E-learning platforms sit at an uncomfortable intersection: they collect some of the most detailed behavioural data of any consumer product — which videos were watched, which questions were answered correctly, how long a learner spent on each topic, what they struggled with, what they skipped — and they do it continuously, across extended periods, often with people who are particularly vulnerable. Children. Employees who feel they cannot opt out. Adults navigating career changes.
When you layer AI-driven personalisation and adaptive learning algorithms on top, you have something that looks, from a GDPR perspective, like extensive profiling of individuals based on their intellectual characteristics. That triggers significant obligations — and in some cases, the most stringent protections in the regulation.
This guide covers what e-learning platforms collect, the legal complexity of different learner populations, and what product managers need to build compliance in from the start.
What Data E-Learning Platforms Actually Collect
E-learning platforms typically collect far more data than learners realise. The obvious data points — name, email, payment details — are only the beginning.
Progress and completion data includes which modules have been completed, which remain outstanding, and the sequence in which content was accessed. This is operationally necessary but constitutes personal data that is often retained long after the course ends.
Assessment scores and answer-level data goes further: not just whether someone passed, but which specific questions they got wrong, how many attempts they made, how long they spent before answering. This creates a detailed map of a person's knowledge gaps.
Time-on-task and engagement metrics — how long each video was watched, whether the learner paused or rewound, when they abandoned a section and came back — create behavioural fingerprints that can reveal learning difficulties, attention patterns, and motivation levels.
Forum and discussion posts are user-generated content that platforms often retain indefinitely. These posts can contain personal views, career concerns, workplace complaints, and sensitive disclosures that learners share in what they perceive to be a semi-private community context.
Video engagement data in recorded lectures includes timestamps for fast-forwarding and rewatching, tied to individual user accounts. In live courses, video conferencing recordings (Zoom, Microsoft Teams, Google Meet) may capture learner faces, voices, and screen shares.
Free trial and conversion behavioural data is collected before any commercial relationship exists. Many platforms use extensive tracking during free trials to identify high-intent users and trigger conversion emails. Learners often do not know this is happening.
All of this is personal data under GDPR. Processing it requires a lawful basis, transparency, and purpose limitation.
The Profiling Problem: Adaptive Learning and AI Tutoring
Adaptive learning systems personalise content delivery based on individual performance data. AI tutoring assistants track conversational patterns, identify misconceptions, and adjust explanations accordingly. Both are valuable pedagogically. Both create significant GDPR obligations.
GDPR Article 22 restricts automated decision-making that produces legal or similarly significant effects on individuals. Whether a recommendation engine that determines which content a learner sees next crosses this threshold depends on the consequences. If the algorithm's assessment of a learner influences whether they receive a certificate, how they are positioned to an employer, or whether they are promoted to advanced content, the effects could be significant.
More broadly, Article 22 requires that even where automated profiling does not trigger the Article 22 restrictions directly, you must:
- Be transparent about the profiling in your privacy notice
- Tell learners which decisions are automated and what data inputs are used
- Provide meaningful information about the logic involved
- Allow learners to request human review of significant decisions
For B2C e-learning platforms, this means your privacy notice needs to explain, in plain language, that your platform uses learning data to personalise content — not bury it in technical appendices.
Adult Learners, Children, and the Consent Problem
The consent requirements differ dramatically depending on who your learners are.
Adult Learners
For adult learners (18+), the standard GDPR consent framework applies. Consent must be freely given, specific, informed, and unambiguous. Pre-ticked boxes, bundled consent for multiple purposes, and cookie walls (where access is conditioned on accepting tracking) are all invalid.
The freely given requirement is particularly challenging for e-learning platforms. If a learner has paid for a course and access to that course is conditioned on accepting non-essential tracking cookies or profiling, the consent is arguably not free. Platforms need to separate what is technically necessary to deliver the service from what is optional analytics and personalisation tracking.
Children
Where your platform is used by or is directed at children under 16 (or under 13 in some EU member states), parental consent is required for processing based on consent. This is not merely a checkbox exercise — you need age verification mechanisms that are reasonably reliable, and you need a genuine consent mechanism from the parent or guardian, not the child.
For platforms marketed to schools (B2B edtech), the school typically acts as the data controller, and their agreement to your terms can substitute for individual parental consent — but this places obligations on the school's data protection officer to validate that your terms are adequate. If you are a B2C platform with no school intermediary, you bear this obligation directly.
Beyond consent, data minimisation takes on greater importance with children's data. You should collect only what is strictly necessary. You should not use children's learning data for personalised advertising or profile-building that extends beyond the educational purpose. The ICO's Children's Code (Age Appropriate Design Code) in the UK, and equivalent guidance from EU data protection authorities, sets out extensive requirements for platforms that children use or are likely to use.
Enterprise L&D and Employee Data: The HR Dimension
Many e-learning platforms serve enterprise customers — providing Learning Management Systems (LMS) or on-demand learning to companies for their employees. This creates an entirely different legal structure.
In the enterprise L&D context, the employer is the data controller. The e-learning platform is the data processor. This means:
- You must have a Data Processing Agreement (DPA) in place with every enterprise customer
- The DPA must specify what data you process, for what purpose, and on what legal basis
- You cannot use employee learning data for your own purposes (analytics, model training, advertising) without separate permission
Employees have a different relationship with consent than consumers. Employee consent under GDPR is generally considered suspect because the power imbalance between employer and employee means consent is rarely freely given. Employers must rely on different legal bases — typically legitimate interest or legal obligation — for processing employee data in L&D platforms.
If your platform captures detailed competency data — skills assessments, performance in simulations, test scores — this data may feed into HR decisions about promotions, performance reviews, or redundancy selection. At that point, Article 22 automated decision-making protections become directly relevant, and employees have the right to request human review and to object to automated processing.
Critically: transparency to employees matters. If employees do not know their learning platform is capturing detailed behavioural data and feeding it back to HR, this is a GDPR transparency failure — even if the employer has a lawful basis for the processing.
Certificate and Credential Data
Certificates and credentials issued by e-learning platforms are an increasingly valuable form of personal data. They are used in job applications, LinkedIn profiles, and professional accreditation processes. Several issues arise:
Retention periods: Learners may want certificate records retained indefinitely as proof of achievement. But GDPR storage limitation principles require you to justify how long you keep data. A policy that retains all platform data for seven years may be appropriate for financial records but not for assessment answer data.
Verification sharing: Many platforms enable credential verification by third parties — employers, accreditation bodies, professional associations. Each such sharing needs to be disclosed in your privacy notice, and the legal basis for the sharing (consent, legitimate interest, or contractual necessity) needs to be documented.
Data subject rights: If a learner exercises their right to erasure, you need to think carefully about what can actually be deleted versus what must be retained. Certificate records linked to accreditation bodies may fall under retention obligations that override the right to erasure. But behavioural data, answer-level data, and tracking logs should be erasable without affecting the credential record.
Video Conferencing in Live Courses
Live courses delivered via Zoom, Microsoft Teams, Google Meet, or proprietary video platforms create specific data protection issues.
Recording live sessions creates a permanent record of what learners said, what they looked like, and what appeared on their screens. Before recording:
- Learners must be informed clearly, before joining, that the session will be recorded
- They must be told what the recording will be used for (review, sale to future students, quality assurance)
- They need to be told how long the recording will be retained
- They must be told who will have access to the recording
Facial recognition features in video conferencing tools — which some platforms use to detect attention or engagement — process biometric data, which is special category data under GDPR Article 9. Processing biometric data for the purpose of uniquely identifying natural persons requires explicit consent (not just regular consent) and a separate legal basis. Most e-learning platforms should simply not use these features.
For AI meeting assistants that transcribe and summarise sessions (Otter.ai, Fireflies, etc.), the transcription is a further processing of personal data. Your privacy notice must cover this, and — for enterprise customers — your DPA must address it.
Discussion Forums and Community Data
Discussion forums, cohort chat tools, and peer review systems create a type of data that is easy to overlook: learner-generated content that contains personal information about third parties.
A learner discussing a workplace conflict in a forum post may be disclosing personal data about their manager. A peer review comment may reveal health information or personal circumstances. Moderating and retaining this content creates ongoing data protection obligations.
Specific issues to address:
- Retention: Most platforms retain forum posts indefinitely. This is difficult to justify under storage limitation principles. Implement a policy for archiving or deleting old discussions.
- Deletion rights: If a learner requests erasure, you need a mechanism to delete their posts without corrupting the conversational thread for other participants.
- Export and portability: Learners have a right to data portability. Your platform should be able to export a learner's forum posts, along with their other learning data.
- Moderation records: If you keep records of moderation decisions (flagged posts, banned users), this is also personal data with its own retention implications.
Payment Data and Free Trial Tracking
Payment data — card details, billing addresses, transaction records — is processed through your payment processor (Stripe, Braintree, PayPal). You are typically not storing the card data itself, but you are storing records of transactions, which are personal data. These typically have a six to seven year retention requirement for accounting purposes.
The more interesting issue is free trial behavioural data collection. E-learning platforms often instrument free trial experiences heavily — tracking every click, page view, and content engagement to identify conversion intent signals and trigger targeted emails. This processing happens before the learner has entered into a paid contract with you.
During a free trial, your lawful basis for tracking needs to be clearly established:
- If you are using cookies and trackers, you need a cookie consent mechanism even during the trial
- Your trial sign-up flow should make clear what behavioural data you are collecting and why
- Inferred signals (e.g., "learner watched 80% of intro video — high intent") that drive automated follow-up emails are profiling and should be disclosed
Sharing Data with Employers and Accreditation Bodies
Many e-learning platforms are built around the promise of verifiable credentials. Learners complete a course, pass an assessment, and a certificate is generated that an employer or accreditation body can verify. Some platforms go further, proactively sharing learner records with employers — particularly in enterprise L&D contexts where the employer is funding the training.
From a GDPR perspective:
- Learner consent is required before sharing detailed learning records with employers or third-party accreditation bodies, unless there is a separate legal basis
- In enterprise contexts, the employer-as-data-controller may have the legal basis, but learners should still be informed clearly
- Accreditation body sharing needs to be documented in your privacy notice as a specific data sharing relationship, with a named recipient category and a legal basis
- Do not use sharing as a sales feature without ensuring the data protection implications are covered — "we'll send your completion data directly to the industry body" is a significant data sharing arrangement that needs to be properly constituted
Privacy by Design: A Checklist for E-Learning Product Managers
Privacy by design is not a retrospective compliance exercise. It means building data protection into product decisions from the start. Here is a practical checklist:
Data collection
- Audit every data point you collect and document the purpose and legal basis for each
- Remove data collection that cannot be justified against a clear lawful basis
- Apply data minimisation — collect what you need, not what might be useful someday
- Separate technically necessary data (session management, progress tracking) from optional analytics
Consent and transparency
- Implement a granular cookie consent banner that distinguishes essential cookies from analytics and personalisation cookies
- Write a privacy notice that explains your adaptive learning and profiling in plain language
- For children's platforms, implement age verification and parental consent mechanisms
- For enterprise deployments, ensure your DPA templates are GDPR-compliant and reviewed by a data protection solicitor
Data subject rights
- Build a self-service data export function that covers all learner data: progress records, forum posts, assessment data, video engagement logs
- Implement account deletion that genuinely deletes personal data (not just marks accounts as inactive)
- Document what data cannot be deleted and why (e.g., certificate records linked to accreditation requirements)
AI and automated decision-making
- Map every automated decision in your platform: content recommendations, adaptive sequencing, assessment scoring
- For each, assess whether it could have legal or similarly significant effects on learners
- Where it could, implement human review mechanisms and document the logic of the algorithm
- Do not use learner data to train AI models without explicit consent or a clearly documented legitimate interest assessment
Third-party processors
- Maintain a record of all third-party tools that receive learner data: video platforms, analytics tools, email platforms, AI services
- Ensure each has a DPA in place and is listed in your privacy notice
- Carry out Transfer Impact Assessments for any tools that transfer data outside the EEA
Retention
- Define retention periods for each data category
- Implement automated deletion or anonymisation at the end of the retention period
- Do not retain detailed behavioural logs indefinitely because they might be analytically useful
Video and live sessions
- Implement a clear pre-session recording notice
- Do not use biometric attention-tracking features without explicit consent
- Document retention and access policies for session recordings
The regulatory risk for e-learning platforms is not hypothetical. The combination of detailed behavioural data, profiling, children's data, and employer data relationships creates multiple routes to regulatory scrutiny. The platforms that will navigate this well are the ones that treat privacy compliance as a product requirement, not a legal afterthought.
Run a free scan of your platform's web presence at app.custodia-privacy.com/scan to see what trackers and data collection points are visible from the outside — and where your transparency gaps are.
This post provides general information about GDPR as it applies to e-learning platforms. It does not constitute legal advice. Specific obligations vary based on your platform's business model, learner base, and the jurisdictions you operate in. Consult a qualified data protection lawyer for advice specific to your situation.
Top comments (0)