Illuminate Education’s recent settlements with the FTC and the AGs of three states over a data security incident show movement among state and federal enforcers to regulate the educational technology industry. The settlements include the first application of California’s and Connecticut’s student data privacy laws. This article analyzes the breach and settlement terms, noting lessons for companies and signs of future enforcement trends, with commentary from FTC experts at the Entertainment Software Ratings Board, Sheppard Mullin and Wilson Sonsini. See our three-part series “Children’s Privacy Grows Up”: Examining New Laws That Now Protect Older Teens (Jan. 15, 2025), FTC Amends COPPA Rule and Targets Data Sharing (Jan. 29, 2025), and Seven Compliance Areas for Protecting Teens” (Feb. 12, 2025).