The education software company PowerSchool and Chicago Public Schools have agreed to pay $17.25 million to settle a proposed class-action lawsuit that accused them of violating students’ privacy by eavesdropping on their communications, court documents show.

The plaintiff, a student identified as Q.J., on Monday asked an Illinois federal judge to approve the proposed settlement and end what the motion called a “first-of-its-kind action that arises out of the alleged unlawful wiretapping of, and eavesdropping upon, school students while they used school-mandated education technology products.”

The lawsuit argued that PowerSchool Holdings, its subsidiary Hobsons, Inc. and the analytics firm Heap Inc. collected sensitive personal data about millions of students by covertly recording their communications. 

Along with PowerSchool and Hobsons, Chicago Public Schools will create and contribute to the settlement fund. Heap was removed from the Illinois case and is now being sued in New York. That litigation is ongoing.

In addition to the $17.25 million payout, which will be split between more than 10 million potential class members, the settlement requires PowerSchool to establish a “web governance” committee to monitor how it uses advertising technology in its Naviance platform and refrain from using third parties’ software or code in Naviance for the next two years, according to the motion describing the proposed settlement terms.

Anyone who logged into the Naviance platform between August 2021 and January 2026 is an eligible class member, the court documents said.

PowerSchool agreed to direct Heap and other vendors to delete all data belonging to class members and significantly enhance its privacy disclosures.

Chicago Public Schools agreed to mandate that its vendors supply annual certifications showing that they comply with state and federal privacy laws.

The lawsuit dates to August 2023 with allegations that while PowerSchool and Hobsons had advertised that they valued student privacy in reality they used online surveys, assessments and other tools to collect and obtain “sensitive and confidential” personal information about students, including student records and associated data.

Q.J. accused Chicago Public Schools of allowing the companies to unlawfully and “systematically” violate students’ privacy.

PowerSchool and Chicago Public Schools did not immediately respond to a request for comment. Under the proposed settlement terms, PowerSchool denies liability.

In January 2025, PowerSchool announced a hack which exposed sensitive student and teacher data, including special education status, mental health details, disciplinary notes and parent restraining orders.

The hacker obtained data belonging to 62 million students and 9.5 million teachers. The company is facing multiple lawsuits for the allegedly weak cybersecurity practices that led to that breach, including a failure to use multifactor authentication.