FTC Finalizes Order Against Illuminate Over Student Data Breach (2026)

The Federal Trade Commission gave final approval on June 5, 2026 to a consent order against ed-tech provider Illuminate Education, resolving claims that weak security exposed the personal data of about 10.1 million students. The order requires deletion of unneeded data, a security program, and honest breach notices, but no fine.

Information last verified on June 6, 2026. This is a developing story; we update it as the record changes.

Jurisdiction scope: This article addresses a federal FTC enforcement action under Section 5 of the FTC Act. It does not provide a state-by-state analysis of student-privacy statutes. For related background, see our student data privacy and FERPA guide.

What Happened

On June 5, 2026, the FTC announced final approval of a modified consent order in In the Matter of Illuminate Education, Inc., File No. 222-3105. The Commission had announced the proposed order in December 2025 and finalized it after reviewing public comments. The Commission's vote to finalize was 2-0.

According to the FTC, a hacker accessed Illuminate's cloud databases between December 2021 and January 2022 using the login credentials of a former employee who had left the company roughly three and a half years earlier. The breach exposed the personal information of about 10.1 million students, including email and mailing addresses, dates of birth, student records, and health-related information. The FTC alleged that Illuminate stored students' personal information in plain text, failed to use reasonable access controls and data-retention practices, and failed to notify affected school districts and individuals in a timely way, contrary to its promises.

The Commission charged that this conduct was an unfair or deceptive practice under Section 5 of the FTC Act. The order it finalized is an enforcement settlement, not a court judgment, and it resolves the FTC's claims on the terms described below.

What the Law Actually Says

The FTC's authority here comes from Section 5 of the FTC Act, 15 U.S.C. 45, which prohibits "unfair or deceptive acts or practices in or affecting commerce." The agency has long used Section 5 as a data-security tool: when a company promises to protect personal information but fails to use reasonable safeguards, the FTC treats the gap between promise and practice as deceptive, and it treats a security failure that causes substantial, unavoidable consumer injury as unfair.

The Illuminate order reflects the remedies the FTC now favors in data cases. It prohibits Illuminate from misrepresenting how it protects data and how quickly it will give breach notice. It requires a comprehensive information-security program. And it requires data minimization: Illuminate must delete personal information that is no longer needed to provide its services and must publish and follow a retention schedule stating why it collects information, the business need for keeping it, and when it will be deleted. Deletion and retention limits have become standard terms in recent FTC data orders rather than optional add-ons.

Student records sit at the intersection of several regimes. The federal Family Educational Rights and Privacy Act governs education records held by schools, and many states have their own student-data-privacy statutes. This FTC action does not displace those rules; it adds a federal consumer-protection backstop aimed at the vendor that held the data. For how the school-records side works, see our student data privacy and FERPA guide and COPPA compliance guide.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The most striking feature of the Illuminate order is what it does not contain: a fine. The FTC's leverage here is structural rather than financial. By requiring deletion of unneeded student data and a binding retention schedule, the order attacks the underlying risk, which is that vendors accumulate sensitive records and hold them indefinitely. Data that has been deleted cannot be breached.

The order also illustrates how the FTC frames vendor accountability. Illuminate did not run the schools; it served them. By holding the vendor directly responsible for security and for honest, timely breach notice, the FTC signals that processors of student data carry independent obligations, not just contractual ones owed to their school clients. That framing matters for the broader ed-tech market, where a small number of vendors hold records on very large numbers of children.

We are not predicting how any future enforcement action will be resolved, nor are we offering a view on any specific company's current compliance. The order describes allegations the company settled; it is not a judicial finding of liability.

How This Affects You

For parents and school administrators, the order is a reminder that the vendors handling student data are subject to federal oversight, and that breach-notification promises are enforceable. Families generally cannot sue under the FTC Act themselves, because it has no private right of action; enforcement runs through the Commission. Rights to access or correct education records typically come from FERPA and state law instead. If you are evaluating an ed-tech vendor, the order's themes (reasonable security, data minimization, and prompt breach notice) make a useful checklist, though they are not legal advice about any particular contract.

This is general legal information, not legal advice. It covers a federal FTC enforcement action under Section 5 of the FTC Act, verified on June 6, 2026. Laws change and details can evolve; consult a lawyer licensed in your jurisdiction about your specific situation.

---

Related articles

• Student data privacy and FERPA guide
• COPPA compliance guide
• Children's online privacy laws by state

---

Last updated: 2026-06-06. This is a developing story; details verified as of June 6, 2026.

Frequently Asked Questions

What did the FTC accuse Illuminate Education of doing?

The FTC alleged Illuminate failed to use reasonable data security, including storing student data in plain text and failing to give timely breach notice, after a 2021 to 2022 breach exposed about 10.1 million students' personal information. It charged this as a violation of Section 5 of the FTC Act.

Does the FTC order include a fine?

No. The final order, approved June 5, 2026 by a 2-0 vote, imposes no monetary penalty. It requires data deletion, a retention schedule, a comprehensive security program, and bars misrepresentations about security and breach notice.

What is data minimization in the order?

Illuminate must delete personal information it no longer needs and publish and follow a retention schedule explaining why it collects data, the business need to keep it, and when it will be deleted. The FTC increasingly requires these terms in data-security cases.

Can affected families sue under this order?

Not under the FTC Act, which has no private right of action; the FTC enforces it. Separate claims may exist under FERPA-related rules or state law, but those are distinct from this federal order.

How does this relate to FERPA?

FERPA governs education records held by schools, while this FTC action targets the vendor under federal consumer-protection law. The two operate alongside each other rather than one replacing the other.

What does the order require going forward?

Illuminate must not misrepresent its security or breach-notification practices, must maintain a comprehensive information-security program, and must minimize and delete data it does not need, subject to FTC oversight.