Court Advances PowerSchool Class Action Lawsuit
A federal ruling determines that ed-tech firms may be subject to medical privacy laws for student data breaches.
Updated on Oct. 27, 2026 in Cybersecurity
Live Poll
Should companies be held strictly liable for the security of student and teacher data?
A federal court in the Southern District of California has denied PowerSchool’s motion to dismiss a key claim in a class action lawsuit regarding a 2024 data breach. The court ruled that the software provider may be classified as a health care entity under California law, potentially holding it liable for the exposure of data belonging to 50 million students and teachers.
Why it matters
This ruling expands the potential legal liability for educational software providers by testing whether data management services constitute health care provision. The decision underscores the growing intersection of K-12 data privacy and state medical confidentiality regulations.
The court assessed whether PowerSchool qualifies as a health care provider under the California Confidentiality of Medical Information Act. This classification creates a potential legal precedent for how educational software providers must handle sensitive student health records versus standard academic data.
The players
PowerSchool
A provider of software and data-management services to school districts nationwide.
US District Court for the Southern District of California
The federal judicial body overseeing the multi-district proposed class action.
The details
The court evaluated the company’s status based on the California Confidentiality of Medical Information Act, a law governing the protection of medical records. Plaintiffs argued that because PowerSchool provides software and data-management services that touch on student health information, the firm maintains an obligation comparable to medical facilities. The denial of the motion to dismiss ensures that this legal interpretation will be scrutinized further during the multi-district litigation process.
Timeline
2024: A data breach involving student and teacher information occurred.
October 27, 2026: The US District Court for the Southern District of California issued the ruling.
The Tech Race
This case tests the limits of the California Confidentiality of Medical Information Act when applied to modern ed-tech platforms. It establishes a high-stakes legal benchmark for how data-management services are categorized under existing privacy laws.
Families and educators whose information was exposed in the 2024 breach now have a clearer path for their class action claims to proceed in federal court. The outcome of this litigation will likely influence future security protocols and legal requirements for software providers handling sensitive K-12 student data.
The takeaway
The court’s decision establishes that ed-tech companies may face medical-grade privacy litigation for student data breaches. Stakeholders should monitor the multi-district class action for further rulings on institutional liability.
Further reading
For more on evolving data protection standards and legal precedents, explore our coverage of Cybersecurity.
Source note: This article includes information reported by Bloomberglaw.
Live Poll
Should companies be held strictly liable for the security of student and teacher data?
