Most educational software programs use and gather personal information and metadata from students. Additionally, most of the educational software programs are no longer operated by the learning institutions but are run by third-party agencies. This means that in the decade since 2020, information about students is stored and handled outside premises and control of learning institutions. The personal information about students and their activity while they interact with learning management systems and online learning tools is increasingly in custody of cloud computing platforms, software-as-a-service providers, and learning tool vendors. There is an increasing will to use all the data and metadata from the activity of the students for research, to develop education management strategies, pedagogy approaches, and develop behavior control tools or learning tools informed by behavior analysis from learning analytics. Many times, these studies lack the ethical and moral perspective. In addition, there is an increasing number of cases in which this information has leaked or has been used in a shady way. Additionally, this information will be around for a long time, tied to the future digital profiles of the students whose data has been leaked. This paper hypothesizes that there has been an ongoing process of technological evolution that leads to a loss of control over personal information, which makes it even more difficult to protect user confidentiality and ensuring privacy, that data surveillance has entered the world of education, and that the current legal frameworks are not enough to really protect the student’s personal information. The paper analyzes how this situation came to pass, and why this is wrong. We conclude with some proposals to address it from its different root dimensions: technical, cultural, legal, and organizational.