A prominent advocate for Utah’s book bans was given access to a school library system containing private student information — including home addresses, phone numbers and what books each student has previously checked out.

But Davis School District officials assert that Brooke Stephens didn’t look at any sensitive data while she was volunteering at Reading Elementary earlier this year.

“Ms. Stephens was one of three volunteers who were helping the school librarian catalog a large number of books,” district spokesperson Christopher Williams said. “...Each was supervised by the school librarian during the time they were assisting the librarian. There was no breach of student records.”

The district confirmed Stephens had access to the library system to help enter “titles, authors, ISBN numbers, and the like into our system for a large number of newly purchased books.” The practice is typically reserved for librarians, the district added.

An internal investigation into the situation determined “there was no policy violation,” the district said. But the district didn’t specify how it investigated what Stephens was able to access.

The Salt Lake Tribune sent district officials several follow-up questions about that investigation and the district’s library volunteer policy.

In response, the district did not explain how it concluded Stephens did not access student records, nor did it detail how the librarian was able to closely monitor all three volunteers’ work at once.

“Our response is that the volunteers were supervised by the librarian while they accomplished the work and that they did not access any student information,” the district reiterated.

Stephens is a prominent leader in the conservative group Utah Parents United and launched the popular social media page “LaVerna in the Library,” which is dedicated to offering parents instructions on how to request that school districts review certain titles for inappropriate content.

She has submitted many requests herself for book reviews across the state, filing more than 20 in Davis School District alone, where her children attend.

Accordingly, the district has led the ranks in contributing to statewide book bans. Under Utah law, once three school districts (or two districts and five charters) remove the same book for containing “objective sensitive material,” all public schools in the state must pull — and destroy — all copies. Davis banned 34 of the 35 titles removed from shelves statewide.

In general, it’s not uncommon for librarians to seek the help of volunteers, said Sarah Lamdan with the American Library Association (ALA). Lamdan leads the nonprofit’s Office of Intellectual Freedom.

However, because library circulation records are considered private in 48 states, including Utah, the national organization recommends that libraries train all volunteers on those privacy laws, Lamdan said.

“Everyone in the library, including volunteers, [have] the duty to respect and protect the privacy of users,” she said. “So, that kind of training is imperative.”

School library records indicating which titles students have checked out have an extra layer of protection under the federal Family Educational Rights and Privacy Act. The law prohibits public disclosure of a student’s education records without parental consent.

The district did not answer whether parent volunteers are ever provided with any privacy law training, including on FERPA.

When reached by The Tribune about concerns that the district allowed Stephens access to a system that contains sensitive student library records at Reading Elementary, Stephens said: “Nothing happened,” then ended the call.

The Tribune followed up with Stephens via email, relaying a series of questions that asked for her perspective on the access she was provided, how she was provided that access, what information she ultimately accessed and whether she received any training as a parent volunteer. Stephens did not respond.

The issue was first formally raised in a complaint to the Utah State Board of Education, a copy of which was shared with The Tribune.

The Tribune reached out to the complainant listed on that form, parent Jessica Horton, who confirmed she submitted it after first learning from Davis educators that the district granted Stephens library system access in February.

Horton runs a group called Let Davis Read, which aims to protect student book access and runs counter to Stephens’ efforts. Horton’s kids also attend Reading Elementary, a school named for a former school board member who encouraged young students to read and write.

“Immediately, I had alarm bells going off,” Horton said.

She said she first raised the issue with the school’s principal before some friends recommended that she reach out to her state school board representative. That’s when, Horton said, she was advised to file the formal complaint with the state’s education hotline.

What the complaint alleges

Horton submitted her complaint on March 10. In it, she wrote she learned that Stephens and other parents were granted library system access after Reading Elementary’s librarian had requested volunteers to help catalog a new shipment of books.

As part of the task, the three parent volunteers were given access to Follett, the software system the district uses for its libraries, the district confirmed.

Horton alleges in the complaint that Stephens was let into the system using the librarian’s login. That’s according to what an educator told her, she wrote. And because Stephens was logged in as an administrator, that gave her access to private student information, Horton believes.

The Tribune in a series of emailed questions asked the librarian whether she provided the parent volunteers with her login credentials. The Tribune also asked whether the librarian had trained any volunteers on privacy law or other subjects or tasks. The librarian did not respond.

Horton, who previously focused on data privacy as an attorney, believes an unauthorized individual having access to a system with private student data — whether that person looks at it or not — violates both the federal Family Educational Rights and Privacy Act (FERPA) and Utah law on student privacy.

Shortly after the parent volunteers were given access to the system, Horton said she learned that Stephens allegedly approached Lori Warden, the Davis School District’s library supervisor, with a training opportunity: Stephens wondered if she could show district librarians how to integrate her book-rating system, ratedbooks.org, into the Follett software.

The Rated Books website that Stephens created, with a nonprofit registration in her name, rates books that students may have access to on a scale of 0–5; zero means suitable for all ages while “5” means “deviant,” or adults-only. The scale, according to the site, is modeled after the Motion Picture Association’s film ratings.

The state previously referenced information sourced from Stephens’ Rated Books system when it conducted a 2025 audit on banned books, with auditors ultimately calling for “more robust oversight” of materials entering public schools.

After the volunteer visit, and after Stephens’ request, Warden sent a notice to library staff through Microsoft Teams on Feb. 24. Horton obtained a copy of that message through a public records request that she shared with The Tribune.

“Please remember that we don’t upload rating systems into Follett,” Warden cautioned library staff in the district, “nor do we have parents come in and help us with the software or the catalog.”

“Parents might come in to help put stickers on books or organize materials,” Warden continued, “but they shouldn’t have administrator access to the catalog, which may have student information associated with it.”

The Utah Professional Practices Advisory Commission, which investigates alleged misconduct among those holding Utah educator licenses, told The Tribune it does not have any cases open regarding the librarian.

Ewell is the only staff member listed on the school’s web page for its library. The district lists her official title as elementary media specialist. A website that lists Utah educators’ licenses was not operating Thursday; the school and the state Board of Education did not reply to questions about whether Ewell is licensed or a paraprofessional.

Horton said that Reading Elementary’s principal told her the librarian sat next to Stephens the entire time she was logging books into the system. He added that the librarian said she never saw Stephens do anything inappropriate, Horton said.

Neither the principal nor the librarian personally answered Tribune questions, separate from the district’s responses, about how the librarian was able to closely monitor the three volunteers simultaneously.

Horton said she remains concerned that the district “doesn’t appear to know exactly what Brooke did when she had access to the system, what data she accessed, or if she retained copies of that data.”

The state and district’s responses

In response to Horton’s complaint, the state board instructed her to instead raise her concerns with the Davis School District, because the situation was outside of the state’s scope of control.

A Utah State Board of Education spokesperson confirmed to The Tribune that the board received Horton’s complaint and referred it to the board’s Internal Audit Department.

That department, which runs the hotline that fields statewide education complaints, emailed Horton back. The message, according to a copy The Tribune reviewed, stated that the board oversees public education in the state as a whole and “may not govern, manage, or operate school districts, institutions, and programs, unless granted that authority by statute,’” citing state law.

“Once the Internal Audit Department (IAD) makes referrals, as was done in this case, the IAD has very limited involvement if any, and further communications are best addressed with the referrals directly,” USBE spokesperson Ryan Bartlett said.

Horton then reiterated her concerns to the district, she said, but felt officials didn’t do much to address them.

The school’s principal told her in a call, Horton said, that its library wouldn’t take volunteers anymore and that only other librarians within the district would be able to help log books in the future.

Neither the principal nor the district answered Tribune questions about that characterization, including whether or not it reflected a district policy change.

Horton also scheduled a call with Logan Toone, an assistant superintendent for the district. Horton shared some notes from that call with The Tribune.

Toone, she said, told her that Stephens volunteered for about 90 minutes on Feb. 20. Toone also said, according to Horton, that the cataloging interface of the library system is on a separate page from student data.

Horton said he told her that he didn’t believe Stephens accessed those student data pages, but added there’s no way to know. Horton also recalled Toone saying that the district checked the system for the books Stephens logged and didn’t noticed any unusual data or ratings associated with the titles.

The Tribune contacted Toone directly to ask about Horton’s notes and recollections from the call, as well as his understanding of the situation. Toone did not respond.

The district also did not answer questions about the call.

Did giving volunteers access break the law?

Neubia L. Harris, a North Carolina attorney who specializes in student data privacy and FERPA law, said she is surprised Davis School District allowed parent volunteers to access the library system.

Even among school officials, she said, there should be strong parameters for accessing personal student data. Staff should only be looking if there’s a fine, if a student didn’t turn in a book on time, or if there’s a “legitimate” safety concern, such as a student who has been making threats checking out books on guns.

Parents can also request such information about their own child, Harris said. But that’s where the list ends.

“There’s no reason a volunteer should have access to that personal information,” she told The Tribune. “That’s inappropriate. The books that students check out are considered student records.”

Harris said it’s likely the district did “run afoul of FERPA” law in letting Stephens access the system at all — regardless of whether she reviewed sensitive data.

“I’m surprised the school gave her access,” she added. “I think that’s a bad call.”

Volunteers, she said, can help in other ways that don’t involve having access to library software. Or, she said, the software should be more securely set up.

Davis School District did not provide its perspective on the situation when the Tribune asked, including whether or not officials believe the access the parent volunteers were provided amounted to a privacy law violation.

The district gives its librarians broad authority over volunteers, allowing them to assign tasks at their discretion, according to the district’s media center guidelines.

Librarians are required to attend “required district trainings to remain current with library media trends and resources,” though there are no such training requirements for library volunteers.

District policy also doesn’t require that volunteers be trained. However, the district does direct all employees and volunteers to “maintain appropriate confidentiality pursuant to federal and state law.”

Employees and volunteers have “a responsibility to protect confidential student information” and should “access records only as necessary,” district policy states. Both parties are also prohibited from sharing passwords “for electronic maintenance of student records.”

Harris said student checkout records are generally considered private because they can indicate deeply personal things. A queer student, for example, may check out books that offer guidance about coming out to loved ones, she said. It’s why she believes the records should be protected.

The Utah State Board of Education also confirmed checkout records are considered educational records in Utah and protected under FERPA.

“They may also be protected under Utah’s student data privacy statutes and corresponding board rules when they are linked to an identifiable student,” Bartlett, a USBE spokesperson, said.

He noted that while the state school board does not have a rule specifically governing the level of system access that school library volunteers may have, schools should ensure that “volunteers are given the minimum access necessary to perform assigned tasks and are appropriately supervised.”