What Canvas knows about you: Who controls the privacy that students never had?

Every time you message a TA, ask for extra time on an exam or turn in a late assignment, Canvas records it. These databases include personal information like student names, ID numbers and email addresses, as well as billions of direct messages exchanged between students and faculty. We assume it’s all private.

In May 2026, the cybercriminal group ShinyHunters hacked Instructure, the company behind Canvas, and stole roughly 275 million records from about 8,800 institutions. The same day, the UC Office of the President ordered all campuses to block or redirect Canvas until the site was secure. It wasn’t until May 11 — four days after the initial cyberattack — that the site was fully restored to all UC locations, leaving students unable to work toward their assignments and course pages in the middle of spring quarter. 

ShinyHunters used a “pay-or-leak” model, which means that they threatened to publish the stolen data unless Instructure paid a ransom. Instructure paid and got “shred logs” in exchange, which are supposed to prove that the stolen data was deleted. Still, this wasn’t ShinyHunters’ first rodeo. After a 2024 breach of education software company PowerSchool, the group went after individual victims even though the company had already paid. With a past history of taking the money and keeping the data, experts are far from sure that the shred logs tell anything. 

According to Bryan Vorndran, a former head of the Federal Bureau of Investigation’s (FBI) Cyber Division, the stolen data became a “treasure trove for cyber criminals.” A combination of names, IDs and private messages allows cybercriminals to conduct spear phishing, a targeted scam where hackers use real details to create fraudulent emails that appear legitimate. 

Our data was stolen, but was it ever private in the first place? Evidence says no. 

Canvas is only one of the providers that holds sensitive student information. School districts across the country also pay for tools like GoGuardian, Securly and Gaggle, which are constantly scanning student emails, documents and browsing history. Instead of simply storing who we are, these providers track our actions, such as what students search, write and click. 

Educational software providers make money in two main ways: through contracts worth millions of dollars with the school district and the data itself. While these companies often claim that they don’t “sell” student data, court cases suggest the line can be blurry. 

In a class action lawsuit over the college-planning platform Naviance, students alleged that hidden analytics software recorded their keystrokes and private messages to counselors and passed them to Google and Microsoft. PowerSchool, Naviance’s owner, paid a $17.25 million settlement to resolve the case. In Kansas, students sued their school district due to their usage of Gaggle after it had deleted their work without any prior warning, including a college essay that mentioned mental health. The school district ended up dropping Gaggle, but then quietly switched to a nearly identical tool without a public vote on the matter.  

The law has not caught up yet. The Family Educational Rights and Privacy Act (FERPA), the primary federal student privacy law, hasn’t been fully updated since 1974. The Children’s Online Privacy Protection Act (COPPA) dates to 1998, and its 2025 revision failed to clarify whether a school is allowed to consent to data collection in the place of a parent. Additionally, COPPA applies solely to children under 13, and although there’s a proposal in Congress to raise that age to 17, the policy doesn’t apply to college students currently. Even though FERPA does, advocates claim that its definition of “education records” is “far too narrow” to cover the new browsing histories and behavioral data companies collect today.

The rules that were meant to protect us either don’t apply to us, or were written for a different time. 

Students can’t opt out either. At UC Santa Barbara, Canvas is where we access course material, turn in assignments, message professors and request accommodations — activities which the platform is keeping track of — and there is no alternative. Universities choose the platform and sign the contract. We just receive a login to sign in with, and have no say in how our data is collected and used. Until laws like FERPA and COPPA catch up with the times, we should no longer question whether our data is privately stored, but rather the implications of who is allowed to keep it.

A version of this article appeared on p.11 of the Oct. 15, 2026 edition of the Daily Nexus.