Learn21's Weekly EdTech Update

January 22, 2026

A Preview of Privacy Trends for 2026

By Mike Porter

The amazing folks at the Future of Privacy Forum offer their preview of the 2026 legislative season with a refreshingly honest admission–it’s impossible to make a prediction of what the new year will look like from a privacy policy perspective. While there are certainly some big trends afoot, there is no overarching piece of Federal legislation that ties it all together. Below is a summary of the trends identified. The full article details the five major trends, and leaves us with the unresolved question if states are going to lead the privacy charge, or will federal laws emerge to take policy precedent. 

Here are the five major questions the authors identify:

First, does the absence of new comprehensive state privacy laws in 2025 signal stability or foreshadow deeper fragmentation?

Although no new state comprehensive privacy laws were enacted in 2025—leaving the total at 19 or 20—this slowdown did not reflect reduced legislative activity. States amended existing laws, considered hundreds of privacy-related bills, and passed sector-specific legislation addressing AI, health data, and youth safety. Several states, including Alabama, Massachusetts, Vermont, and Pennsylvania, advanced comprehensive privacy bills that could resurface in 2026.

This pause could indicate that states have reached a saturation point, producing a stable map of “privacy law states” and “non-privacy law states.” Alternatively, it could mark an inflection point. A group of New England states—particularly Vermont, Maine, and Massachusetts—are considering far more stringent privacy frameworks. These proposals emphasize strong data minimization rules, restrictions on selling sensitive data, bans on targeted advertising to minors, and, in Vermont’s case, a private right of action. If enacted, these laws would push state privacy policy in a more restrictive direction and potentially fracture the increasingly dominant “Connecticut model” that has guided many states thus far.

Second, are age signals poised to become the dominant approach to youth online protections?

A persistent challenge in youth privacy legislation is determining how companies can identify minors without imposing invasive age verification. In 2025, lawmakers pivoted toward “age signals” frameworks, which shift responsibility for age determination upstream to app stores or operating system providers.

Two distinct models emerged. The App Store Accountability Act (ASAA), enacted in Utah, Texas, and Louisiana, requires app stores to verify user ages, obtain parental consent for minors, and transmit age signals to developers. This approach imposes substantial technical and legal obligations and has already prompted constitutional challenges, particularly in Texas. In contrast, California’s AB 1043 requires operating system providers to collect age information during device setup and share it with developers solely to facilitate compliance with existing laws like COPPA and the CCPA. This narrower model has garnered industry support and has not yet faced legal challenges.

Looking ahead, court decisions on ASAA—along with federal interest in nationalizing the framework—may shape whether states pursue aggressive age signaling mandates or gravitate toward California’s more limited, potentially durable approach.

Third, will 2026 continue to be the “year of the chatbots,” or will lawmakers shift strategies?

In 2025, AI chatbots became central to policy debates, especially following high-profile incidents involving “companion chatbots” allegedly encouraging self-harm among minors. States such as California and New York responded with disclosure-based laws requiring chatbot operators to clearly identify AI interactions and maintain safety protocols, particularly for youth. Notably, these laws avoided outright bans, favoring transparency over prohibition.

Momentum is continuing into 2026, with new chatbot bills pre-filed in several states. While most proposals still focus on youth safety and mental health, policymakers are also beginning to explore chatbot use in education, elder care, and employment. At the federal level, bipartisan proposals range from disclosure-focused measures to outright restrictions on minors’ access to companion chatbots. The central question is whether lawmakers will maintain disclosure-first approaches or move toward stricter use limitations, potentially reshaping or preempting state efforts.

Fourth, will health and location data remain at the center of sensitive data debates?

Health and location data dominated sensitive data discussions in 2025 and show no signs of fading. States proposed and enacted laws restricting the collection, use, and sale of health inferences, neural data, and precise location data. High-profile proposals like New York’s Health Information Privacy Act would significantly expand the scope of regulated health information and impose stringent consent and necessity standards. At the federal level, proposals such as HIPRA seek to modernize health privacy protections to cover emerging technologies like wearables and health apps.

Location data has also faced heightened scrutiny. States such as Oregon and Colorado amended their privacy laws to restrict or ban the sale of precise location data, while enforcement actions in Texas and at the FTC highlighted ongoing compliance risks. As definitions evolve and enforcement intensifies, organizations are increasingly urged to adopt robust data governance practices to navigate growing complexity.

Finally, will federal efforts to curb state AI regulation redefine the policy landscape?

A defining development in 2025 was the federal government’s renewed interest in limiting state AI laws. After failed legislative attempts, the administration issued an executive order aimed at constraining “excessive” state AI regulation through litigation pressure and funding restrictions. However, ambiguity over what qualifies as an “AI law” creates uncertainty, as many state measures embed AI provisions within broader privacy or consumer protection frameworks.

The executive order carves out areas such as child safety and state government AI use, but leaves significant room for interpretation. A critical question for 2026 is whether federal limits on state AI regulation will be paired with a substantive national framework—or whether states will be constrained without a federal baseline to replace their efforts. The resolution of this tension may ultimately shape not only AI governance, but the future architecture of U.S. privacy law itself.

In Loco Parentis, According to Google

by Mike Porter

Google found itself in the midst of quite the kerfuffle when viral posts spotlighted Google’s past practice of emailing minors on family accounts, as they were turning 13, to inform them that they could add more “features” to their accounts. This included removing parental oversight, without their parents' permission, as an “upgrade.” 

To be fair, after being outed, Google quickly pivoted on the policy, and at the time of this article, now only the parent on the family account can remove supervision. In other words, Google aligned the family account to work like a school account: adults determine the safety standard. 

Schools are required to monitor and filter students' access to the internet as a condition of receiving Federal ERate money. No school would ever email its students and ask them if they wanted to be filtered or monitored–it would put them out of alignment with the Children' s Internet Protection Act, and frankly, break trust with parents. 

Most educators recognize the phrase “In Loco Parentis”—the concept that when students are at school, educators act in place of the parents, or that educators will provide a high standard of care. Schools apply filters and monitoring to students because that is what parents expect of us and it is our ethical and moral responsibility to students.

Just as each family has their thresholds of what is a permissible level of access to the Internet, school districts calibrate their students’ online experience based on local values. And in both cases, conversation, shared learning, clear expectations and ongoing adjustments led by adults are the norm. Interestly, when asked, Google’s Gemini3 AI agreed that a “gradual release” was probably the best approach to children's access to the Internet. 

In short, it seems as if Google has learned to think like a K-12 technology leader.

Making Privacy Stick: Culture, Not Just Compliance

By Carly Ghantous

Student data privacy doesn’t usually unravel because someone ignored a policy. More often, it slips in the small moments—when an email is sent too quickly, when a new tool looks promising, or when everyone assumes someone else has already thought it through.

Most privacy missteps don’t happen because someone doesn’t care. They happen because school days are busy, decisions are fast, and sharing feels like the easiest path forward. That’s exactly why culture matters so much in student data privacy work. Policies set expectations, but culture shapes what people do when no one is watching.

There’s no single switch that turns on a culture of student data privacy. It’s built gradually, through small decisions made by many people, every day. When we step back and name those decisions a clear (and alphabetical) pattern starts to emerge.

A — Ask Before You Share

A strong privacy culture starts with a pause.

Before sharing student information, photos, or access to a tool, educators in privacy-aware schools feel comfortable asking a simple question: “Is this the right way to share this?” Sometimes that question is asked out loud. Sometimes it’s internal. Either way, it matters.

When leaders model this behavior by asking questions themselves, it sends a clear message: slowing down to protect students is valued, not inconvenient.

B — Build Privacy Checkpoints into Lessons

Privacy doesn’t need a standalone lesson to be meaningful.

It shows up when a teacher explains why a platform needs student accounts, or when a class talks about what information belongs in a shared document. These brief check-ins don’t derail instruction; they deepen it.

Over time, students start to understand that privacy is part of learning how to navigate the digital world, not just a rule imposed by adults.

C — Create Visual Cues

Even the most thoughtful educators have busy days.

That’s where visual cues help. A reminder near a shared device. A symbol on slides that signals student data. A short checklist embedded in lesson planning. These cues aren’t about catching mistakes; they’re about supporting good intentions when attention is stretched thin.

The best reminders feel like a quiet nudge from a colleague, not a warning sign.

D — Demystify the “Why”

Rules without context rarely stick.

When schools explain why certain privacy practices exist—protecting students from harm, honoring family trust, or reducing long-term risk—something shifts. People stop seeing privacy as red tape and start seeing it as part of their role in caring for students.

Understanding the “why” builds confidence, not resistance.

E — Empower Student Helpers

Students notice more than we think.

In many schools, students are already helping one another navigate tools and settings. Some communities choose to formalize that role, inviting students to serve as helpers, ambassadors, or advisors. These students might help peers adjust settings, flag oversharing, or provide feedback on tools from a student perspective.

It’s a subtle but powerful shift: students aren’t just data subjects. They’re active participants in protecting their digital lives.

F — Feature a “Tool Talk Tuesday”

Culture grows through conversation, not one-time training.

Some schools make space for short, regular discussions about the tools being used in classrooms. A quick spotlight—what the tool does, what data it uses, and what to be mindful of—keeps privacy visible without making it heavy.

These moments build shared awareness and reinforce the idea that privacy is everyone’s responsibility, not just the job of one person or department.

Culture Is Built in the Everyday

Building a culture around student data privacy isn’t about perfection. It’s about patterns.

It’s the pause before sharing. The explanation instead of the mandate. The reminder that shows up at the right moment. The student who speaks up. The colleague who asks a thoughtful question.

When those small actions become routine, privacy stops feeling like an extra task and starts feeling like part of who a school community is. That’s where student data privacy truly takes root.

Big Ideas

So That’s How They Make Their Money! 

In what is likely a sign of things to come, Disney and OpenAI strike a deal that licenses Disney characters (Mickey! Buzz Lightyear! Yoda!) to Open AI’s video creation tool, Sora. The deal, worth 1 billion, makes Disney an equity partner and is the first of its kind. This deal breaks new space in the often uneasy relationship between content creators and generative AI. This might be a great current events conversation in your high school classrooms. More here from CNN. 

How long does it take to poach an egg?

It turns out that the weight of mega, mirrored data centers, fiber optics, and incredible energy consumption is being used to address the world’s pressing issues, such as “how long does it take to poach an egg?” According to data giant Amazon, questions around celebrities, (T-Swift was up there) and people’s net worth dominated the queries to Alexa across the globe. A deeper dive, here. Or just ask Alexa. 

And according to Copilot…

As a nice companion article, Microsoft shares what its customers use Copilot for, and in what context. They note that at the workplace, on a desktop computer, work related and technical questions were dominant. Interestingly, on a mobile device, all hours of the day, health questions were most prevalent. The article notes that school accounts and enterprise accounts were excluded from the analysis of the de-identified data. Taking the two articles together, one can draw the conclusion that the device in which one accesses genAI is reflective of what their use of AI is.

www.learn21.org