FTC Nabs Illuminate Education in Deception Settlement Deal
Published Date: 12/4/2025
Notice
Summary
Illuminate Education, a company that helps schools with data, is being called out for unfair business practices. They’ve agreed to fix these issues under a new deal, and the public can share their thoughts until January 5, 2026. This means Illuminate must change how they operate, but no fines or money penalties are mentioned yet.
Analyzed Economic Effects
6 provisions identified: 5 benefits, 1 costs, 0 mixed.
Millions of students' records exfiltrated
The proposed complaint says a threat actor had unfettered access to Illuminate's network for 13 days and exfiltrated millions of students' personal information. The exposed data included names, addresses, parent contact information, grades, indicators of special education plans (IEP/504), and free or reduced lunch status.
Must implement comprehensive security program
Part IV requires Illuminate to establish, implement, and maintain a comprehensive information security program to protect the security, availability, confidentiality, and integrity of covered information. The complaint lists failures the program must address, including lack of encryption (data stored in plaintext until at least January 2022), weak access controls, poor threat detection, and missing incident response until at least November 2022.
Ban on lying about security and breach timing
The proposed order bars Illuminate from misrepresenting how well it protects privacy, security, availability, confidentiality, or integrity of covered information and from misrepresenting the time period in which it will notify school districts and students of a breach. This stops the company from saying it does security or breach notices it does not actually perform.
Requirement to delete unneeded student data
Part II and Part III of the proposed order require Illuminate to delete or destroy covered information that is not needed under its customer contracts, and to document and follow a retention schedule showing why it collects each item and when it will be deleted. This limits how long student data can be kept.
Independent security assessments for 10 years
Part V requires Illuminate to obtain an initial and then biennial (every two years) independent third-party information security assessment for 10 years. Part VI requires disclosing material facts to the assessor and forbids misrepresenting facts material to those assessments.
Annual CISO certification and FTC breach notice reporting
Part VII requires an annual certification from the Chief Information Security Officer that the company implemented the order and reports any material noncompliance. Part VIII requires Illuminate to notify the Commission any time it notifies a federal, state, or local government that consumer information was accessed or exposed without authorization.
Personalized for You
How does this regulation affect your finances?
Personalize government policy and PRIA will tell you what this federal register document means for your household, plus every other regulation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.
Key Dates
Related Federal Register Documents
2026-20143, Rule on Impersonation of Government and Businesses
The FTC is planning new rules to stop scams where fake websites or social media accounts pretend to be the government or real businesses to trick people out of money. This affects online platforms like search engines and social media sites, which may have to change how they handle these impersonation scams. The FTC wants your thoughts by November 30, 2026, before making any final decisions.
2026-20078, Petition for Rulemaking of Malik Tony Singleton
Malik Tony Singleton asked the Federal Trade Commission to create new rules that protect consumers from tricky business practices, especially around automated decisions and keeping records. This could affect anyone who buys stuff or uses services that rely on computers to make choices. People have until October 30, 2026, to share their thoughts, and these changes might make companies more honest and clear, possibly saving consumers money and hassle.
2026-19598, Rules of Practice
The FTC is updating its rules to drop a confusing post-job approval step for former employees, making it easier to hire experts like economists and tech pros. They’re keeping ethics rules but clarifying what happens if someone breaks them. These changes kick in on September 24, 2026, with no new costs, just smoother, fairer rules for everyone involved.
2026-19597, Rules of Practice
The FTC is updating its rules to make things clearer and smoother for everyone involved. These changes affect how staff handle information requests, assign judges, and manage public records, with some new deadlines and procedures starting September 24, 2026. No big money changes here—just smarter, faster government work for businesses and the public.
2026-19289, FleetCor Technologies; Analysis of Proposed Consent Order To Aid Public Comment
FleetCor Technologies is facing charges for unfair business practices, and the FTC has proposed a deal to fix these issues. FleetCor must follow new rules to stop these practices, and the public can share their thoughts by October 22, 2026. This agreement aims to protect customers and keep FleetCor honest without any immediate fines mentioned.
2026-18853, Civil Penalty Inflation Adjustments
The Federal Trade Commission (FTC) won’t raise any fines in 2026 because the government couldn’t get the inflation data needed to update them. So, businesses and folks facing penalties will see the same fine amounts as in 2025. This freeze kicks in starting September 15, 2026, keeping things steady for now.
Previous / Next Documents
Previous: 2025-21891, Self-Regulatory Organizations; Cboe BZX Exchange, Inc.; Notice of Filing and Immediate Effectiveness of a Proposed Rule Change To Introduce a Small Retail Broker Hosted Solutions Program and To Update the Existing Eligibility Requirements for the Small Retail Brokerage Distribution Program for the Cboe One Summary Feed
Cboe BZX Exchange is rolling out a new Small Retail Broker Hosted Solutions Program and updating who can join the Small Retail Brokerage Distribution Program for the Cboe One Summary Feed. This means small retail brokers get easier, better access to important market data starting right away, with no extra fees announced yet. If you’re a small broker, these changes could make your data game stronger and simpler starting now!
Next: 2025-21894, Endangered and Threatened Species; Receipt of Recovery Permit Applications
The U.S. Fish and Wildlife Service got requests from scientists and groups who want special permits to help save endangered and threatened animals. They’re asking everyone—local communities, tribes, and the public—to share their thoughts by January 5, 2026, before deciding. These permits let researchers do important work to protect wildlife without breaking the law.