What Your Kid's School Chromebook Actually Reports

Five vendors, four federal-law words, and a parent portal that mostly shows the school, not you.

State of Surveillance

TL;DR: The school-issued Chromebook your child carries home is not their device. It is a managed endpoint running one of five dominant monitoring products, and each one has a privacy policy that says so in plain language. GoGuardian's product policy, last updated September 22, 2026, lists "browsing history, IP address, online content, email content, screenshots, and key percentage variance" among the student data it collects.[1] Securly's child-directed notice says it captures "the contents of emails, blog posts, and messages" and runs analysis to "identify potential signs of anxiety, depression, cyberbullying, self-harm, and potential violence."[2] Gaggle's student data privacy notice, last updated September 24, 2026, says it forwards certain incidents to the National Center for Missing and Exploited Children CyberTipline.[3] Under FERPA, 34 CFR 99.10, parents have the right to inspect and review education records, and the school must respond "within a reasonable period of time, but not more than 45 days."[4] Whether browser screenshots, AI-driven wellness alerts, and 24/7 keyword scans count as "education records" is the part the law has not caught up with.

The Five Names Districts Actually Buy

Most US K-12 districts standardize on one of five student-monitoring products. The vendors and their most recent public policy dates are: GoGuardian (product privacy policy, September 22, 2026), Gaggle (student data privacy notice, September 24, 2026), Bark (privacy policy, March 15, 2026), Securly (children's online privacy notice, no date on the page), and Lightspeed Systems (privacy policy, effective August 1, 2026).[1][3][5][2][6] The four words on every one of those policies are FERPA, COPPA, school official, and in loco parentis. The school, not the parent, is the customer; the school, not the parent, owns the data flow.

That customer relationship is the single most important fact about school Chromebook monitoring. When a 13-year-old signs into the managed Chrome profile, the legal basis for the data collection is the school's consent, given "as agent for Students' parents" under COPPA, in Securly's exact phrase.[2] GoGuardian puts it the same way: the company "only collects Personal Student Information where Schools have provided consent required by Applicable Law, including the Children's Online Privacy Protection Act ('COPPA')."[1] Lightspeed's policy says the school is the data controller and the vendor is the data processor.[6] The parent is the person whose child's data is being collected, and the parent is not the customer.

This is the structural reason the questions parents ask ("can I see what is being collected?" "can I turn it off?" "can I delete the history?") are answered with "ask the school" by every one of these policies. The vendors route the request through the district, not to the parent. Bark, in the most parent-friendly framing of the five, says "Parents may review the child's personal information, revoke consent, request deletion, and request a copy of the child's data."[5] The catch is that the access flow runs through "the appropriate School Official" or Bark's support team, not directly to the vendor. The federal right that parents do have is FERPA. It is real, and it is narrow.

What GoGuardian Takes, in GoGuardian's Own Words

GoGuardian (parent company Liminex, which also owns Pear Deck) has the most explicit product data list of the five. The product privacy policy states that, for students, it collects "Student's name, email address, Google Profile ID and Google Image URL," "Microsoft Profile ID," and "browsing history, IP address, online content, email content, screenshots, and key percentage variance (but not the actual inputs or sequence of inputs)," plus "Grade, Attendance, and Assignment Information" and "geographic location of devices."[1]

"Screenshots" is the word that catches parents. GoGuardian's product policy also notes that "video conferencing recordings (including audio and video of participating Students and chats from within a video conference)" are part of the service.[1] The retention numbers are short and specific: video recordings are stored for "ninety (90) days," and "no more than sixty (60) days" for non-alert emails.[1] Deactivated accounts are kept for "365 days after all of a School's licenses expire without use."[1]

On parent access, GoGuardian's policy says "parents/guardians/eligible students must contact the appropriate School Official of his/her or his/her child's School," and the company "will cooperate with the School to fulfill requests."[1] There is no parent-side portal. There is no parent-side delete button. The company also says it "do[es] not share Personal Student Information with third-party service providers for training of their artificial intelligence models" and "do[es] not sell" the data, which is a check on the AI training pipeline that other vendors have not been as explicit about.[1]

What Gaggle Takes, and Who It Calls

Gaggle, owned by PowerSchool, is the vendor that publishes the most about the downstream consumer of an alert. The student data privacy notice, last updated September 24, 2026, lists what it considers required versus optional: "the student email is the only required data point for Gaggle Services." Optional fields include "Student first and last name, Student Physical Address, Student ID, Parent/Guardian First and last name, Parent/Guardian Physical address, Parent/Guardian Phone/Mobile Number, Parent/Guardian Email Address."[3] Most districts that buy Gaggle turn all the optional fields on. Many do not tell parents that.

The notice also names the services a district can buy, with descriptive subtitles in the original: device content monitoring (Safety Management), online content monitoring (Web Activity Monitoring), smart content filtering (Web Filter), data storage (Archive), Coaching and Therapy, 24/7 crisis counselors (ReachOut), and a tipline (SpeakUp).[3] Coaching and Therapy is the one that collects clinical-style records: "assessments, symptoms, treatment-related information, clinical documentation, and other records created or maintained by licensed mental health professionals."[3]

On third-party disclosure, Gaggle says "Gaggle will not distribute to third parties any staff data or student data without the consent of either a parent/guardian or a qualified educational institution."[3] There is a specific exception: "incidents containing explicit videos and images of possible minors" are reported to "the CyberTipline at the National Center for Missing and Exploited Children (NCMEC)."[3] That mandatory-reporting exception is the part of the pipeline that is invisible to most parents. If a student's Google Drive document triggers a Gaggle alert with image content, that document may end up at NCMEC without the parent ever being told.[3] Gaggle also says it "do[es] not collect biometric data," a notable line because some competitors do.[3] Retention is "up to 30 days" for general customer data, with longer retention "where state laws require a specific shorter or longer duration."[3]

What Securly Reads, and What It Tries to Predict

Securly's children's online privacy notice is the most parent-readable of the five. It says, in plain language, that Securly collects "web browsing activity (for example, websites and videos viewed or blocked, time spent on a website, links clicked, web searches, AI chat questions); social media usage, including social media posts and messaging activity; the contents of emails, blog posts, and messages; and online interactions with teachers including student/teacher chats, virtual raised hands, and teachers' response to distracted behavior such as closing a tab on a Student's device."[2]

It is the only one of the five that explicitly states what the AI does with that pile. Securly says: "Based on a Student's online activities, Securly may identify potential signs of anxiety, depression, cyberbullying, self-harm, and potential violence."[2] The notice also draws a specific line on audio: "Calls are not monitored, recorded, or stored by Securly."[2] The retention period is not stated on the children's privacy page.

On parent access, Securly says "Schools, Educators, and Parents are able to log in to view information about their Students' use of certain Services."[2] The vendor's "parents" link points to a parent portal at securly.com/parents/login where parents can see what the system flagged, but the underlying data is the school's to export. Securly also says it may report alerts to "relevant state or local authorities in these states" for "child abuse or neglect or the presence of child sexual abuse material."[2]

What Bark and Lightspeed Cover

Bark's privacy policy, last updated March 15, 2026, applies to both the consumer product and Bark for Schools, but treats the school customer as the data controller. The children's data section describes the scope: "text messages, email content, chat content, social media content, and other child-generated content within the Accounts."[5] The retention default is short: "We generally retain your User Data on an identifiable basis for 30 days, after which it is deleted," with a longer retention on report-related portions.[5] The 15-day account-deletion turnaround is unusually fast for the sector.[5]

Lightspeed Systems' privacy policy, effective August 1, 2026, is the one that names what it does not do, which is sometimes as useful as what it does. It says it collects "student name, email address, device information/identifiers and usage data" and monitors "search queries, websites visited or blocked…recorded web activity, and device geolocation."[6] It does not name screenshots, email content interception, or file scanning, and it explicitly tells parents to "contact their educational institution" for access requests.[6] Lightspeed is also the only one of the five that says it is "certified to U.S. Department of Commerce" under the EU-U.S. Data Privacy Framework and uses EDPO as its EU GDPR representative.[6]

FERPA's Promise, and the Gap in It

FERPA, 34 CFR Part 99, is the federal law that gives parents the right to "inspect and review" their child's education records.[4] The implementing regulation at 34 CFR 99.10 says the school "must be given the opportunity to inspect and review the student's education records," and that the school "shall comply with a request for access to records within a reasonable period of time, but not more than 45 days after it has received the request."[4] The regulation also says the school "shall not destroy any education records if there is an outstanding request to inspect and review the records."[4]

That is the part of FERPA that is sharp. The part that is blunt is the definition. "Education records" are "those records that are: (1) Directly related to a student; and (2) Maintained by an educational agency or institution or by a party acting for the agency or institution."[4] A screenshot taken on a managed Chrome profile, with the student's name and a content hash, is plausibly an education record. An AI-derived "potential sign of self-harm" alert, generated by Securly's model from the student's browsing and chat, is more ambiguous: is the alert itself a record, or is the alert the vendor's analysis output, which the school did not "maintain"?[2][4] FERPA does not answer that, and the Department of Education's Student Privacy Policy Office has not issued a public opinion that does, either.

COPPA, the second federal frame, is narrower. COPPA applies to children under 13 and lets the school give consent on the parent's behalf "in loco parentis."[2][1] For students 13 and up, COPPA does not require parental consent at all; the school's FERPA process is the only federal floor. There is no federal regulation that gives a parent the right to turn off school monitoring, opt out of a specific vendor, or delete browsing history collected by a third-party processor.

Where State Law Actually Helps

California's SOPIPA, the Student Online Personal Information Protection Act, prohibits targeted advertising to students and the sale of K-12 student data, with limited exceptions. GoGuardian's product policy explicitly cites SOPIPA, alongside California's AB-1584 and Education Code 49073.1, as part of its compliance posture.[1] Connecticut's "Act Concerning Student Privacy" (Conn. Gen. Stat. § 10-234aa et seq.) is named the same way in the GoGuardian policy.[1] The two states are the clearest; the other 48 vary widely and many have no K-12 monitoring-specific statute.

What state law generally does NOT do is give parents a switch. The switch is a district policy choice, and most districts publish an acceptable-use policy that parents sign at the start of the year. The signed form is the legal basis the vendor relies on. Reading that form is worth the time, because the list of monitoring tools, the retention window, and the parental-notification policy for wellness alerts are usually buried in the middle.

What Parents Can Do This Month

FERPA gives parents a real right, but only on paper. The practical sequence:

Step 1: Read the acceptable-use policy and ask which vendor is running. The district's acceptable-use policy is the document that names the monitoring product. If it does not name a vendor, ask the school office. GoGuardian, Gaggle, Bark, Securly, and Lightspeed are the five most common; if your district runs a different one, the privacy policy URL pattern is similar.[1][3][5][2][6]

Step 2: File a written FERPA request for your child's education records. 34 CFR 99.10 says the school must respond "within a reasonable period of time, but not more than 45 days."[4] Ask for every education record that includes your child, including any alert history, screenshot history, and email content scan history. The vendor does not have to give you the data; the school does. Put the request in writing and keep the timestamp.

Step 3: Ask for the parent portal login. Securly and Bark both advertise parent-side portals; Gaggle, GoGuardian, and Lightspeed route access through the school.[2][5] If your district uses one of the portal-equipped vendors, the parent login is the only place where you can see what is being flagged in near real time.

Step 4: Ask the district about off-network filtering. Some districts only run the monitoring when the Chromebook is on the school network. If the filter and the monitoring only run on-campus, an unsynced personal device or a school-issued device used off Wi-Fi may not be monitored at all. Knowing the off-network policy tells you how much of your child's evening browsing is actually in the vendor's database.

Step 5: Read the wellness-alert language. If your district uses Securly, Gaggle, or Lightspeed, the wellness-alert path can route content to the school counselor, to law enforcement, or to NCMEC's CyberTipline without prior parental notice.[3][2] The acceptable-use policy is the place where most districts say which path they take. If the policy is silent, ask.

Step 6: At age 18, your child gets the rights. FERPA shifts the right to "eligible students" at 18, or earlier if the student attends a postsecondary institution.[4] Before senior year, ask the district how records are handled on the transition. Most districts purge alerts, but the retention is vendor-specific and not always 30 days.

The Bottom Line

The school-issued Chromebook is a managed device with a vendor on the other end. The five dominant monitoring products all collect browsing, search, and identity data; some collect screenshots, email content, AI-driven wellness assessments, and clinical-style records. The federal floor (FERPA + COPPA) gives parents a right to inspect, on a 45-day timeline, and COPPA's under-13 consent is delegated to the school. There is no federal right to turn monitoring off, no federal right to delete vendor-side history, and no federal right to opt out of a specific vendor. The practical lever is the district.

  1. GoGuardian's product privacy policy, last updated September 22, 2026, lists "browsing history, IP address, online content, email content, screenshots, and key percentage variance" as student data the vendor collects, and stores video recordings for "ninety (90) days."[1]
  2. Securly's children's online privacy notice says the vendor collects "the contents of emails, blog posts, and messages" and runs AI to "identify potential signs of anxiety, depression, cyberbullying, self-harm, and potential violence."[2]
  3. Gaggle's student data privacy notice, last updated September 24, 2026, names the optional data fields most districts turn on, lists the eight services districts can buy, and states that explicit image content is forwarded to the NCMEC CyberTipline.[3]
  4. Bark's privacy policy, last updated March 15, 2026, treats the school as the data controller, gives parents a 15-day account-deletion turnaround, and says user data is "generally retained…for 30 days."[5]
  5. Lightspeed Systems' privacy policy, effective August 1, 2026, does not name screenshots, email content interception, or file scanning, and tells parents to "contact their educational institution" for access requests.[6]
  6. Under 34 CFR 99.10, parents have the right to inspect and review education records, the school must respond "within a reasonable period of time, but not more than 45 days," and the school "shall not destroy any education records if there is an outstanding request to inspect and review the records."[4]

Sources

  1. GoGuardian (Liminex, Inc.): Product Privacy Policy, last updated September 22, 2026. https://www.goguardian.com/policies/product-privacy
  2. Securly, Inc.: Children's Online Privacy (COPPA Direct Notice). https://www.securly.com/childrens-online-privacy
  3. Gaggle.net, Inc. (PowerSchool): Student Data Privacy Notice, last updated September 24, 2026. https://www.gaggle.net/student-data-privacy-notice/
  4. U.S. Department of Education, Protecting Student Privacy: Family Educational Rights and Privacy Act (FERPA), 34 CFR Part 99, including 99.3 (definition of education records) and 99.10 (right to inspect and review). https://studentprivacy.ed.gov/ferpa
  5. Bark Technologies, Inc.: Privacy Policy, last updated March 15, 2026. https://www.bark.us/privacy
  6. Lightspeed Systems, LLC: Privacy Policy, effective August 1, 2026. https://www.lightspeedsystems.com/privacy-policy/

Published: October 13, 2026