The U.S. District Court for the Northern District of Illinois addressed an edtech provider’s motion to dismiss. Plaintiff alleged data privacy violations related to the use of the a platform by Chicago public school students. The case involves claims under federal and state privacy statutes, constitutional rights, and common law.
The lawsuit centers on allegations that the provider, the developer, and the board of education failed to protect sensitive student data collected through the mandatory use of the platform. The platform, used by public school students, collects a range of personal and educational information and incorporates third-party analytics software, including an autocapture feature, which tracks user interactions.
Personal Jurisdiction
The court granted the developer’s motion to dismiss for lack of personal jurisdiction. The court found that the Delaware corporation based in California, did not purposefully target Illinois or its residents. The installation of its tracking cookies on Illinois users’ devices was deemed “fortuitous” and dependent on the actions of the developer’s customers, like the provider, and not the developer itself. The plaintiff failed to provide evidence that the developer deliberately exploited or targeted the Illinois market.
Motions to Dismiss for Failure to State a Claim
- ECPA Claims: The court denied dismissal, finding it plausible that the provider could be liable for procuring third parties to intercept electronic communications for a criminal or tortious purpose, even if it was a party to the communications.
- Section 1983 Claims: Dismissed. The court held that the provider was not a state actor under any recognized theory, as it merely provided services to the public schools and did not act under state direction or perform an exclusive public function.
- CIPA Claims: The court allowed these claims to proceed, finding it plausible that the developer eavesdropped on confidential communications and that provider could be liable for aiding or conspiring in that conduct.
- SCA Claims: The court declined to dismiss, holding it plausible that the provider provided an electronic communication service to the public and that the relevant data was in “electronic storage” as defined by the statute.
- IEA, ISSRA, and CIPA Extraterritoriality: The court found it premature to dismiss claims based on the extraterritorial application of these statutes, leaving the issue for later stages.
- Breach of Contract: The court allowed the breach of contract claim to proceed, finding that students may plausibly be third-party beneficiaries of the public school – provider contracts, and that factual disputes regarding the scope of authorized data sharing should be resolved at a later stage.
Q.J. v. PowerSchool Holdings, LLC, No. 23 C 5689, 2025 WL 2410472 (N.D. Ill. Aug. 20, 2025).
