Student engagement data is among the most sensitive categories of personal information that EdTech products collect, and it is routinely treated with far less rigour than clinical health data, financial data, or other categories that trigger robust regulatory attention. This is not because the sensitivity is lower — it's because the regulatory infrastructure has not caught up with the technical capability, and because many of the people making product decisions in EdTech companies are technically sophisticated but haven't spent time thinking through the downstream consequences of the data they're collecting on children and young people.
In New Zealand, the Privacy Act 2020 applies to student data collected by EdTech providers through standard information privacy principles: data must be collected for a specific, lawful purpose; it must be adequate, relevant, and not excessive; it must be held securely; and individuals (or their guardians, in the case of minors) have access and correction rights. Schools that contract with EdTech providers are data controllers with legal obligations to understand what data their providers collect and how it's processed. The practical reality is that most schools are not in a position to conduct thorough data processing audits of every tool in their technology stack. The information governance responsibility is effectively delegated to the EdTech provider's terms of service and privacy documentation — documents that are rarely reviewed by the teacher recommending the tool and often only reviewed by a board of trustees member at annual compliance time.
The specific problem with engagement analytics is that the data collected can support inferences that go far beyond what the product needs to function. A tool that records time-on-task, click patterns, response latency, and error rates for a student's maths practice session is collecting a behavioural profile rich enough to make inferences about attention, frustration, confidence, and cognitive load. Those inferences may be useful for the adaptive learning function — knowing that a student's response latency is increasing and error rate is rising can correctly flag the need to change instructional strategy. But that same data could also be used to make inferences about learning disabilities, mental health, or home circumstances, if retained, aggregated, and subjected to secondary analysis. Founders who are thinking only about the primary use case are not thinking through the downstream inference problem.
We are not saying that engagement analytics products are inherently harmful. Used well, engagement data is one of the most useful signals available to adaptive learning systems, and the information it surfaces for teachers — which students are spending double the expected time on a task without completing it, which students are advancing much faster than their peers — has genuine pedagogical value. What we are saying is that founders who treat data ethics as a compliance box to check before launch are building on a fragile foundation. The schools and districts that are making considered decisions about their EdTech stack are asking increasingly specific questions about data minimisation, retention schedules, secondary use restrictions, and audit rights. Companies that can answer those questions with substance and precision, rather than pointing to a generic privacy policy, have a significant competitive advantage in institutional sales. Companies that can't are going to face an increasingly difficult conversation as regulatory attention in this space increases.
Panorama Education, which we backed at pre-seed in 2024, is building in this space with a specific design principle: collect only the engagement signals that can be directly acted on by a teacher within the timeframe when the signal is relevant, and make the data access and retention policy visible and controllable to the school administrator, not just the vendor. That design philosophy constrains the product scope, but it's the right constraint. The schools we've spoken with that have evaluated Panorama Education's approach against competing tools that collect richer engagement data say that the explicit data governance design is a significant trust factor in their adoption decision. In a market where institutional trust is the primary adoption barrier, that matters.