A Testing Company Breach Exposed Millions of Students' Records

Intro — The Company Your Kid's School Chose

Welcome to The Tech Radar for Parents. I'm your host, Weston, brought to you by Nicholas D. West Tech LLC. This is your briefing for the week of October nineteenth, twenty twenty six.

This week, the story isn't an app your kid chose. It's a company your kid's school chose.

Here's the plan. The good, Australia says it's getting ready to take five of the biggest platforms to court over its under sixteen ban. The bad, Arizona's attorney general says Roblox is stonewalling a child safety investigation, and she's asked a judge to step in. The ugly, a testing company's breach exposed records on millions of California students, including disability information.

This episode mentions child exploitation. If you or your child are struggling, call or text nine eight eight.

Let's go.

The Good — Australia Gets Ready to Enforce

The good. Australia gets ready to enforce.

Last December, Australia became the first country to bar kids under sixteen from holding accounts on major social media apps. The question since then has been simple. Does anyone actually enforce it?

This week, Australia's communications minister, Anika Wells, said yes. In an interview with Bloomberg, she said the country's online safety regulator is using new powers to prepare Federal Court cases against Facebook, Instagram, TikTok, Snapchat and YouTube. Her line, from earlier this month: the law is not failing, platforms are failing to comply with the law.

Here's why it got to this point. In July, the regulator reported that some apps let kids retry the same age check over and over until it worked. Since September, it can force companies to hand over internal records. The maximum penalty is about seventy six million U S dollars per breach.

Now, the caveat. Nothing has been filed yet. And independent research suggests a lot of Australian kids got around the ban anyway.

Closer to home, on Thursday the fifteenth, the same federal appeals court that let Florida's law stand last week did the same for Georgia's. That law requires a parent's permission for kids under sixteen. The court didn't call it constitutional. It just let Georgia enforce it while the case goes on.

So the rules are getting teeth. Whether they bite is the next chapter.

The Bad — Roblox, and the Questions It Won't Answer

The bad. Roblox, and the questions it won't answer.

On Friday the sixteenth, Arizona Attorney General Kris Mayes asked a court to order Roblox to hand over information for her office's child safety investigation. She also asked the judge to hold Roblox in contempt until it does.

The state sent Roblox two formal demands, in May and in August. It wants to know whether Roblox failed to protect kids from sexual exploitation, violent content and age inappropriate material, and whether it misled parents about those risks.

According to the state, even after repeated extensions, Roblox hasn't fully answered even its most basic requests. Things like, how many Arizona kids are on the platform. What safety systems it uses. And whether what it tells parents matches what happens inside the company.

Mayes said her office will not allow companies to stonewall efforts to protect Arizona children.

Now, the caveat. This is a request to a judge, not a ruling. Nothing has been proven, and we didn't find a response from Roblox to Arizona's filing.

But look at those questions again. How many kids. What protections. Do the promises match reality. Those are the same questions you'd ask before you let your child into any game. If a state can't get answers, a parent reading a help page won't either. So set the controls yourself.

The Ugly — The Breach Your Family Never Signed Up For

The ugly. The breach your family never signed up for.

On Friday the sixteenth, the California Department of Education announced that E T S, the company that runs the state's standardized tests, had been breached. Someone used a stolen login to get into a file transfer site, and copied files on and off from May twenty second to September eighteenth. Nearly four months. E T S found it on September twenty fifth.

The records cover current and former public school students enrolled from twenty twenty three through this school year. That's millions of kids. The state hasn't given an exact count.

Here's what was in them. Names, birthdays and home addresses. Student I D numbers. Test scores. And the sensitive part. Whether a child has a disability or a five oh four plan. Whether a family qualified for help because they were homeless. Whether a parent serves in the military.

The state says Social Security numbers and financial information were not taken, and it hasn't seen the data posted publicly. E T S is offering two years of free identity monitoring. And one day after the announcement, a family filed a proposed class action. Those are allegations for now.

Here's why this is the ugly. You can change a password. You can't change your child's birthday, a disability record, or the fact that your family once needed help. And no parent picked this company. The school did, and the state did.

If you're not in California, don't tune out. Your child's school uses testing companies and learning apps too.

The Decoder Ring — Decoding the Headlines

Time for the decoder ring.

Once again, I couldn't find new slang with a real date and a real source behind it. So we're decoding the headlines. Four terms.

Civil investigative demand. A formal order from a state attorney general that says, hand over these documents and answer these questions. It's like a subpoena, but before anyone has been sued. Arizona sent Roblox two.

Contempt. When a judge finds that someone ignored a court order. It can mean fines that keep adding up every day until they comply. That's what Arizona wants.

Five oh four plan. A school plan, under a federal law called Section five oh four, that gives a student with a disability accommodations. Things like extra test time or a quiet room. It's private, and it was in the California breach.

Age assurance. The umbrella term for any way an app estimates or checks your age. A birthday box, a face scan, an I D upload. Australia's fight is about whether apps did enough of it.

Now you've got the vocabulary for this week's news.

Your Weekly Action Plan (1–2)

Here's your action plan for the week. Four things.

Number one. Ask the school who has your child's data. Email the front office or the district and ask which outside companies hold your child's records, like testing, learning apps and the grade portal. You have a right to see your child's education records. If you're in California, watch your mail for a letter from E T S, and use the code inside to sign up for the free monitoring.

Number two. Freeze your child's credit. All three credit bureaus, Equifax, Experian and TransUnion, will freeze a child's credit for free if they're under sixteen. A freeze stops anyone from opening an account in your kid's name. It's the strongest step there is after a breach.

Your Weekly Action Plan (3–4)

Number three. Set Roblox's controls yourself. Link a parent account in the Roblox settings, then set the content maturity level, decide who can chat with your child, and set a spending limit. Don't wait for an investigation to tell you what the defaults are.

Number four. Ask your kid how they'd get around an age rule. Seriously. Say, if a law said you couldn't use this app, how would kids get around it? You'll learn more about their online life in five minutes than any settings page will tell you. And it shows them you want to understand, not just ban things.

Closing, This Week's Poll & Outro

Let's bring it home.

The good. Australia says it's preparing to take five big platforms to court over its under sixteen ban. Nothing's filed yet.

The bad. Arizona asked a judge to force Roblox to answer its child safety questions. Nothing's been proven.

The ugly. A testing company's breach exposed millions of California students' records, including disability information.

One more headline. A New Mexico judge ordered Meta to pay twenty five billion dollars. That case is about adult privacy and Cambridge Analytica, not kids, and Meta says it will appeal.

What I did not check this week. No court dockets were pulled. California's own announcement page blocked us, so the breach details come from news coverage that matches it. And there's no word yet from Roblox on Arizona's filing.

This week's poll. Do you know which companies your child's school shares their data with? Yes. No. I'm not sure. Or, I didn't know to ask. Vote right in the Spotify app, or at n d w tech dot org slash tech radar slash polls.

If you or your child are struggling, call or text nine eight eight. Free, confidential, twenty four hours.

If this was useful, please like and subscribe. And if you have another thirty seconds, leave a review. Reviews are free, and they're what keeps this show going and keeps it free for parents. Share it with another parent who needs it.

I'm your host, Weston, with Nicholas D. West Tech LLC. Stay vigilant, stay informed, and I'll see you next week.