PowerSchool Naviance Data Harvesting Lawsuit Settles for $17.25 Million In early April, students worldwide received notifications about a settlement in a lawsuit against PowerSchool, the provider of Naviance, a widely used college and career readiness platform. The lawsuit alleged that between August 18, 2021, and January 23, 2026, Naviance embedded Heap, a third-party tracking tool, which collected sensitive student data including keystrokes, clicks, mouse movements, and private messages to counselors without consent. The harvested data was reportedly sent to Google, Microsoft, and Hotjar, violating state and federal privacy laws, including the Electronic Communications Privacy Act and the California Invasion of Privacy Act. Filed in August 2023 by an unnamed Chicago student, the lawsuit accused Naviance of unauthorized digital surveillance. PowerSchool denied the allegations but reached a $17.25 million settlement in February 2026, with payments to affected students. As part of the agreement, Heap, Google, Microsoft, and Hotjar agreed to delete all stored student data. Final approval is pending at a hearing on August 19, 2026. This incident is not PowerSchool’s first privacy controversy. In December 2024, a hacker exploited a stolen password to breach PowerSchool’s systems, stealing data from millions of students and educators. Though a $2.85 million ransom was paid, the same data was later used in further extortion attempts. The case reflects a broader trend of EdTech privacy failures, as digital learning tools in K-12 schools have nearly doubled in usage since 2020. Recent breaches, including a ShinyHunters attack on Canvas in April and May 2026, disrupted global education systems, forcing Instructure to pay an undisclosed ransom to prevent data leaks. Eligible students have until July 27, 2026, to file a claim under the settlement.