FTC Nabs Illuminate Education in Deception Settlement Deal
Published Date: 12/4/2025
Notice
Summary
Illuminate Education, a company that helps schools with data, is being called out for unfair business practices. They’ve agreed to fix these issues under a new deal, and the public can share their thoughts until January 5, 2026. This means Illuminate must change how they operate, but no fines or money penalties are mentioned yet.
Analyzed Economic Effects
6 provisions identified: 5 benefits, 1 costs, 0 mixed.
Millions of students' records exfiltrated
The proposed complaint says a threat actor had unfettered access to Illuminate's network for 13 days and exfiltrated millions of students' personal information. The exposed data included names, addresses, parent contact information, grades, indicators of special education plans (IEP/504), and free or reduced lunch status.
Must implement comprehensive security program
Part IV requires Illuminate to establish, implement, and maintain a comprehensive information security program to protect the security, availability, confidentiality, and integrity of covered information. The complaint lists failures the program must address, including lack of encryption (data stored in plaintext until at least January 2022), weak access controls, poor threat detection, and missing incident response until at least November 2022.
Ban on lying about security and breach timing
The proposed order bars Illuminate from misrepresenting how well it protects privacy, security, availability, confidentiality, or integrity of covered information and from misrepresenting the time period in which it will notify school districts and students of a breach. This stops the company from saying it does security or breach notices it does not actually perform.
Requirement to delete unneeded student data
Part II and Part III of the proposed order require Illuminate to delete or destroy covered information that is not needed under its customer contracts, and to document and follow a retention schedule showing why it collects each item and when it will be deleted. This limits how long student data can be kept.
Independent security assessments for 10 years
Part V requires Illuminate to obtain an initial and then biennial (every two years) independent third-party information security assessment for 10 years. Part VI requires disclosing material facts to the assessor and forbids misrepresenting facts material to those assessments.
Annual CISO certification and FTC breach notice reporting
Part VII requires an annual certification from the Chief Information Security Officer that the company implemented the order and reports any material noncompliance. Part VIII requires Illuminate to notify the Commission any time it notifies a federal, state, or local government that consumer information was accessed or exposed without authorization.
Personalized for You
How does this regulation affect your finances?
Personalize government policy and PRIA will tell you what this federal register document means for your household, plus every other regulation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.
Key Dates
Related Federal Register Documents
2026-16827, Agency Information Collection Activities; Proposed Collection; Comment Request; Extension
The Federal Trade Commission wants to keep its Franchise Rule paperwork rules for three more years, helping people get clear info before buying a franchise. This affects franchisors who must keep detailed records and share important facts with potential buyers. Comments on this plan are open until September 17, 2026, with no new costs expected.
2026-16617, Regulatory Agenda
The Federal Trade Commission (FTC or Commission) is publishing its regulatory agenda in accordance with section 22(d)(1) of the Federal Trade Commission Act, 15 U.S.C. 57b-3(d)(1) and the Regulatory Flexibility Act (RFA), 5 U.S.C. 601 to 612, as amended by the Small Business Regulatory Enforcement Fairness Act. The Commission's agenda follows guidelines and procedures issued September 15, 2025, by the Office of Management and Budget in accordance with the provisions of Executive Order 12866, "Regulatory Planning and Review," 58 FR 51735 (Oct. 4, 1993) and Executive Order 14192, "Unleashing Prosperity Through Deregulation," 90 FR 9065 (Feb. 6, 2025). The Government-wide Unified Agenda of Federal Regulatory and Deregulatory Actions includes a list of all regulatory actions under development or review and is scheduled for publication in its entirety on www.reginfo.gov and www.regulations.gov in a format that offers users a greatly enhanced ability to obtain information from the agenda database. The RFA requires publication in the Federal Register of agenda entries for rules that are likely to have a significant impact on a substantial number of small entities (5 U.S.C. 602) and any such rules that the agency has identified for periodic review under section 610 of the RFA. For the 2026 agenda, the Commission has no rule that meets the RFA's publication requirements. The Commission has identified rulemakings that are likely to have some impact on small entities, but do not meet the RFA's publication requirements. The current rulemakings that are likely to have some impact on small entities are: (1) the Energy Labeling Rule, 16 CFR 305; (2) the Alternative Fuel Rule, 16 CFR 309; (3) the removal of the vacated 2024 amendments to the Negative Option Rule, 16 CFR 425; (4) the Cooling-Off Rule, 16 CFR 429; (5) the Amplifier Rule, 16 CFR 432; (6) the Business Opportunity Rule, 16 CFR 437; (7) the Impersonation Rule, 16 CFR 461; (8) the withdrawal of the final rule for the vacated Combating Auto Retail Scams Rule (16 CFR 463); (9) the proposed Earnings Claims Trade Regulation Rule, to be codified at 16 CFR 462; (10) Unfair or Deceptive Fees Trade Regulation Rule, 16 CFR 464; and (11) the removal of the vacated Non-Compete Clause Rule from 16 CFR 910. The Commission's rulemaking review process carefully considers regulatory burdens and streamlines rules when feasible and appropriate. The majority of the rulemakings listed in the agenda are being conducted as part of the Commission's systematic review of all of its regulations and guides on a rotating basis. Under the Commission's program, rules are reviewed on a 10-year schedule. In each rule review, the Commission requests public comments on, among other things, the economic impact and benefits of the rule; possible conflict between the rule and state, local, or other federal laws or regulations; and the effect on the rule of any technological, economic, or other industry changes. These reviews incorporate and expand upon the review required by the RFA and regulatory reform initiatives directing agencies to conduct a review of all regulations and eliminate or revise those that are outdated or otherwise in need of reform. Except for notice of completed actions, the information in this agenda represents the judgment of Commission staff, based upon information now available. Each projected date of action reflects FTC staff's assessment that the specified event will occur this year. No final determination by the staff or the Commission respecting the need for or the substance of a rule should be inferred from the notation of projected events in this agenda. In most instances, the dates of future events are listed by month, not by a specific day. The information in this agenda may change as new information, changes of circumstances, or changes in the law occur.
2026-15955, Privacy Act of 1974; System of Records
The FTC proposes to modify its Privacy Act system of records notices (SORNs) by adding a routine use to four specific SORNs to comply with Executive Order 14249, Protecting America's Bank Account Against Fraud, Waste, and Abuse, and OMB Memorandum M-25-32, Preventing Improper Payments and Protecting Privacy Through Do Not Pay. The FTC is also separately making technical changes to three of these SORNs.
2026-15913, Caremark and Zinc Health Services; Analysis of Proposed Agreement Containing Consent Order To Aid Public Comment
The consent agreement in this matter settles alleged violations of Federal law prohibiting unfair methods of competition. The attached Analysis of Proposed Agreement Containing Consent Orders to Aid Public Comment describes both the allegations in the complaint and the terms of the consent order--embodied in the consent agreement-- that would settle these allegations.
2026-15182, Petition for Rulemaking of the National Consumers League, Campaign for Fairer Gambling, the National Council for Problem Gambling, the Public Health Advocacy Institute, and Truth in Advertising, Inc.
Please take notice that the Federal Trade Commission ("Commission") received a petition for rulemaking from the National Consumers League, Campaign for Fairer Gambling, the National Council for Problem Gambling, the Public Health Advocacy Institute, and Truth in Advertising, Inc., and has published that petition online at https://www.regulations.gov. The Commission invites written comments concerning the petition. Publication of this petition is pursuant to the Commission's Rules of Practice and Procedure and does not affect the legal status of the petition or its final disposition.
2026-14920, Agency Information Collection Activities; Proposed Collection; Comment Request; Extension
The Federal Trade Commission wants to keep its rules for how gas stations and fuel sellers measure and share fuel quality for three more years. This affects refiners, importers, distributors, and retailers who must keep records and share fuel ratings. Comments on this plan are open until September 21, 2026, and the paperwork costs about $455,000 a year in labor.
Previous / Next Documents
Previous: 2025-21891, Self-Regulatory Organizations; Cboe BZX Exchange, Inc.; Notice of Filing and Immediate Effectiveness of a Proposed Rule Change To Introduce a Small Retail Broker Hosted Solutions Program and To Update the Existing Eligibility Requirements for the Small Retail Brokerage Distribution Program for the Cboe One Summary Feed
Cboe BZX Exchange is rolling out a new Small Retail Broker Hosted Solutions Program and updating who can join the Small Retail Brokerage Distribution Program for the Cboe One Summary Feed. This means small retail brokers get easier, better access to important market data starting right away, with no extra fees announced yet. If you’re a small broker, these changes could make your data game stronger and simpler starting now!
Next: 2025-21894, Endangered and Threatened Species; Receipt of Recovery Permit Applications
The U.S. Fish and Wildlife Service got requests from scientists and groups who want special permits to help save endangered and threatened animals. They’re asking everyone—local communities, tribes, and the public—to share their thoughts by January 5, 2026, before deciding. These permits let researchers do important work to protect wildlife without breaking the law.