Education
On a school or workplace learning platform, the institution bought the system and you were never the customer, so deletion is its call and a request to the vendor is usually sent back to it. The main record stays long after you have gone, with no period named.
The read at a glance
These are special-category records, and they are often about a child.
A leak exposes a child's records, health flags, and safeguarding notes.
Academic and safeguarding records are kept for years, sometimes for life.
Enrolment may verify identity; a learning app often asks for little.
Industry profile reviewed 23 August 2026. Also machine-readable via the free API.
If it leaks
A school or university record follows you into adulthood: grades, discipline, special-needs assessments, family circumstances. One breach took the records of more than sixty million students at once.
What repeats in the policies
You were never the customer
The school, college or employer bought the platform, so they are the customer and you are not. Deletion is their call, and a request to the vendor is usually sent straight back to them. Under 13, the school's consent even stands in for a parent's.
The file covers how you worked
Policies here list conduct notes, browsing history and screenshots, message content, and how each question was answered. Watched exams add the room, the screen, your face and a photo ID.
It stays long after you have gone
Most policies name no period at all and keep the main record as long as they judge necessary. The few numbers that appear cover small pieces, like a video call. The award never goes: exam boards and universities keep it so the qualification can always be checked, and a school file about you can run for decades.
What a company here typically holds
Worked out from the industry, not from any one company. What you actually handed over is yours to record.
The list understates it for a school or university: the record covers behaviour, needs and family circumstances, and it was written about you by other people.
What this can reveal about you
Built only from what this kind of service actually collects. A dimension that the data does not support is not listed.
Health Possible
Special-needs and welfare flags sit in the file.
Mental health Possible
Pastoral and safeguarding notes touch on it.
What lawfully stays after you leave
Two kinds of hold. Law sets it: a statute makes them keep it. They set it: a ground the company grants itself.
Safeguarding records Law sets it decades
Child-protection and vulnerable-adult records are kept for decades.
Qualification and academic records They set it effectively permanent
The award is a register entry, kept so the qualification can always be verified.
Tax and accounting records Law sets it about 6 years
Tax and company law makes them keep billing and payment records.
Who wants this data
One stolen contractor login exposed more than sixty million students across thousands of districts. The ransom was paid and the districts were then squeezed again. A vendor was ordered to delete the models it had built on school-consented data, and European schools were told that handing student data over to improve the product had no lawful basis.
Sold or shared Possible
Ed-tech has shared pupil data with advertisers and brokers.
AI training Moderate
Coursework and behaviour train learning and proctoring models.
Even anonymised, this can still be you
A pupil is singled out by school, year group, and date of birth, the same few fields the first re-identification study used (Sweeney, 2000).
Name, date of birth, postcode Typical
Fifteen demographic attributes re-identify 99.98% of Americans in a released dataset (Rocher, Hendrickx and de Montjoye, Nature Communications, 2019); date of birth, postcode, and sex alone did it for most people in the first study of the problem (Sweeney, 2000).
Payment patterns Sometimes
Four card transactions identify 90% of people in payment data (de Montjoye et al., Science, 2015).
How you write Sometimes
Language models infer where a person lives, their income, and their sex from their writing alone, at near-human accuracy and at scale (Staab et al., ICLR 2024).
Face and voice Sometimes
A face, voice, or fingerprint template identifies a person directly; there is nothing left to anonymise, and it cannot be reissued like a password.
Browsing fingerprint Typical
Browser and device fingerprints were unique for 84% of visitors in the first large study (Eckersley, 2010), and sparse histories of what people viewed re-identified them against public reviews (Narayanan and Shmatikov, 2008).
The studies Estimating the success of re-identifications in incomplete datasets using generative models (Nature Communications 10, 3069, 2019)·Simple Demographics Often Identify People Uniquely (Carnegie Mellon University, Data Privacy Working Paper 3, 2000)·Unique in the shopping mall: On the reidentifiability of credit card metadata (Science 347 (6221), 2015)·Beyond Memorization: Violating Privacy via Inference with Large Language Models (ICLR 2024, 2024)·How Unique Is Your Web Browser? (Privacy Enhancing Technologies Symposium (PETS 2010), 2010)·Robust De-anonymization of Large Sparse Datasets (IEEE Symposium on Security and Privacy, 2008)
The wording that does the work
Clauses that recur across this industry, and what each one actually permits.
“to provide and improve our services”
The catch-all purpose. Analytics, profiling, personalisation and AI training all fit under it. When they want to do something new with your data, this sentence usually already allows it.
The move An objection tells them to use your data to run the service and nothing more.
“we do not sell your personal information”
Usually this means no cash changes hands. Your data can still go to ad networks, analytics firms and partners, because they count that as sharing rather than selling.
The move Use the do-not-sell switch where there is one, and put an objection in writing as well.
“service providers, partners, and affiliates”
This is how your data leaves with no name attached. Recipients are described by what they do rather than named, and you cannot send a request to a company you cannot name.
The move An access request can ask for recipients by name rather than by category, and UK and EU law put that choice with you.
“aggregated or de-identified information”
Taking your name off does not take away the pattern, and the pattern often still points at you. Policies give themselves free use of this data with no end date, on the basis that it is no longer about you.
The move If a deletion comes back as 'anonymised', keep the reply. It usually means de-identified, and it is their claim, not a fact you can check.
“retained as long as necessary, or as required by law”
They can keep it for legal duties, tax rules, fraud prevention, possible lawsuits and their own business reasons. None of those has a firm end date, so deletion turns into something you have to argue for.
The move Which reasons apply to you, and how long each runs, is a request of its own.
“you grant us a licence to use your content”
This is a contract term rather than a data setting, so a privacy request cannot undo it. A careful version ends when your account does. A broad one can be passed on, never expires and survives deletion.
The move Their terms say whether the licence ends when the account does. Close the account and log the date here.
“acting as the agent of the parent and consenting on the parent's behalf”
Data is taken from a child under 13 without anyone ever asking the parent. The school gives the consent, and in some policies the act of buying the product is the consent.
The move A request asks for everything held on the child and who authorised it.
“retention and deletion is at the direction of the school”
No limit set by the vendor on how long the record lives. If the school never says delete, it stays. A deletion request sent to the vendor turns into a referral back to the school.
The move A request establishes, in writing, where the deletion power actually sits, even if the answer is a referral.
“facial detection, not facial recognition”
During an exam the monitoring service tracks the face and eyes continuously, worded to stay clear of the laws that govern biometric data. Identity checks in the same market do admit to creating biometric face data, which policies say is deleted within two years.
The move A request names the exam recording held on the student and asks how long it is kept.
Their own policy is the one that binds them. Pin it down with a request, and keep the reply.