Vance, from the Public Interest Privacy Center, said the rule could mean that teachers are restricted from trying out ed-tech products individually in their classrooms if using that product requires accessing students’ personal data, and the district doesn’t provide them with a data custodian or set process for data sharing.