Canvas Maker Instructure Sued for Alleged Student Data Harvesting

Case Overview: A class action lawsuit accuses Instructure, the company behind Canvas, of illegally collecting and profiting from the personal data of schoolchildren without parental consent.

Consumers Affected: Parents of K-12 students in the United States who used Instructure's Canvas platform or other products marketed to schools.

Court: U.S. District Court for the Central District of California

Instructure, the education technology company behind the widely-used learning platform Canvas, has secretly built a multibillion-dollar business by mining the personal data of schoolchildren—without their consent or their parents’ knowledge, a new lawsuit claims.

Filed by a group of parents in California and Maryland, the lawsuit accuses Instructure of systematically collecting, storing, and sharing private information about students across the country, including those under 13, in violation of federal and state privacy laws. 

The complaint argues that the company has prioritized profit over privacy, turning kids’ educational experiences into a stream of monetizable data.

Instructure Accused of Secretly Tracking and Sharing Student Data

The plaintiffs include the parents and legal guardians of three minors—two attending public school in California, and one in Maryland—who say their children were required to use Instructure products like Canvas as part of their everyday schoolwork. Because the students couldn’t opt out, the parents say, their consent to data collection was never freely given—nor was it informed.

The lawsuit also claims the company failed to notify families that it was collecting and analyzing detailed personal data. One parent, Heidi Saas, said she was denied access to information Instructure had collected about her son, despite asking both the company and his school. She said in the complaint that families are left in the dark and have no idea what data has been collected. 

Lawsuit Details Alleged Data Collection and Use

According to the lawsuit, Instructure doesn’t just collect routine educational information—it generates and extracts “thousands of data points” about children through their use of its tools. That includes behavioral data, preferences, interactions, and more, which the company allegedly shares with both school districts and third-party businesses for product development, marketing, and analytics.

The complaint accuses Instructure of building “intimate digital dossiers” on students that can shape how they’re taught, targeted, and even treated—without ever obtaining meaningful permission. It alleges that Instructure’s business model mirrors the controversial playbook of “surveillance capitalism,” prioritizing data extraction over transparency and accountability.

The company, headquartered in Utah, is alleged to have failed basic requirements for legal consent: providing understandable disclosures, obtaining permission from someone with authority (like a parent), and offering any real value in return for the data it collects.

The parents are seeking damages and court oversight to stop what they call a dangerous and unchecked practice. Schools used to collect information to help students, the complaint argues, now corporations are doing it to help themselves.

Data Privacy Lawsuits Target Various Industries

The lawsuit against Instructure is part of a growing wave of legal action over data privacy across industries. 

Earlier this month, Capital One was hit with a proposed class action after a former employee allegedly stole customer data over a nine-month period. Allstate has been accused of secretly building and profiting from a massive driving behavior database. 

A high-profile lawsuit claims a Musk-linked federal initiative accessed millions of Americans’ financial records without consent. And student-athletes at the University of Michigan are suing a former football coach and the school over alleged hacking and theft of sensitive personal information. 

In their lawsuit against Instructure, the parents want to represent anyone in the United States who attend or attended a K12 school who used Instructure K-12 school-marketed products. He is suing for violations of the constitution, as well as state laws, invasion of privacy, and more.

Case Details

• Lawsuit: Hernandez-Silva, et al. v. Instructure, Inc.
• Case No: 2:25-cv-02711
• Court: U.S. District Court for the Central District of California

Plaintiffs' Attorneys

• Melisa A. Rosadini-Knott and Andrew R. Tate (Peiffer Wolf Carr Kane Conway & Wise LLP)
• Andrew Liddell (EdTech Law Center PLLC)
• Lori G. Feldman and Brittany L. Sackrin (George Feldman Mcdonald, PLLC)

Are you a parent concerned about student data privacy? Share your thoughts on this lawsuit below.