Assumed Consent: When Fine Print Sells Out Your Child’s Privacy
A small change in the default—shifting from opt-out to opt-in—marks a big step toward protecting your child’s personal information from being sold without your knowledge.
Every school year, parents are buried in a blizzard of consent forms—medical releases, media waivers, technology agreements—most of which go unread in the rush to get kids back in class. Buried in the fine print is a decades-old policy that allowed schools to quietly hand over students' personal information to outside vendors—unless parents knew to opt out. But a new Arizona law changes that, requiring schools to get explicit permission first. It’s a small default switch with massive implications for child privacy. Despite overwhelming public support, the only opposition came from liberal lawmakers.
In this investigation, we explain the policy shift and speak exclusively with Christopher Thomas of the Goldwater Institute, the policy expert who led the charge to put parents—and not vendors—back in control.
THE INTERVIEW.
Christopher Thomas | Director of Legal Strategy for Education Policy | Goldwater Institute
Christopher Thomas is currently the Director of Legal Strategy for Education Policy at the Goldwater Institute––a Phoenix‑based conservative/libertarian think tank with a litigation arm that defends and enhances constitutional freedoms in all 50 states
With a background in school law, Thomas is well-versed in the federal Family Educational Rights and Privacy Act (FERPA), which safeguards the privacy of student education records. Under FERPA, parents have the right to access, review, correct, and protect their child’s school records.
One category of student information under FERPA is known as “directory information.” This typically includes items not considered highly sensitive on the surface—such as a student’s name, date of birth, participation in extracurricular activities, and dates of attendance. Unlike academic or disciplinary records, directory information is often viewed as less private, but it can still raise significant concerns depending on how it’s shared.
It’s not a violation of FERPA to release this student information. “I wrote policy to that law. What had always sorta bothered me was that especially in the computer age, the internet age, some of this information does have a personal nature. Somebody could troll and find out information about students and piece together the data that is publicly available from other sources and violate the privacy rights of both the students and the parents.”
Thomas believed the law didn’t go far enough, arguing it should require affirmative parental consent. “The parent, in writing, should have to say, ‘You have my authority or my consent to release this information,’” he explains.
When HB2514 was heard in the Senate Education Committee, Sen. Denise “Mitzi” Epstein (D-LD12) acknowledged she wasn’t completely familiar with FERPA and questioned whether the bill, if passed, would override federal law.
Thomas pushed back on the assumption that schools have a right to release student information.
“My head was spinning. Because, the school doesn’t have a right to release this information. The parents have a right. The feds have just set up a system by which the parents are only given an opportunity to opt out. But the right, if there is a right there, it is the privacy interest of the student data which belongs to the student. And it belongs to the parent. It’s not a right of school districts to release this information.”
The bill faced no opposition in the Arizona House of Representatives, but it prompted a number of questions when it reached the Senate. Still, Thomas said he was encouraged Governor Hobbs recognized the bill as a matter of common sense and ultimately signed it into law.
Virginia is currently the only state with a similar law, enacted under Governor Glenn Youngkin, a strong advocate for parental rights. Arizona’s version was modeled after it but modified to fit state law—shifting from an opt-out system to requiring parents to affirmatively opt in before student information can be released.
ABOUT THE LEGISLATION.
HB 2514: notices; directory information; disclosure; consent
Sponsor: Representative Olson (R-LD10)
We’ve compiled the key milestones of HB2514’s journey from bill to law—including pivotal testimony from the Goldwater Institute, insights from bill sponsor Rep. Justin Olson, and sharp legal questioning from Democrat State Senator Denise “Mitzi” Epstein.
The bill was signed into law by Governor Katie Hobbs on April 18, 2025.
“Most children have a larger digital footprint by the time of their first birthday than most of us have had - that their parents have had - by the time they’re 25,” says privacy pro Naomi Brockwell.
In an exclusive interview, Barber sits down with world-renowned privacy advocate Brockwell to unpack the realities of child privacy in today’s increasingly digital and data-driven world.
While technology can be a powerful educational tool, Brockwell says it’s turning devices into surveillance tools allowing third parties to harvest, profile, and monetize children's data from an early age.
“Maybe your child doesn’t want their face to be trained on AI - facial recognition software - so it has mapped every day of their life and now there’s no chance as an adult that they’ll be able to evade the system,” she explains. That footprint is not only permanent, but also invisible to many parents who unknowingly authorize access through apps and platform permissions.
Brockwell warns the use of front-facing cameras, microphones, and AI facial recognition systems can create a lifelong record children never consented to—and may never be able to erase. She calls on parents to better educate themselves about digital risks.
Children, she notes, are 51% more likely to become victims of identity theft due to the massive amount of data being shared about them online. “By the time they find out—when they apply for a car loan or a job—it’s too late,” she said. Brockwell says we need to set kids up for digital success, not digital liability.