In order to close significant gaps in the privacy protection of student data in educational AI systems, this study looked at how Privacy by Design principles are incorporated into AI-enhanced educational technologies and how well they match US legal requirements. This research shows notable differences in privacy implementation and legal compliance by conducting a systematic analysis of privacy practices across popular educational AI platforms, such as Khan Academy, Coursera, and commercial learning management systems. The results show that although 77% of platforms do not make privacy a default setting, Khan Academy is a prime example of how strong privacy safeguards and effective education can coexist, as evidenced by its high user satisfaction ratings and extensive data protection policies. According to the analysis, there are ongoing issues with consent protocols, with 67% of platforms gathering behavioral data beyond what is required for education, and there are extensive shortcomings in transparency procedures that make privacy policies unintelligible to important stakeholders. Strong correlations between the implementation of privacy features and user satisfaction are confirmed by statistical analysis (r=0.73, p<0.001), which defies industry presumptions regarding trade-offs between privacy and functionality. Critical ethical blind spots in current implementations are identified by the research, such as the systematic exclusion of student voices from privacy design decisions and the failure to adequately consider the long-term implications of educational data profiling. These results demonstrate the pressing need for institutional commitment to Privacy by Design principles, improved regulatory enforcement, and coordinated policy reform. The study offers practical suggestions for enhancing privacy practices in educational AI systems that benefit millions of students across the country, while also adding empirical support to theoretical frameworks.