{"resourceId":"class-size-matters-nyc-ai-hs-pilot-vendor-privacy-policy-review-20261013","versions":[{"version":"external-8da829c3d11dcd3155381c8e49847bcf8540dad6c677e7edd96baf2bb34f092a","resource":{"id":"class-size-matters-nyc-ai-hs-pilot-vendor-privacy-policy-review-20261013","title":"Class Size Matters / Parent Coalition for Student Privacy: four of five NYC AI high school pilot vendors' public policies allow product-improvement use of student data","organization":"Parent Coalition for Student Privacy / Class Size Matters (for the AI Moratorium Coalition)","sector":"K-12 AI vendor privacy review (advocacy analysis)","geography":"New York City, New York, United States","publishedAt":"October 13, 2026 (dated analysis)","publicationDate":"2026-10-13","eventDate":null,"sourceName":"Class Size Matters","sourceLabel":"Advocacy organization analysis (PDF)","sourceUrl":"https://classsizematters.org/wp-content/uploads/2026/10/Privacy-concerns-with-AI-pilot-programs-10.13.26.pdf","evidenceClass":"independent-reporting","outcomeClass":"cautionary","topics":["data-security","governance-procurement"],"finding":"Leonie Haimson's analysis reviews the public privacy policies and posted privacy addenda of the five announced NYC AI high school pilot vendors. It says Playlab, Quill and Edia state that personal student data may be used to improve their products or services, which the author argues is a commercial use prohibited under New York's Education Law 2-d regulations. Intel AI-Ready Schools has no public-facing privacy policy and no posted addendum; Intel's general privacy notice allows use for advertising and marketing. Brisk explicitly says it does not use student or teacher data to train or fine-tune models, but the analysis says its Brisk Boost student chatbot appears to contradict the department's statement that companion chatbots are prohibited. For the posted addenda, the analysis says none explicitly bars product-improvement use, requires data minimization or sets a deletion date, and Playlab's listed contract term ran only from February to June 2024. It also says the department cannot verify vendor claims without access to code or running the tools on its own servers.","sledRelevance":"A line-by-line privacy review of the actual vendors in the largest district's AI pilot, and newly relevant tonight because Chalkbeat's October 23 list shows the department's AI vetting is contested and quotes the same author.","evidence":"Advocacy analysis of public documents; legal interpretations are the author's; no response from vendors or the department is included.","architectureImplications":"Notes vendors rely on third-party model providers (for example Anthropic and OpenAI per a Chicago contract cited for Brisk). Interpretation: sub-processor disclosure is part of AI vendor review.","governanceImplications":"Argues the department's posted privacy addenda do not meet Education Law 2-d requirements for AI vendors and that parent consent and opt-out are unclear.","securityPrivacyImplications":"Product-improvement clauses, missing deletion dates and missing data-minimization terms are flagged for four of five vendors; one has no public policy.","caveats":"Published October 13, before the last run, but not archived; selected because of today's NYC list. Advocacy source with a stated position; legal conclusions are not adjudicated; vendor contracts may contain terms not public.","streamIds":["k12"],"roles":{"sales":"Sales framing: an advocacy review found that most vendors in New York City's AI high school pilot have public policies allowing student data use for product improvement. A bounded offer is a contract and privacy-addendum review for AI vendors before pilots start. Do not claim any vendor is breaking the law; these are an advocate's readings of public documents, not findings by a regulator.","engineering":"Engineering framing: the review turns on which models and sub-processors handle student data, whether data is used to improve products, and when it is deleted. Pre-sales should be ready to show sub-processor lists, training and retention settings, and deletion schedules. Proof of value is a data-flow diagram and contract addendum that answer each question in the analysis.","delivery":"Delivery framing: before an AI pilot launches, confirm a current, posted privacy addendum with no product-improvement use, data minimization and a deletion date, plus a parent notice and opt-out decision. Ownership sits with the district privacy office. Acceptance means every pilot vendor's addendum is posted and current. Risks are expired contracts, chatbots that conflict with district policy and unverifiable vendor claims."},"roleDetails":{"sales":{"customerProblem":"Districts launching AI pilots may rely on vendor privacy terms that allow product-improvement use of student data and lack deletion dates.","stakeholders":["Student privacy officer","General counsel","Pilot program lead","Parent advocacy groups"],"discoveryQuestions":["Is each pilot vendor's privacy addendum current and posted?","Does any vendor use student data to improve products?","Which model providers process student data?","What is the parent consent or opt-out path?"],"valueHypothesis":"Pre-launch contract review could reduce legal and trust risk in AI pilots; no source measures this.","potentialEngagement":"An AI vendor privacy review against the state student privacy law before pilot launch.","unsupportedClaims":["No legal finding of violation.","No evidence student data was actually misused.","Vendor contracts beyond public documents not reviewed."]},"engineering":{"fit":"Fits AI vendors able to document sub-processors, training settings and deletion schedules.","architectureIntegration":"Map student data flows from the app to model providers and record retention and training settings in the addendum.","prerequisites":["Sub-processor list","Data retention schedule","Signed state-law addendum"],"constraints":["New York Education Law 2-d","District ban on companion chatbots","Limited ability to inspect vendor code"],"security":"Bar product-improvement use, minimize data and set deletion dates in contract.","proofOfValue":["Data-flow diagram reviewed","Addendum answers each review question","Deletion tested at pilot end"]},"delivery":{"work":"Run a privacy and contract check on each AI pilot vendor before students use it.","dependencies":["Vendor documents","Legal review capacity","Posting process for addenda"],"ownership":"District student privacy office with general counsel.","skillsAdoption":"Train pilot leads to read AI vendor privacy terms for training and retention clauses.","governanceCheckpoints":["Addendum posted before launch","Chatbot features checked against policy","Parent notice issued"],"acceptanceCriteria":["Proposed: every pilot vendor has a current posted addendum","Proposed: no product-improvement use of student data in contract","Proposed: deletion date stated for each vendor"],"risks":["Expired agreements","Policy conflicts with chatbot features","Unverifiable vendor claims"]}},"retrievedAt":"2026-10-23T22:09:25-05:00","enrichedAt":"2026-10-23T22:12:24-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Raises concern that continuous AI writing feedback may weaken students' independent writing skills (author's view).","procurementImplications":"Argues contracts must bar product-improvement use, require minimization and set deletion dates.","operatingModelImplications":"External advocates are auditing district AI vendors from public documents.","sourceVerification":{"openedUrl":"https://classsizematters.org/wp-content/uploads/2026/10/Privacy-concerns-with-AI-pilot-programs-10.13.26.pdf","referenceExcerpt":"The only AI Pilot company that explicitly promises not to use student personal data for product improvement is Brisk","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}