L.A. Unified's Chatbot Collapsed. Nobody Can Prove What It Did With Student Data.

The public timeline

Six dated events, in order. Every one is on the public record. What is not on the public record is the per-response data trail any of them would have wanted to sample.

What no auditor has been able to reconstruct

Everyone reading Whiteley’s allegations two years later wants the same thing. The district records officer, the state privacy consortium, the FBI, the grand jury: they all want a per-response record of what Ed did with student data. They cannot get it. The reasons are documented in the collapse timeline above, but the specific gaps are worth listing:

• Which student data fields Ed sent to which third-party model, per response, across 86 days of live operation.
• Whether any AllHere subprocessor stored or trained on the data, per the terms of the subprocessor DPAs that governed at the time.
• What consent basis was in effect when each response was produced, cohort by cohort.
• Whether any teacher-review or parent-notification step fired between response generation and delivery.
• What retention rules actually governed which stores, and whether those stores were purged, sold in bankruptcy, or still exist somewhere.
• What backups AllHere held at the moment operations wound down, and whether the trustee inherited them intact.

Every one of those questions was answerable in real time by the operating system that ran Ed. None of them are answerable today. The record is not missing because AllHere is gone. The record is missing because it was never emitted in a form that could survive AllHere being gone.

The failure is not the whistleblower being wrong

Whiteley could be right, wrong, or partially right. It is not knowable from the outside, and the internal record that could resolve it does not exist. That is the failure the district, the state, the FBI, and the grand jury are all working around. Every one of them is doing an investigation that a signed per-event trail would have converted into a query.

The Illuminate Education breach in 2022 hit the same wall. The PowerSchool breach in 2024 hit the same wall. The FTC action against Amazon for COPPA-covered voice recordings in 2023 hit the same wall. In each case, the vendor could not produce a record of what actually happened to the data in the volume and cadence the regulator wanted, and the case turned partly on that record gap. The AllHere case is currently unfolding on the same pattern.

For a district onboarding an AI vendor in 2026-27, this is what the compliance officer is asking about. Not whether the vendor markets itself as private. Not whether the DPA has a data-property clause. Whether the vendor can produce a signed record of a specific response, on a specific date, involving a specific student, that the district can verify without relying on the vendor still being operational.

The reconstruction underway vs. the query it should have been

Two years in, the AllHere investigation is still doing archaeological work. What follows is the reconstruction that is actually happening right now, laid alongside the query that same complaint would have run against a signed event chain. Same complaint, same date, same student cohort. Two very different answers to “what did Ed actually do?”

The pattern property that matters is portability. Signed records survive the vendor in the same way a notarized document survives the notary’s office closing. That is what makes them useful under the exact conditions where investigators need them: after the vendor is gone. It is the same discipline we ran into when our own deploy agent hit a SEV-0 on April 30, which is when we started running per-event signing on our own agents (documented in the internal April 30 field note).

Where this leaves the market

For districts, the AllHere pattern changed vendor decisions. The RFP conversation now includes a specific question about how the vendor would produce a per-decision record if a parent complains, and how the vendor’s answer changes if the vendor is no longer operational. Districts that have been through Illuminate, PowerSchool, or the Amazon COPPA action already ask this. The rest are learning to.

For vendors, the pattern does not create new liability that was not already there. What it does is bound the scope of the discovery a district (or a regulator, or a plaintiff’s counsel) can run. Without signable records, the alleged behavior is the maximum plausible behavior, because nothing exists to counter the allegation. With signable records, the vendor can prove what did and did not happen at the response level, and the discovery scope narrows to what the records actually show. That is the argument for adoption. It is not that signing records is easier on the vendor; it is that not signing records concedes the plaintiff’s narrative by default.

The regulatory posture supports this direction too. The FTC has treated evidence gaps as findings on their own since the Illuminate action, and the state consortia (SDPC, California SB 820, New York Ed Law 2-d) have been moving toward per-vendor attestation records that mirror this discipline. Vendors that are ahead of the requirement do not face it as a compliance surprise. The framework districts are already building around is documented in the AI-in-the-classroom vendor responsibility framework.

Ed is the counterfactual. Eighty-six days of live operation, no per-response record of what it did, and two years later still no verified answer. The next AllHere-shaped vendor collapse is coming. Whether it plays out the same way is a decision every AI-touching edtech vendor is making right now, whether they are aware of making it or not.