FTC settlement with a children's-toy app, Apitor, over a location-sharing SDK that violated federal child-privacy law.
What this piece is not saying
This isn't saying any of these vendors or districts act in bad faith -- Gaggle's own CEO asking for "a teachable moment, not a law enforcement moment" argues the opposite, and most of what's described here is a design and consent problem, not a conspiracy. It isn't saying the Snapchat/FBI story about the Illinois teacher is false -- it's saying nobody has confirmed it, which is different. It isn't saying school security cameras, bus tracking, or cafeteria payment systems are illegitimate on their face; schools have real safety and logistics obligations, and some of this technology plainly serves them. And it isn't saying FERPA does nothing -- it's saying FERPA's central enforcement mechanism, a federal complaint office running roughly two years behind by its own count, is not the same thing as real-time protection. The question this piece is actually asking is narrower: at what point in a five-year-old's first week of kindergarten does anyone ask a parent a real yes-or-no question about any of this -- and when the answer is never, what does that file look like by the time the kid is old enough to ask for it back?
What to actually do
- Ask your district, by name, which vendors touch your child's data: the monitoring software on school devices (Gaggle? Lightspeed? GoGuardian? Bark?), the cafeteria payment system, and the bus-tracking app. For monitoring software specifically, ask the only question that matters: does a flag go to a counselor first, or straight to a school resource officer?
- Before signing any enrollment paperwork, look for an actual opt-out or consent clause on biometric collection (fingerprint or palm scans) and bus RFID tracking. If the notice doesn't ask you a real yes-or-no question, that's the model, not an oversight -- ask in writing anyway, and ask what happens to the data if you decline.
- Assume anything typed on a school account or school-issued device is monitored and can be escalated to police. Tell your kids plainly, in age-appropriate terms, before they find out the hard way.
- If you use a parent-monitoring app (Bark, Life360, Qustodio, or similar), read the actual privacy policy for the data-sharing language, not just the marketing page -- and know that some of these run on your child's own phone, watching them the way the school does.
- File a FERPA complaint with the Department of Education's Student Privacy Policy Office if you believe a school shared your child's data improperly. It's slow -- expect a real wait -- but it's the documented federal channel, and a paper trail matters even when the process is backed up.
Why this is a BL:UF story
The panic attached itself to the wrong case. A viral video of a teacher's arrest trends because it's frightening and personal, even though the mechanism behind it was never confirmed. The system that's actually documented -- an AP investigation, a federal lawsuit, a CEO's own misgivings, real kids in real cells -- barely trends, because it's aimed at children and wrapped in the language of safety. But that system is only the loudest branch. The quieter one runs through a fingerprint scanner at lunch, a badge scan on the bus, a camera in the hallway, and more than 2,700 apps a year that most parents have never heard of -- and it starts before any child involved is old enough to say yes or no to any of it.
The Receipts
BL:UF doesn't ask you to trust us. Check our work:
AP investigation -- AI school surveillance, student arrests, and false alarms -- Associated Press, via WUSF: wusf.org/education/2025-08-07/students-have-been-called-to-the-office-and-even-arrested-for-ai-surveillance-false-alarms
The 13-year-old's arrest, the Lawrence and Polk County numbers, and the Gaggle CEO's quote -- same AP investigation (also carried by KSTP and NBC6 South Florida): nbcmiami.com/news/national-international/students-arrested-for-ai-surveillance-false-alarms
The Lawrence, KS lawsuit over Gaggle surveillance -- Lawrence Times: lawrencekstimes.com/2025/08/01/usd497-gaggle-lawsuit-filed
The switch to ManagedMethods and the "same kind of surveillance" allegation -- Lawrence Journal-World, Nov. 21, 2025: www2.ljworld.com/news/schools/2025/nov/21/students-allege-continued-unconstitutional-ai-digital-surveillance-with-new-vendor-and-violations-of-open-records-act-in-school-district-lawsuit
The April 2026 open-records violation ruling -- Lawrence Journal-World, April 10, 2026: www2.ljworld.com/news/schools/2026/apr/10/federal-judge-finds-lawrence-school-district-violated-open-records-law-in-student-lawsuit-regarding-gaggle
The July 2026 $113,000 attorney-fee sanction and "not in good faith" finding -- Lawrence Times, July 27, 2026: lawrencekstimes.com/2026/07/27/judge-usd497-pay-113k
The teacher's arrest (Jan 29, 2025), the charge, and the "exasperation" finding -- WAND-TV (NBC, central Illinois): wandtv.com
Oak Harbor, Ohio cafeteria fingerprint-scan pushback -- 13abc, Aug. 15, 2023: 13abc.com/2023/08/15/some-oak-harbor-parents-unhappy-with-finger-scan-program-school-lunches
The Kenwood HS Doritos incident and Omnilert's on-record response -- CNN, Oct. 25, 2025: cnn.com/2025/10/25/us/baltimore-student-chips-ai-gun-detection-hnk
Evolv Technology's FTC settlement, 800 schools/40 states, and the missed 7-inch knife -- FTC press release, Nov. 2024: ftc.gov/news-events/news/press-releases/2024/11/ftc-takes-action-against-evolv-technologies-deceiving-users-about-its-ai-powered-security-screening; The 74, Jan. 2025: the74million.org/article/ftc-ai-weapons-detection-co-evolv-misled-schools-about-its-safety-abilities
Cafeteria biometrics: identiMetrics deployment and privacy claims -- identiMetrics: identimetrics.net/biometrics-info/student-privacy-guide
Caribou High School, Maine fingerprint rollout and reversal -- Bangor Daily News, Feb. 13, 2024: bangordailynews.com/2024/02/13/aroostook/caribou-school-to-use-student-fingerprints-for-data-collection; ACLU of Maine records review: aclumaine.org/publications/caribou-high-school-public-records
Illinois BIPA's government-agency exclusion -- 740 ILCS 14/10, via Justia: law.justia.com/codes/illinois/chapter-740/act-740-ilcs-14/
Synovia/"Here Comes the Bus" data retention terms -- Synovia Solutions service agreement: synovia.freshdesk.com/en/support/solutions/articles/22000174512
Edulog API vulnerability exposing 6 million student riders -- THE Journal, Dec. 14, 2023: thejournal.com/articles/2023/12/14/vulnerabilities-in-edulog-portal-revealed-bus-location-data-logins-for-6m-students.aspx
BusPatrol's reported plan to share license-plate/location data with law enforcement -- 404 Media, May 26, 2026: 404media.co/buspatrol-put-ai-cameras-in-tens-of-thousands-of-school-buses-now-they-want-to-give-cops-access
School camera prevalence (93% of public schools, 2021-22) -- National Center for Education Statistics, Condition of Education: nces.ed.gov/programs/coe/indicator/a19
Marion County, WV facial recognition deployment -- WV MetroNews, Feb. 8, 2025: wvmetronews.com/2025/02/08/marion-county-schools-increase-school-safety-measures-through-facial-recognition-weapons-detection-technology
Lockport, NY facial recognition, the misidentification-rate audit, and New York's statewide moratorium -- BuzzFeed News, Dec. 23, 2020: buzzfeednews.com/article/carolinehaskins1/new-york-stops-school-facial-recognition; ACLU: aclu.org/press-releases/new-york-creates-first-nation-moratorium-facial-recognition-schools
FTC action against Evolv Technology's weapons-detection marketing -- Electronic Frontier Foundation, Dec. 2024: eff.org/deeplinks/2024/12/ftc-rightfully-acts-against-so-called-ai-weapon-detection-company-evolv
Kenwood High School, Baltimore County, MD -- AI gun-detection misidentified a Doritos bag -- CNN, Oct. 25, 2025: cnn.com/2025/10/25/us/baltimore-student-chips-ai-gun-detection-hnk
ACLU "Digital Dystopia" report on the K-12 surveillance market -- ACLU, Oct. 2, 2023: aclu.org/publications/digital-dystopia-the-danger-in-buying-what-the-edtech-surveillance-industry-is-selling
FERPA's "school official exception" -- 34 CFR 99.31(a)(1), via Cornell Legal Information Institute: law.cornell.edu/cfr/text/34/99.3
FERPA has no private right of action -- Gonzaga University v. Doe, 536 U.S. 273 (2002); Congressional Research Service explainer: congress.gov/crs-product/R46799
Dept. of Education's own audit finding a ~2-year FERPA complaint backlog -- U.S. Dept. of Education Office of Inspector General, Nov. 26, 2018, via oversight.gov: oversight.gov/reports/audit/office-chief-privacy-officers-processing-family-educational-rights-and-privacy-act
Internet Safety Labs finding 96% of tested school apps share data with third parties -- Internet Safety Labs, Dec. 13, 2022: internetsafetylabs.org/blog/news-press/isl-research-reveals-96-of-school-apps-send-student-data-to-third-parties
Average ed-tech tools per district (2,739, +8% YoY) -- LearnPlatform by Instructure, "EdTech Top 40": prnewswire.com/news-releases/new-learnplatform-by-instructure-report-finds-increases-in-more-unique-digital-tools-accessed-by-k-12-institutions-students-and-teachers-302180031.html
FTC v. Edmodo -- $6 million penalty over children's data used for advertising -- FTC press release, May 25, 2023: ftc.gov/news-events/news/press-releases/2023/05/ftc-says-ed-tech-provider-edmodo-unlawfully-used-childrens-personal-information-advertising
FTC v. Illuminate Education and the CA/CT/NY multistate settlement -- GovTech, Dec. 2, 2025: govtech.com/education/k-12/ftc-mandates-security-overhaul-for-ed-tech-company-after-breaches; New York AG, Nov. 6, 2025: ag.ny.gov/press-release/2025/attorney-general-james-and-multistate-coalition-secure-51-million-education
PowerSchool breach -- disclosure, disputed victim counts, and the hacker's sentencing -- PowerSchool's own incident page: powerschool.com/security/sis-incident; CyberScoop, Oct. 2025 sentencing coverage: cyberscoop.com/powerschool-hacker-matthew-lane-sentenced; original 62.4M extortion claim, Bleeping Computer, Jan. 2025: bleepingcomputer.com/news/security/powerschool-hacker-claims-they-stole-data-of-62-million-students; Texas AG lawsuit, Sept. 2025: click2houston.com/news/local/2025/09/03/texas-sues-powerschool-over-breach-compromising-info-of-over-880000-students-teachers
GoGuardian's district-side monitoring access -- Electronic Frontier Foundation, Oct. 2023: eff.org/deeplinks/2023/10/how-goguardian-invades-student-privacy
Life360 selling precise location data to data brokers -- The Markup, Dec. 6, 2021: themarkup.org/privacy/2021/12/06/the-popular-family-safety-app-life360-is-selling-precise-location-data-on-its-tens-of-millions-of-user
FTC v. Apitor Technology -- children's location-data COPPA violation -- CyberScoop, Sept. 2025: cyberscoop.com/ftc-settlement-apitor-childrens-privacy-violation
On the "Snapchat AI reported her to the FBI" claim -- unconfirmed by any credible outlet; asserted only by viral aggregators and reaction videos. We flag it as unverified rather than report it as fact.
