California Attorney General Rob Bonta’s office opened a civil investigative demand into student-facing chatbot vendors and several large school districts this week, asking how long prompts, transcripts, and behavioral analytics are retained, whether data trains vendor models, and how products marketed as FERPA-aligned actually map to deletion timelines, according to people familiar with the letters and public statements from the Department of Justice.
What regulators are testing
The inquiry targets ed-tech chatbots deployed for tutoring, counseling triage, and writing assistance since 2023. Investigators requested data inventories, subprocessors lists, and copies of parent notifications—documents districts often treat as boilerplate but that CCPA and California’s student privacy statutes treat as enforceable representations.
Officials are particularly interested in “soft delete” practices where vendors stop displaying chats to users but retain embeddings or summarization artifacts in vector stores—a technical distinction parents may not see in plain-language privacy summaries.
Power and responsibility
Districts sign data processing agreements; vendors set retention defaults in admin consoles many school IT teams never reconfigure. The attorney general’s letters ask who holds liability when a chatbot logs mental-health keywords longer than counseling records law allows—a scenario student advocates raised after pilot programs expanded without board votes.
Vendor counsel said some products anonymize transcripts before storage; investigators want proof that anonymization resists re-identification when combined with roster data districts upload for single sign-on.
What artifacts exist today
Several vendors publish safety classifiers and moderation dashboards but not immutable audit logs. The inquiry asks whether those dashboards can be edited retroactively—a control assessors compare to financial systems that require write-once storage.
California Department of Education staff said they will not pause statewide literacy grants tied to chatbot pilots while the probe proceeds, but new memoranda will require explicit retention caps before funds flow—a policy lever separate from litigation outcomes.
FERPA, COPPA, and California overlays
FERPA governs educational records held by schools; vendors act as school officials only when contracts say so. Investigators allege some marketing decks implied vendor ownership of de-identified chats—a framing lawyers said conflicts with how California courts read student data ownership.
For users under thirteen, COPPA consent flows matter. Letters ask whether chatbots collected voice biometrics during read-aloud features without updated parental forms—a feature set popular in English-learner programs.
District responses
Los Angeles and San Diego unified spokespeople confirmed receipt of demands and said they will cooperate while reviewing vendor settings. Smaller charter networks said they lack staff to export requested logs and asked the state for a standardized export format—an operational gap the probe may expose regardless of legal findings.
Teachers unions urged members not to paste identifiable student stories into chatbots pending guidance, a workplace rule that could shrink usage metrics vendors report to investors.
What careful readers still do not know
The attorney general has not accused specific vendors of violations; civil investigative demands are fact-finding tools that may precede lawsuits or settlements. Timing of any public action likely slips past the November election cycle, but districts already renegotiating 2026 contracts are inserting 30-day deletion mandates and bans on model training—terms vendors previously resisted as “operational burdens.”
For California schools, the probe forces chatbot retention policies out of slide decks and into auditable clocks—whether or not every vendor can meet the deadlines investigators will test next quarter.
Technical exports investigators requested
Letters ask for machine-readable exports of retention jobs, cron schedules, and backup tape indices—artifacts vendors rarely surface in sales demos. Engineers at one vendor said producing those dumps required a week of script writing, revealing how immature operational tooling is behind polished teacher dashboards.
Parent and advocate reactions
Parent coalitions in Oakland and Sacramento welcomed the probe but asked for interim moratoriums on counseling chatbots until retention defaults change. District lawyers resisted blanket bans, citing tutoring equity gaps when human counselors remain understaffed.
Vendor competition dynamics
Smaller ed-tech firms with shorter default retention marketed “delete-by-default” settings in pitch decks this week, hoping to win RFPs before the attorney general concludes. Larger platforms counter that frequent deletion harms abuse investigations—an argument investigators said they will test against actual moderation workflows.
