[jnorthrop]

You're correct. The teachers can not give student data to a third party without a proper contract for data transfer. However, I will give them credit for having a clear, fair and simple terms of service and privacy policy but it doesn't look like a lawyer was involved with their creation (it wouldn't be so simple or clear if a lawyer wrote it) so they probably haven't sought council for the rest of the business either.

[eli]

This is an aside, but many lawyers view it as their job to protect your company from legal liability to maximum extent possible. But any half-way decent lawyer should be willing to take directions like "limit the privacy policy to the page" and "cut out extraneous legalese."