Updated: 03.31.2025
Filed on: 05.06.2024
PowerSchool Data Privacy Litigation
Cherkin, et al. v. Powerschool Holdings, Inc., 3:24-cv-2706 (N.D. Cal.)
On May 6, 2024, K-12 students and their parents sued PowerSchool, a learning management and student information management system, alleging that PowerSchool generates, collects, uses, and shares information about them without proper consent. Plaintiffs asserted claims under
- common law intrusion upon seclusion,
- California statutory deceit (Cal. Civ. Code §§ 1709, 1710),
- California Invasion of Privacy Act (CIPA),
- California’s Unfair Competition Law,
- California’s Comprehensive Data Access and Fraud Act (CADAFA),
- invasion of privacy under the California Constitution,
- California statutory larceny (Cal. Penal Code § 496(af)), and
- unjust enrichment.
In their Complaint, the Plaintiffs warned that “[b]y collecting vast amounts of data from both students and their families, PowerSchool puts that data at risk.” Eight months later, in January 2025, PowerSchool announced that it had been hacked in late December 2024. Subsequently, it was reported that over 62 million student records and nearly 10 million teacher records were affected, making this one of the largest breaches of children’s information in U.S. history.
PowerSchool moved to dismiss the complaint, asserting that the Plaintiffs “failed to adequately plead the core elements for any of their legal claims,” and arguing that the Complaint “reads like a book report that simply summarizes horror stories about surveillance capitalism, cybercrimes, and targeted marketing and ‘datafication.’”
On March 17, 2025, Judge James Donato granted-in-part and denied-in-part the motion: Plaintiffs’ claims for statutory deceit, unfair competition, and statutory larceny were dismissed with leave to amend; their remaining privacy and unjust enrichment claims were allowed to proceed. Judge Donato wrote that “the complaint amply alleges that PowerSchool collects, for its own commercial benefit, data about public-school kids from information that the students share as part of their legally required education,” and that “doing so parental notice or consent, as is alleged, plausibly describes conduct that is ‘highly offensive to a reasonable person and . . . constitutes an egregious breach of the social norms.’”
The Court has ordered that a mandatory settlement conference must occur on or before May 30, 2025.