Your School’s Website Is Probably Leaking Student Data

Ask the parents at almost any independent school whether their children’s personal information is safe, and they’ll assume it is. The school is small, trusted, careful with tuition and transcripts — of course it protects the data. What most parents don’t know, and what many schools haven’t fully reckoned with, is how much of that data now lives outside the school entirely, spread across dozens of third-party apps, plugins, and trackers that were bolted on one convenient tool at a time.

This isn’t a story about one bad app. It’s about a supply chain most schools have lost track of — and, for independent schools specifically, a legal safety net that often isn’t there at all.

What the research actually found

Independent researchers have spent the last few years testing what the software in schools does with student data. The findings are consistent and uncomfortable.

Read the website number again, because it’s the one closest to home: a quarter of the school sites examined were quietly loading third-party trackers. Not the software students log into — the public website itself, the one prospective families browse, silently feeding visitor data to advertising and analytics companies the school never meaningfully vetted.

The safety net independent schools assume they have — and often don’t

Here’s the part that surprises even careful administrators. FERPA — the federal student-privacy law everyone name-checks — applies to institutions that receive U.S. Department of Education funding. Most private K-12 schools don’t, which means FERPA frequently doesn’t cover independent schools at all.

That cuts against intuition. Parents assume a federal law is standing guard. In much of the independent world, it isn’t — and the responsibility for protecting student and family data falls entirely on the school itself, with no federal floor beneath it. State laws are beginning to fill that gap (Utah’s H.B. 55, in force since July 2026, now requires specific student-data protections in vendor contracts), and more states are moving the same direction. But today, for most independent schools, the honest position is this: whatever protection exists is the protection the school built itself.

Why this is a reputation problem, not an IT problem

It’s tempting to file all of this under “something for the IT person to worry about.” That’s a mistake, and the scale of what’s at stake is why. In December 2024, a breach of a single widely-used school records platform exposed data on roughly 62 million students — the largest disclosed exposure in the history of student data. Enforcement is tightening too: cases involving third-party data sharing rose 34% in a single year.

Now translate that to an independent school’s actual business. The entire value proposition is trust — affluent families handing over their children, their finances, and their personal lives on the belief that this institution is careful. A data leak isn’t an IT incident in that world. It’s a breach of the one thing the school sells. It shows up in admissions, in re-enrollment, in the parent WhatsApp groups, in the reputation that took decades to build. That’s a head-of-school problem, not a help-desk ticket.

What to actually do about it

The answer is not “build your own everything.” No school should be writing its own student information system or learning platform — those are enormous, specialized tools, and reinventing them would be reckless in its own way. Anyone telling a school to build its own gradebook is selling something. The real fix is narrower, and entirely achievable.

Know your data supply chain. Most schools have never inventoried what’s actually running on their website and in their systems. The first step is simply knowing: what loads on your site, what each tool collects, and where that data goes. You can’t protect what you haven’t counted.

Own your web presence. The public website is the one piece fully within the school’s control, and it’s where the loose third-party trackers accumulate — a social pixel here, a marketing widget there, a convenient consumer-grade chat tool that phones home. A site built and maintained deliberately carries only what the school chose to put on it, and nothing it didn’t.

Prefer first-party and vetted tools over convenient ones. When a function can be handled by a tool the school controls, or a vendor with a real contract and real data protections, that’s worth more than the free plugin that was easy to install. Convenience is exactly how the 143 tools got there.

Be deliberate, not paranoid. Plenty of third-party tools are fine and necessary — a school can’t and shouldn’t run on nothing but in-house software. The point isn’t to rip everything out. It’s to know what you’ve installed and what it does, which almost no school currently can say — and to make those choices on purpose instead of one convenient click at a time.

[DAN: optional — one first-hand line here, e.g. what you typically find when you audit a school’s site for what’s loading on it. Skip if you’d rather keep it clean.]

How we think about this at 914Digital

We build and maintain websites for schools and organizations that can’t afford to be careless with the data of the people who trust them. That means a site the school actually controls — where every tool that loads is there on purpose, where staff can update content through simple fields without bolting on risky plugins, and where “what is running on our website and what is it collecting” is a question with a clear answer.

We’re not the right people to build your student information system, and we’ll tell you so. But the public face of your school, and the question of what you’ve quietly plugged into it — that’s exactly the kind of thing worth getting deliberate about.

Request a website audit
View Our Work

Sources