California laws protecting student data have loopholes that allow tech companies to continue packaging and selling that information.