From the K–12 edition of October 23, 2026
Class Size Matters / Parent Coalition for Student Privacy: four of five NYC AI high school pilot vendors' public policies allow product-improvement use of student data
Parent Coalition for Student Privacy / Class Size Matters (for the AI Moratorium Coalition) · K-12 AI vendor privacy review (advocacy analysis) · New York City, New York, United States
- Publisher
- Class Size Matters
- Original publication
- October 13, 2026 (dated analysis)
- Source retrieved
- 2026-10-24
What happened
Leonie Haimson's analysis reviews the public privacy policies and posted privacy addenda of the five announced NYC AI high school pilot vendors. It says Playlab, Quill and Edia state that personal student data may be used to improve their products or services, which the author argues is a commercial use prohibited under New York's Education Law 2-d regulations. Intel AI-Ready Schools has no public-facing privacy policy and no posted addendum; Intel's general privacy notice allows use for advertising and marketing. Brisk explicitly says it does not use student or teacher data to train or fine-tune models, but the analysis says its Brisk Boost student chatbot appears to contradict the department's statement that companion chatbots are prohibited. For the posted addenda, the analysis says none explicitly bars product-improvement use, requires data minimization or sets a deletion date, and Playlab's listed contract term ran only from February to June 2024. It also says the department cannot verify vendor claims without access to code or running the tools on its own servers.
Why it matters
A line-by-line privacy review of the actual vendors in the largest district's AI pilot, and newly relevant tonight because Chalkbeat's October 23 list shows the department's AI vetting is contested and quotes the same author.
Evidence and measured results
Advocacy analysis of public documents; legal interpretations are the author's; no response from vendors or the department is included.
Limitations and uncertainty
Published October 13, before the last run, but not archived; selected because of today's NYC list. Advocacy source with a stated position; legal conclusions are not adjudicated; vendor contracts may contain terms not public.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-23; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Districts launching AI pilots may rely on vendor privacy terms that allow product-improvement use of student data and lack deletion dates.
- Stakeholders
- Student privacy officer
- General counsel
- Pilot program lead
- Parent advocacy groups
- Discovery questions
- Is each pilot vendor's privacy addendum current and posted?
- Does any vendor use student data to improve products?
- Which model providers process student data?
- What is the parent consent or opt-out path?
- Value hypothesis
- Pre-launch contract review could reduce legal and trust risk in AI pilots; no source measures this.
- Potential engagement
- An AI vendor privacy review against the state student privacy law before pilot launch.
- Unsupported claims
- No legal finding of violation.
- No evidence student data was actually misused.
- Vendor contracts beyond public documents not reviewed.
Pre-sales engineering
Role takeaway
- Fit
- Fits AI vendors able to document sub-processors, training settings and deletion schedules.
- Architecture and integration
- Map student data flows from the app to model providers and record retention and training settings in the addendum.
- Prerequisites
- Sub-processor list
- Data retention schedule
- Signed state-law addendum
- Constraints
- New York Education Law 2-d
- District ban on companion chatbots
- Limited ability to inspect vendor code
- Security
- Bar product-improvement use, minimize data and set deletion dates in contract.
- Proof of value
- Data-flow diagram reviewed
- Addendum answers each review question
- Deletion tested at pilot end
Delivery
Role takeaway
- Work
- Run a privacy and contract check on each AI pilot vendor before students use it.
- Dependencies
- Vendor documents
- Legal review capacity
- Posting process for addenda
- Ownership
- District student privacy office with general counsel.
- Skills and adoption
- Train pilot leads to read AI vendor privacy terms for training and retention clauses.
- Governance checkpoints
- Addendum posted before launch
- Chatbot features checked against policy
- Parent notice issued
- Acceptance criteria
- Proposed: every pilot vendor has a current posted addendum
- Proposed: no product-improvement use of student data in contract
- Proposed: deletion date stated for each vendor
- Risks
- Expired agreements
- Policy conflicts with chatbot features
- Unverifiable vendor claims
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Notes vendors rely on third-party model providers (for example Anthropic and OpenAI per a Chicago contract cited for Brisk). Interpretation: sub-processor disclosure is part of AI vendor review.
Governance
Who approves, reviews and stays accountable for outcomes?
Argues the department's posted privacy addenda do not meet Education Law 2-d requirements for AI vendors and that parent consent and opt-out are unclear.
Security and privacy
What data, permissions and controls need testing?
Product-improvement clauses, missing deletion dates and missing data-minimization terms are flagged for four of five vendors; one has no public policy.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Raises concern that continuous AI writing feedback may weaken students' independent writing skills (author's view).
Procurement
What should contracts, pricing and exit terms secure?
Argues contracts must bar product-improvement use, require minimization and set deletion dates.
Operating model
Which teams own the service once it runs?
External advocates are auditing district AI vendors from public documents.
Publication history
- 2026-10-23K–12 · Issue 475 resources
Stable resource ID: class-size-matters-nyc-ai-hs-pilot-vendor-privacy-policy-review-20261013