FTC Finalizes Order Against Illuminate Over Student Data Breach (2026)
Independently fact-checked against primary sources (last audited June 6, 2026). · 3 primary sources cited on this page. How we verify our legal content
The Federal Trade Commission gave final approval on June 5, 2026 to a consent order against ed-tech provider Illuminate Education, resolving claims that weak security exposed the personal data of about 10.1 million students. The order requires deletion of unneeded data, a security program, and honest breach notices, but no fine.
Information last verified on June 6, 2026. This is a developing story; we update it as the record changes.
Jurisdiction scope: This article addresses a federal FTC enforcement action under Section 5 of the FTC Act. It does not provide a state-by-state analysis of student-privacy statutes. For related background, see our student data privacy and FERPA guide.
What Happened
On June 5, 2026, the FTC announced final approval of a modified consent order in In the Matter of Illuminate Education, Inc., File No. 222-3105. The Commission had announced the proposed order in December 2025 and finalized it after reviewing public comments. The Commission's vote to finalize was 2-0.
According to the FTC, a hacker accessed Illuminate's cloud databases between December 2021 and January 2022 using the login credentials of a former employee who had left the company roughly three and a half years earlier. The breach exposed the personal information of about 10.1 million students, including email and mailing addresses, dates of birth, student records, and health-related information. The FTC alleged that Illuminate stored students' personal information in plain text, failed to use reasonable access controls and data-retention practices, and failed to notify affected school districts and individuals in a timely way, contrary to its promises.
The Commission charged that this conduct was an unfair or deceptive practice under Section 5 of the FTC Act. The order it finalized is an enforcement settlement, not a court judgment, and it resolves the FTC's claims on the terms described below.
What the Law Actually Says
The FTC's authority here comes from Section 5 of the FTC Act, 15 U.S.C. 45, which prohibits "unfair or deceptive acts or practices in or affecting commerce." The agency has long used Section 5 as a data-security tool: when a company promises to protect personal information but fails to use reasonable safeguards, the FTC treats the gap between promise and practice as deceptive, and it treats a security failure that causes substantial, unavoidable consumer injury as unfair.
The Illuminate order reflects the remedies the FTC now favors in data cases. It prohibits Illuminate from misrepresenting how it protects data and how quickly it will give breach notice. It requires a comprehensive information-security program. And it requires data minimization: Illuminate must delete personal information that is no longer needed to provide its services and must publish and follow a retention schedule stating why it collects information, the business need for keeping it, and when it will be deleted. Deletion and retention limits have become standard terms in recent FTC data orders rather than optional add-ons.
Student records sit at the intersection of several regimes. The federal Family Educational Rights and Privacy Act governs education records held by schools, and many states have their own student-data-privacy statutes. This FTC action does not displace those rules; it adds a federal consumer-protection backstop aimed at the vendor that held the data. For how the school-records side works, see our student data privacy and FERPA guide and COPPA compliance guide.
Analysis: Why This Matters
The following is analysis from the Recording Law Editorial Team.
The most striking feature of the Illuminate order is what it does not contain: a fine. The FTC's leverage here is structural rather than financial. By requiring deletion of unneeded student data and a binding retention schedule, the order attacks the underlying risk, which is that vendors accumulate sensitive records and hold them indefinitely. Data that has been deleted cannot be breached.
The order also illustrates how the FTC frames vendor accountability. Illuminate did not run the schools; it served them. By holding the vendor directly responsible for security and for honest, timely breach notice, the FTC signals that processors of student data carry independent obligations, not just contractual ones owed to their school clients. That framing matters for the broader ed-tech market, where a small number of vendors hold records on very large numbers of children.
We are not predicting how any future enforcement action will be resolved, nor are we offering a view on any specific company's current compliance. The order describes allegations the company settled; it is not a judicial finding of liability.
How This Affects You
For parents and school administrators, the order is a reminder that the vendors handling student data are subject to federal oversight, and that breach-notification promises are enforceable. Families generally cannot sue under the FTC Act themselves, because it has no private right of action; enforcement runs through the Commission. Rights to access or correct education records typically come from FERPA and state law instead. If you are evaluating an ed-tech vendor, the order's themes (reasonable security, data minimization, and prompt breach notice) make a useful checklist, though they are not legal advice about any particular contract.
This is general legal information, not legal advice. It covers a federal FTC enforcement action under Section 5 of the FTC Act, verified on June 6, 2026. Laws change and details can evolve; consult a lawyer licensed in your jurisdiction about your specific situation.
Related articles
Last updated: 2026-06-06. This is a developing story; details verified as of June 6, 2026.
Frequently Asked Questions
What did the FTC accuse Illuminate Education of doing?
The FTC alleged Illuminate failed to use reasonable data security, including storing student data in plain text and failing to give timely breach notice, after a 2021 to 2022 breach exposed about 10.1 million students' personal information. It charged this as a violation of Section 5 of the FTC Act.
Does the FTC order include a fine?
No. The final order, approved June 5, 2026 by a 2-0 vote, imposes no monetary penalty. It requires data deletion, a retention schedule, a comprehensive security program, and bars misrepresentations about security and breach notice.
What is data minimization in the order?
Illuminate must delete personal information it no longer needs and publish and follow a retention schedule explaining why it collects data, the business need to keep it, and when it will be deleted. The FTC increasingly requires these terms in data-security cases.
Can affected families sue under this order?
Not under the FTC Act, which has no private right of action; the FTC enforces it. Separate claims may exist under FERPA-related rules or state law, but those are distinct from this federal order.
How does this relate to FERPA?
FERPA governs education records held by schools, while this FTC action targets the vendor under federal consumer-protection law. The two operate alongside each other rather than one replacing the other.
What does the order require going forward?
Illuminate must not misrepresent its security or breach-notification practices, must maintain a comprehensive information-security program, and must minimize and delete data it does not need, subject to FTC oversight.
Updates
Independently fact-checked against the cited primary sources
The Law Behind This Article
This article rests on the statutory provisions below, held in our own legal record and retrieved from the official source. Tap a section to read the operative text.
United States Code Title 15
§ 45Unfair methods of competition unlawful; prevention by CommissionIn forcecited in 14 of our articles
Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful. The Commission is hereby empowered and directed to prevent persons, partnerships, or corporations, except banks, savings and loan institutions described in section 57a(f)(3) of this title, Federal credit unions described in section 57a(f)(4) of this title, common carriers subject to the Acts to regulate commerce, air carriers and foreign air carriers subject to part A of subtitle VII of title 49, and persons, partnerships, or corporations insofar as they are subject to the Packers and Stockyards Act, 1921, as amended [7 U.S.C. 181 et seq.], except as provided in section 406(b) of said Act [7 U.S.C. 227(b) ], from using unfair methods of competition in or affecting commerce and unfair or deceptive acts or practices in or affecting commerce.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at uscode.house.gov
Cited in 3,207 court opinions in our collectionLatest citing opinion in our collection: 2026
In the courts (editorial summary, independently checked):United States v. Philadelphia National Bank (1963) applied the bank exclusion in 15 U.S.C. 45(a)(6) when construing Clayton Act section 7, and Copperweld Corp. v. Independence Tube Corp. (1984) noted that a corporation and its wholly owned subsidiaries remain subject to section 5 of the FTC Act.
Opinions citing this section in our collection:
- Morales v. Trans World Airlines, Inc. (Supreme Court of the United States 1992, 504 U.S. 374)“…etition in commerce.” 38 Stat. 719 , codified as amended, 15 U. S. C. § 45 (a)(1). That type of prohibition is ent…”
- Copperweld Corp. v. Independence Tube Corp. (Supreme Court of the United States 1984, 467 U.S. 752)“…d § 5 of the Federal Trade Commission Act, 38 Stat. 719 , 15 U. S. C. §45 . That these statutes are adequate to c…”
- Bowen v. Massachusetts (Supreme Court of the United States 1988, 487 U.S. 879)“…n required to exhaust before coming into court. See 15 U. S. C. §45 (c) (1940 ed.); 29 U. S. C. § 160 (f)…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: FTC Fines Travel App Hopper $35 Million Over Hidden "Junk Fees", How the FTC's Nationwide Noncompete Ban Was Struck Down, and What It Means for At-Will Workers, FTC Proposes Personalized Pricing Enforcement Policy, Seeks Comment
Search our full record of US law — 2.1 million sections, every state + federal →
Sources and References
- FTC, In the Matter of Illuminate Education, Inc., File No. 222-3105, case page (final consent order approved June 5, 2026)(ftc.gov).gov
- Federal Register, Illuminate Education, Inc.; Analysis of Proposed Consent Order to Aid Public Comment (Dec. 4, 2025), describing the alleged conduct and order terms(federalregister.gov).gov
- FTC press release, FTC Takes Action Against Education Technology Provider for Failing to Secure Students' Personal Data (Dec. 2025)(ftc.gov).gov
- 15 U.S.C. 45, Section 5 of the FTC Act (unfair or deceptive acts or practices)(law.cornell.edu)