In light of increasing concerns about surveillance, higher education institutions (HEIs) cannot afford a simple paternalistic approach to student data. Very few HEIs have regulatory frameworks in place and/or share information with students regarding the scope of data that may be collected, analyzed, used, and shared. It is clear from literature that basic opting in or out does not sufficiently address many of the complex issues in the nexus of privacy, consent, vulnerability, and agency. The notion of vulnerability (institutional and individual) allows an interesting and useful lens on the collection and use of student data. Though both institutional and individual vulnerability need to be considered, this paper focuses specifically on "student" vulnerability. In this conceptual article, we explore student vulnerability in the nexus between realizing the potential of learning analytics; the fiduciary duty of HEIs in the context of their asymmetrical information and power relations with students; and the complexities surrounding student agency in learning analytics. This article expands on an earlier framework developed by Prinsloo and Slade (2015). It aims to explore ways to decrease student vulnerability, increase their agency, and empower them "as participants" in learning analytics--moving them from quantified data objects to qualified and qualifying selves.