Still, as privacy advocates note, there is a large and qualitative difference between what students share voluntarily and data collected by schools that they and their parents do not control, or even know about.
According to Schneier, "the thing about students that's different and worth talking about is that they're are marginal populations, like the elderly, where bad things tend to happen first."
Jules Polonetsky, executive director of the Future of Privacy Forum, agreed. "At home or when doing business, adults or kids have some ability to make decisions about what information they share," he said. "In school, however, kids are a captive audience and deserve higher protections."
Rebecca Herold, CEO of The Privacy Professor and a former middle- and high-school math teacher, said that higher protection should include parental control over, "data collected about teens and children through tracking devices and areas outside the school's responsibility."
Privacy advocates agree that schools have a legitimate and necessary interest in ensuring the safety of children in school and at school activities. But concerns about activities or relationships outside of school should be addressed, "with the parents or guardians of the specific student in question," Herold said, arguing that blanket monitoring, "is a huge invasion of all students' privacy, and complete disregard of parent/guardian wishes.
"Much of the data that may be collected by schools through connected devices students use, such as smartphones and tablets, is absolutely none of the school's business," she said.
There are multiple legal limits on how student data can be collected and used. Bret Cohen, an associate with the Washington law firm Hogan Lovells, agrees that, "children are compelled to go to school, so in some cases there may not be the opportunity to 'opt out'." But he adds that laws now in place, "restrict what schools and their service providers can do with student information."
In addition to COPPA, CIPA and FERPA, Cohen said the Protection of Pupil Rights Amendment (PPRA), "requires school districts and schools, with certain exceptions, to notify parents if students are scheduled to participate in activities that involve the collection, disclosure, or use of student personally identifiable information (PII) for marketing purposes, and gives parents the opportunity to opt out of such activities."
Cohen added that there are a number of states that have passed laws to regulate the use of student data.
Polonetsky said in addition to those laws, FPF and the Software and Information Industry Association (SIIA) are asking companies involved in the collection of student data to sign the "Student Privacy Pledge," -- a legal commitment that, "any personal data they have access to will only be used for educational purposes and only as directed by schools."
Sign up for CIO Asia eNewsletters.