A federal lawsuit involving California families alleges that i-Ready collects and shares sensitive student information without adequate parental consent. Curriculum Associates denies the allegations, creating a major educational-law debate over privacy, school authority, screen time, and edtech accountability.
Editorial Note
This article discusses an active lawsuit involving children’s personal information, education technology, parental consent, and school-district contracts. It is intended for educational and informational purposes and does not provide legal advice.
The allegations described in the lawsuit have not been proven in court. Curriculum Associates denies that it sells student information, uses student data for advertising, or creates commercial profiles of children. New To Education does not endorse the plaintiffs, Curriculum Associates, i-Ready, any school district, or any legal position discussed in this article.
A federal lawsuit involving California families is raising difficult questions about how much personal information education-technology companies should be allowed to collect from children.
The case concerns i-Ready, a widely used digital assessment and instructional platform created by Curriculum Associates.
Schools use i-Ready to test students in reading and mathematics, measure academic progress, recommend lessons, and provide teachers with reports about student performance.
To perform those functions, the platform processes information that may include students’ names, dates of birth, grade levels, assessment responses, lesson results, demographic information, disability status, English-learner classification, eligibility for subsidized meals, device information, and patterns of platform use.
The plaintiffs argue that families were not given adequate notice or meaningful consent before that information was collected and processed.
Curriculum Associates strongly disputes those claims. The company says schools and districts control the data, authorize its collection for educational purposes, and may provide legally valid consent on behalf of parents.
The disagreement could influence how courts interpret the relationship among families, schools, and private technology providers.
It may also force districts to reconsider whether permission to use school technology is broad enough to cover the detailed information collected by modern adaptive-learning platforms.
What the Lawsuit Alleges
The proposed class-action lawsuit, M.C. v. Curriculum Associates, was filed in federal court on December 22, 2025.
The plaintiffs are students represented by their parents. They allege that Curriculum Associates generated, collected, used, and shared information about children without proper consent.
Their claims include alleged violations of the federal Wiretap Act and the California Invasion of Privacy Act.
According to the complaint and subsequent reporting, the plaintiffs contend that i-Ready records detailed information about how students interact with the platform and transmits some information to third-party service providers.
The families argue that schools did not clearly explain the extent of those practices before students were required or encouraged to use the program.
They also challenge the idea that a general school technology agreement automatically constitutes meaningful permission for every category of information an education company may collect.
The lawsuit seeks class-action status, potentially allowing claims to be pursued on behalf of a much larger group of students who have used i-Ready.
No court has determined that Curriculum Associates violated the law.
Curriculum Associates Denies Selling Student Data
Curriculum Associates states that the lawsuit is legally meritless.
The company says it does not sell student data, use the information for advertising, or create commercial profiles of children.
It argues that i-Ready collects only the information needed to provide services requested by schools and districts.
According to the company, school districts own and control student information. Curriculum Associates describes itself as a service provider operating under the district’s authority.
The company also says third-party providers may process information only to support functions such as hosting, security, authentication, analytics, research, and platform operations.
Those providers are subject to confidentiality requirements and are prohibited from independently using student data for advertising, marketing, or profiling, according to the company’s privacy policy.
The legal dispute may therefore depend partly on what it means to “share” information.
Sending data to a contractor that stores or analyzes it is technically a disclosure to another organization. However, that does not necessarily mean the information has been sold or used for unrelated commercial advertising.
The plaintiffs and the company disagree over whether the actual practices are adequately disclosed, properly authorized, and legally permitted.
What Information Does i-Ready Collect?
Curriculum Associates’ privacy policy provides a detailed description of the information that may be processed through i-Ready.
Basic account information can include a student’s name, date of birth, gender, username, identification number, school, district, class enrollment, and grade level.
Schools may also choose to provide demographic or program information.
That information may include race or ethnicity, eligibility for free or reduced-price meals, disability or special-education status, English-learner classification, gifted eligibility, foster-youth status, homelessness, migrant status, and whether the student is part of a military family.
When students use i-Ready, the system can collect their responses to questions, assessment results, lesson performance, progress, login history, time spent using features, and technical information about the browser or device.
This information allows the system to evaluate student performance and adapt instructional content.
It also creates a detailed digital record of a child’s academic development.
That record may reveal more than whether the student answered a math problem correctly.
When combined, the information could indicate learning difficulties, disability status, family income indicators, language background, academic strengths, weaknesses, and patterns of behavior.
The sensitivity of that information is one reason the lawsuit has attracted attention.
Can Schools Consent on Behalf of Parents?
One of the most important legal questions is whether a school can provide valid consent for an education-technology platform to collect children’s information.
Under the federal Children’s Online Privacy Protection Act, commonly known as COPPA, companies generally must obtain consent before collecting personal information online from children under 13.
In certain educational settings, schools may provide consent on behalf of parents when the information is collected for a legitimate educational purpose rather than a separate commercial purpose.
Curriculum Associates relies on this school-consent model.
Its privacy policy states that school customers may provide consent by entering into an agreement to use i-Ready for educational purposes.
The plaintiffs argue that the consent obtained through schools was not sufficient for the full range of information and data-processing practices involved.
The case may require the court to examine whether the information was collected strictly to provide education services or whether any of it was used in ways that required more direct parental authorization.
The distinction is extremely important for the education-technology industry.
Schools would face major administrative challenges if every digital platform required a separate individual consent form from every parent.
However, allowing districts to consent broadly without providing detailed notice could leave parents unaware of how much information private companies receive about their children.
FERPA Does Not Automatically Resolve the Debate
The Family Educational Rights and Privacy Act, or FERPA, protects the confidentiality of education records maintained by schools receiving federal funds.
FERPA generally permits schools to share information with certain contractors classified as school officials when they perform legitimate educational functions and remain under the school’s direct control.
Curriculum Associates states that it operates as a school official under FERPA.
The company says districts remain the owners of student information and determine how it is used, corrected, shared, or deleted.
However, FERPA is not the only law involved.
A company could potentially satisfy one education-record requirement while still facing claims under wiretapping, consumer-privacy, contract, or child-protection laws.
FERPA also does not necessarily provide families with a simple private lawsuit against every alleged violation.
The i-Ready case therefore illustrates how student privacy is governed by overlapping laws that were written at different times and for different types of technology.
FERPA was enacted long before adaptive online assessments could record each answer, click, login, and second spent on a lesson.
Courts and lawmakers must now determine how older privacy principles apply to modern digital classrooms.
Why Parents Say General Technology Permission Is Not Enough
Many schools ask families to sign acceptable-use agreements allowing students to use computers, internet services, learning applications, and district accounts.
Those agreements may be several pages long and cover dozens of platforms.
Parents may have little ability to negotiate the terms.
Refusing consent could also make it difficult for a child to participate in required lessons, assessments, homework, or classroom activities.
The plaintiffs’ concerns raise a broader question about whether this type of permission is truly voluntary.
A parent may technically agree to school technology use without understanding that a particular platform processes information about disability status, socioeconomic indicators, question responses, and behavioral patterns.
Consent is meaningful only when the person understands what is being authorized.
Districts may therefore need to provide clearer platform-specific notices rather than relying only on a general technology form completed at the beginning of the school year.
Those notices could explain what information is collected, why it is needed, which companies receive it, how long it is retained, and how parents can request access or deletion.
The Case Goes Beyond Privacy
Although the lawsuit focuses on information practices, it has also renewed debate about whether schools rely too heavily on digital platforms.
i-Ready can be used for diagnostic assessments several times each year. Some schools also assign personalized reading or mathematics lessons on a weekly basis.
Supporters say the platform helps teachers identify students who need additional support and provides instruction tailored to individual skill levels.
Critics question whether computer-generated lessons provide enough educational value to justify the time, cost, and information collection involved.
Some educators argue that students, particularly those receiving special-education services, may struggle with standardized digital assessments that do not adequately reflect their knowledge.
Others are concerned that screen-based instruction may replace interaction with teachers rather than supporting it.
These instructional questions are legally separate from the privacy allegations.
A program can be educationally useful and still face legitimate privacy concerns. It can also comply with privacy law while providing limited educational benefit.
Districts should evaluate both issues instead of assuming that legal compliance proves educational effectiveness.
Los Angeles Unified’s Contract Has Increased Scrutiny
The Los Angeles Unified School District has used i-Ready under a contract reportedly valued at approximately $20 million.
The size of that agreement has increased public interest in the lawsuit because LAUSD is one of the largest school systems in the United States.
The district has defended i-Ready as a diagnostic tool that can help educators understand student performance and personalize instruction.
At the same time, LAUSD has been reviewing its broader use of digital learning tools and student screen time.
The district’s situation illustrates how closely educational, financial, and privacy decisions are connected.
A large contract can make a platform difficult to replace quickly. Teachers may receive training, student accounts may be integrated into district systems, and assessment data may be used in school planning.
Before entering a major agreement, districts should determine whether the platform is effective, accessible, secure, legally compliant, and necessary.
They should also consider what happens to student information when the contract ends.
Schools Cannot Outsource Their Responsibility
School districts may purchase technology from private companies, but they cannot outsource their responsibility to protect students.
District leaders should know what information each platform collects and how that information moves between systems.
They should review contracts for data-retention limits, deletion requirements, breach notification, third-party access, research use, security standards, and prohibitions on advertising.
Schools should also understand whether information is being de-identified and how strong those de-identification methods are.
Removing a student’s name does not always make a dataset anonymous.
A combination of school, grade level, disability category, demographic characteristics, and assessment information may still make a student identifiable, particularly in a small class or community.
Districts need staff members with enough legal and technical knowledge to evaluate these risks.
Teachers should not be expected to perform that work by reading lengthy terms of service while managing a classroom.
Parents Need Practical Access to Their Children’s Data
Curriculum Associates says parents may request information about the categories of data collected, ask for deletion, or request that the company stop collecting information.
Because the company operates under the school’s authority, parents are generally instructed to submit those requests through their child’s school.
That process may be legally appropriate, but it must also be understandable and accessible.
Parents may not know which district office to contact. School employees may not know how to process the request. Families may receive incomplete records if data is spread across multiple platforms.
Schools should publish a clear process explaining how families can inspect, correct, download, or delete student information.
They should also explain the consequences.
If certain information is required for the platform to function, deleting it may mean the student can no longer use the service.
Families should then be told whether an equivalent offline or alternative learning option is available.
A privacy right is less meaningful when exercising it prevents a child from participating fully in school.
Student Data Can Follow Children for Years
Academic information can remain valuable long after a particular lesson or assessment ends.
Longitudinal data can help schools identify patterns and provide support. It can also create risks when information is retained indefinitely or transferred between systems.
A student’s early assessment results should not become a permanent label that limits future opportunities.
Children develop at different rates. A student who struggles with reading in elementary school may become highly successful later.
Digital systems should not treat early performance as an unchangeable prediction.
Districts should establish retention periods based on educational necessity rather than keeping information simply because storage is inexpensive.
They should also examine whether automated recommendations reinforce previous classifications.
The more information a platform collects, the greater its responsibility to ensure that the data is accurate, secure, limited, and used fairly.
The Lawsuit Could Affect the Entire Edtech Industry
If the plaintiffs succeed, education-technology companies may be required to provide more direct notice to parents and obtain different forms of consent.
School contracts could become more detailed, and districts might face greater responsibility for explaining platform practices.
Companies could also limit the information they collect or redesign their systems to reduce reliance on identifiable student data.
If Curriculum Associates prevails, the ruling may strengthen the argument that school authorization is sufficient when data is processed for an educational purpose under district control.
Either result could influence other companies that provide assessments, learning-management systems, tutoring software, behavior-monitoring tools, artificial intelligence platforms, or classroom applications.
The case is therefore about more than i-Ready.
It asks who controls the digital record created when a child learns through software.
What School Districts Should Review Now
Districts do not need to wait for the lawsuit to end before improving their practices.
They can create a public inventory of approved education-technology platforms and explain the purpose of each one.
They can identify the information collected, the legal basis for collection, the length of retention, and the process for parental requests.
Districts can also determine whether platforms collect more information than necessary.
A reading application may need a student’s grade level and assessment responses. It may not need every demographic or program classification available in the district’s information system.
This principle is known as data minimization.
Schools should transmit only the information needed for a clearly defined educational purpose.
They should also evaluate whether the educational benefit is strong enough to justify the financial cost, screen time, and privacy risks.
Teachers Should Be Included in Technology Decisions
Teachers often understand how platforms function in practice better than central-office administrators do.
They see whether students engage meaningfully, click through answers, experience frustration, receive inappropriate lesson recommendations, or need significant adult assistance.
Teachers can also identify whether the platform saves instructional time or creates additional work.
District technology decisions should therefore include classroom educators, special-education professionals, families, cybersecurity staff, and students when appropriate.
A procurement process based only on sales demonstrations and administrative reports may overlook major implementation problems.
Privacy and educational quality should be evaluated together.
The safest platform is not necessarily useful, and the most engaging platform is not necessarily safe.
Schools need both.
Key Takeaways
The federal case M.C. v. Curriculum Associates was filed on December 22, 2025, and remained an active educational-law dispute as of July 15, 2026.
The plaintiffs allege that i-Ready collected, used, and shared children’s information without adequate parental consent.
Their claims include alleged violations of the federal Wiretap Act and the California Invasion of Privacy Act.
Curriculum Associates denies the allegations and says it does not sell student data, use it for advertising, or build commercial profiles of children.
The company says school districts own and control the information and authorize its collection for legitimate educational purposes.
i-Ready may process account information, demographic classifications, disability status, assessment answers, lesson performance, usage information, and technical device data.
The case could help determine when schools may consent to data collection on behalf of parents and how clearly families must be informed.
The dispute also raises wider questions about screen time, edtech effectiveness, district contracts, accessibility, and the responsibility of public schools to oversee private vendors.
FAQ
What is i-Ready?
i-Ready is an online assessment and instructional platform used by schools to measure reading and mathematics performance, monitor student progress, and provide personalized lessons.
When was the lawsuit filed?
The proposed class-action lawsuit was filed in federal court on December 22, 2025.
Was the lawsuit filed on July 15, 2026?
No. The case remained active and under public debate as of July 15, but it was filed earlier.
What information does i-Ready collect?
Depending on what the school provides and which services are used, the platform may process names, dates of birth, grade levels, student identification numbers, demographic information, disability status, assessment responses, lesson results, usage patterns, and technical device information.
Does Curriculum Associates sell student information?
The company says it does not sell student data, use it for advertising, or create commercial profiles of students. The plaintiffs dispute aspects of the company’s data practices, and the court has not issued a final ruling on the allegations.
Can schools consent on behalf of parents?
Schools may provide consent in certain circumstances when information is collected for a legitimate educational purpose. The lawsuit challenges whether the consent and notice involved in i-Ready’s practices were legally sufficient.
Can parents ask to see or delete i-Ready information?
Curriculum Associates says parents can request information or deletion through their child’s school. Removing information that is necessary for the platform may prevent the student from continuing to use it.
Is the case only about California students?
The named families are connected to California, but the plaintiffs are seeking broader class-action treatment that could potentially affect students in other states.
Has Curriculum Associates been found liable?
No. The claims remain allegations, and the company denies wrongdoing.
Final Thoughts
Schools increasingly depend on private platforms to test students, organize lessons, monitor progress, and make instructional decisions.
Those tools can provide useful information to teachers.
They can also create detailed records about children who may be too young to understand what is being collected or how it may be used.
The i-Ready lawsuit forces schools and families to confront an uncomfortable reality.
Students do not leave their privacy rights at the classroom door simply because the technology is described as educational.
At the same time, personalized learning systems cannot function without processing some information about student performance.
The challenge is not eliminating data entirely.
It is determining what information is truly necessary, who controls it, how clearly families are informed, and whether children are protected when participation is effectively required.
Curriculum Associates maintains that it follows the law and uses student information only to provide authorized educational services.
The plaintiffs argue that schools and companies have gone too far without obtaining meaningful parental consent.
The court will eventually decide the legal claims.
School districts should not wait for that decision to ask whether their own technology practices are transparent, limited, secure, and educationally justified.
When schools require children to use digital platforms, protecting their data is not an optional technical detail.
It is part of the duty to protect the student.
Related Articles
Japan’s 2026 Generative AI Pilot Schools Could Shape the Future of Classroom Learning
https://www.newtoed.com/view-blog/japans-2026-generative-ai-pilot-schools-could-shape-the-future-of-classroom-learning-6a4c66f6944fa
Cambridge’s July 7 AI in Education Deadline Shows How Top Universities Are Rethinking Learning
https://www.newtoed.com/view-blog/cambridges-july-7-ai-in-education-deadline-shows-how-top-universities-are-rethinking-learning-6a4da7a94d9ec
Sources
EdTech Law Center — M.C. v. Curriculum Associates Case Summary
Curriculum Associates — i-Ready Student Data Privacy: Our Commitment
Curriculum Associates — i-Ready Platform Privacy Policy
The Guardian — California Parents Sue i-Ready Maker Over Student Data Collection
Axios San Diego — Lawsuit Challenges i-Ready’s Student Data Practices
Federal Trade Commission — Children’s Online Privacy Protection Rule
U.S. Department of Education — Family Educational Rights and Privacy Act
