AI-powered tutoring platforms like Khan Academy's Khanmigo, Duolingo Max, Chegg, and Photomath are transforming how students learn. Collectively serving tens of millions of users, these tools offer personalized instruction, instant feedback, and adaptive lesson plans. But behind the convenience lies an uncomfortable reality: these platforms collect vast amounts of data about children's learning patterns, behavior, and even emotional states, often with minimal transparency about how that data is used or shared.
What Data Do AI Tutoring Platforms Collect?
AI tutors need data to personalize the learning experience, but the scope of collection often goes far beyond what parents expect:
- Learning patterns and performance: Every answer submitted, every mistake made, how long a student pauses before responding, and which topics they struggle with are logged and analyzed to build detailed academic profiles.
- Behavioral data: Usage times, session length, click patterns, and navigation behavior reveal not just what a child is studying but how they study, their attention span, and their emotional engagement.
- Voice and audio recordings: Language learning platforms like Duolingo Max use speech recognition for pronunciation practice, which means storing and processing children's voice recordings.
- Text inputs and conversations: AI chat-based tutors like Khanmigo record every question a student asks and every response they type, which can include personal details, frustrations, and off-topic disclosures.
- Device and location information: Most apps collect device identifiers, IP addresses, and sometimes precise location data, creating a digital trail of when and where a child studies.
- Photos and camera data: Math-solving apps like Photomath, now owned by Google, require camera access to scan homework problems, potentially capturing images of a child's surroundings, handwriting, and other materials on their desk.
How Student Data Gets Shared With Third Parties
One of the most alarming findings from recent research is the extent to which edtech platforms share student data. A study found that 96% of edtech applications shared student data with third parties, often without adequate disclosure or consent. This data can flow to:
- Advertising networks: Behavioral data and usage patterns may be used to build advertising profiles, even for minors.
- AI model training: Student conversations and inputs are frequently used to improve the platform's AI models, meaning your child's data helps train systems that serve millions of other users.
- Analytics providers: Third-party analytics services receive detailed usage data that can be combined with information from other sources to create comprehensive profiles.
- Corporate partners and acquirers: When edtech companies are acquired, as when Google purchased Photomath, student data transfers to the new owner and becomes subject to different privacy policies.
AI Tutors Collect More Than Homework Answers
Children frequently share personal information in conversations with AI tutors, treating them like a trusted teacher or friend. They may disclose family situations, health issues, social struggles, or emotional states. Unlike a human teacher bound by professional ethics, an AI platform logs everything and may retain it indefinitely or use it for model training.
COPPA and FERPA: Do Current Laws Protect Your Child?
Two federal laws are meant to safeguard children's data in educational settings, but enforcement has struggled to keep pace with AI-driven tools:
COPPA (Children's Online Privacy Protection Act)
COPPA underwent major revisions with new rules effective June 2025, requiring full compliance by April 2026. Key changes include shifting the default from opt-out to opt-in parental consent and requiring separate consent forms for AI features. Fines can reach $51,744 per violation per day, which means a platform with hundreds of thousands of student accounts could face tens of millions in penalties for systemic non-compliance.
However, many AI tutoring platforms operate in gray areas. Some rely on schools to act as intermediaries for consent, and others claim their AI features are covered under existing terms of service rather than requiring separate authorization.
FERPA (Family Educational Rights and Privacy Act)
FERPA protects education records maintained by schools, but its application to third-party AI tutoring apps is inconsistent. In March 2025, the Department of Education required all state agencies to certify FERPA compliance by April 30, 2025, signaling increased scrutiny. Yet many AI tutoring platforms used outside of official school channels may not be covered by FERPA at all, leaving students without protection.
State Privacy Laws
As of 2025, over 121 state laws protect student privacy beyond what FERPA requires. Some states mandate data deletion timelines, restrict commercial use of student data, and require transparency reports. However, compliance varies widely, and enforcement remains fragmented.
The AI Consent Gap
Under updated COPPA rules, any AI feature that uses children's input requires its own consent form. AI tutors, writing assistants, and adaptive learning engines all qualify. Consent for the main educational service does not automatically cover AI add-on features, yet many platforms have not updated their consent processes to reflect this requirement.
Platform-Specific Privacy Concerns
Khan Academy's Khanmigo
Khanmigo is governed by Khan Academy's privacy policy and warns users not to share personally identifiable information. The free tier, Khanmigo Lite, claims not to store conversations or collect identifying information. However, the full version logs all student-tutor interactions, and teachers are cautioned not to upload students' personal data into the system. While Khan Academy is a nonprofit with generally stronger privacy commitments, data still flows through OpenAI's infrastructure for processing.
Duolingo Max
Duolingo serves millions of users globally, many of whom are minors. Its AI-powered features collect voice recordings and detailed interaction data. Concerns have been raised about the lack of transparency regarding how user inputs are used for AI training, and it remains unclear whether the platform fully complies with COPPA, GDPR, or equivalent privacy frameworks for underage users in all markets.
Photomath (Google)
Since Google's acquisition of Photomath, the app's data practices fall under Google's broader ecosystem. Camera-captured homework images, solution histories, and usage patterns are subject to Google's privacy policies. Parents should review the app's data safety disclosures on app stores carefully, particularly regarding data linked to user identity.
Chegg and Mathway
Chegg's AI study tools, including Mathway, collect contact information, usage data, device identifiers, and user-generated content. With 80% of undergraduates reporting they use generative AI tools for studying, according to Chegg's own 2025 survey, the volume of student data flowing through these platforms is enormous, and 38% of surveyed students specifically requested stronger data privacy safeguards.
How to Protect Your Child's Privacy on AI Tutoring Platforms
You do not need to ban AI tutoring outright, but you should take proactive steps to minimize risk:
1. Review Privacy Policies and App Permissions
Before your child uses any AI tutoring app, read the privacy policy and check the data safety labels on iOS and Android app stores. Look specifically for what data is "linked to you" versus collected anonymously, and whether data is shared with third parties.
2. Use the Most Private Tier Available
Some platforms offer privacy-focused tiers. For example, Khanmigo Lite does not store conversations or collect identifying information. Always choose the option that collects the least data.
3. Teach Children What Not to Share
Explain to your children that AI tutors are not confidential. They should never share their full name, school name, address, age, family information, or emotional struggles with an AI chatbot. Frame questions generically rather than personally.
4. Disable Unnecessary Permissions
Revoke camera, microphone, and location access when those features are not actively needed. On most devices, you can control these permissions on a per-app basis through system settings.
5. Regularly Delete Data and Accounts
Periodically clear conversation histories and request data deletion where available. Under updated COPPA rules, platforms must honor deletion requests for children's data.
6. Monitor Your Family's Digital Footprint
Data from AI tutoring platforms can combine with information already available through data brokers and people search sites, creating a more complete profile of your child. PrivacyOn helps families reduce this exposure by removing personal information from 100+ data broker sites with 24/7 monitoring and dark web alerts. Family plans cover up to 5 people starting at $8.33 per month, making it practical to protect both parents and children from data harvesting across all sources, not just AI tutoring apps.
The Bottom Line
AI tutoring platforms offer genuine educational value, but parents should not assume these tools treat student data with the same care as a classroom teacher. The combination of extensive data collection, opaque sharing practices, and evolving regulations means that protecting your child's privacy requires active involvement. Review settings, teach data hygiene, and take steps to minimize your family's overall digital footprint so that no single platform or data broker holds too much information about your children.