Passed in 2014 and effective starting in 2016, Californias Student Online Personal Information Protection Act (SOPIPA)33 aims to improve privacy and security for student educational records. Ed techs growth is also closely tied to newer market and policy forces. The law prohibits a company from engaging in targeted advertising on its own website or any other website when the targeting of the advertising is based upon any information, including covered information and persistent unique identifiers, that the operator has acquired from a students use of the website. In addition to teaching within the library, share resources with teachers to encourage reinforcing digital privacy lessons across classes and curricula. Giving parents and students the option to opt out of classroom technology use is a necessarybut not sufficientcomponent of protecting student privacy. b. Tracking helps Black students, but it does very little for other minority groups. The school or district should not sign students up for any service without getting explicit permission from their parents. Check out our 4-star rating on Charity Navigator. Jeff went through several emails and a tense meeting before the district agreed to provide Katherine with a non-Google option for fourth gradebut once again declared that such an accommodation would not be possible for fifth grade. Our legal team drafted a letter to the district to outline the privacy concerns associated with school-issued Chromebooks. Lexia Learning requires that students and parents contact the school administrator to facilitate requests to access, change, or delete personal information. I dont feel like I should have to take the word of the school on this. That adds up to a whopping 70 percent of surveyed parents who did not perceive options or alternatives for their childrens education. Whether they do or not is another question, but as they own the laptop, they could be liable for illegal actions made through it, so I would assume that they behave the same that corporate admins behave with corporate laptops: . Click the Startup tab and then click Open Task Manager . While this paper focuses on U.S. policy and practices, the geographical variety of survey responses serves as a reminder that ed tech companiesalong with the services they offer and the privacy issues they poseare global. Prepare teachers and other staff to provide educationally comparable alternative assignments and activities for students who choose to opt out. This argument is based on an incorrect assumption: that only bad people or people who broke the rules or the law want privacy. While we cannot address them all, they provide valuable context and deserve acknowledgement. However, compartmentalized curricula are not enough to transform the way students interact with technology; it has to be reinforced across subjects throughout the school year. Its your privacy, not theirs. In assessing this ** This post is one section of a more extensive piece on Brazils platform accountability and regulation debate. Any time a local or regional board of education plans to share student data with a service provider, the board must enter into a written contract with the service provider. Be a resource for selecting ed tech tools. Lock down privacy settings. These respondents are not alone. The notice and disclosure process is broken. For Jeff, the biggest concern isnt just the data Google collects on students. Student dataor, more broadly, data collected on students in the course of educational activities at school, at home, and elsewheremay interact with advertising, drive inferences and profiles about individual students, or be shared with third parties. The difficulty of putting opt-out into practice can come from the additional burden it puts on administrators and teachers who have adopted increasingly digital pedagogical systems. Attend a Parent Teacher Association (PTA) or equivalent meeting together and raise your concerns. 3 Ask to opt out or use an alternative technology when you do not feel comfortable with the policies of certain vendors. The contract should also clarify the interaction between its terms and the companys general Terms of Service and Privacy Policy. Eric and his colleagues have taken several steps to protect students and support teacherschief among them providing a strong opt-out system. This dangerous bill would threaten security and free speech on the internetbut incredibly, it may pass Congress without even being seriously debated. The Florida Board of Education approved a new set of standards for how Black history should be taught in the state's public schools, sparking criticism from education and civil rights advocates . Whether ed tech services are adopted top-down by large contracts with the administration or bottom-up by individual teachers in single classrooms, librarians can be a central resource for investigating their privacy risks. When people are constantly being watched, their behavior changes. In some cases, students took the investigation into their own hands. For such families, the common opt-out alternative of using a personal device rather than a school-issued device is impossible. You can change your overall location-tracking preferences in your system settings, but this may not turn off location tracking completely. However, they come with real costs and unresolved ethical questions.4 Throughout EFFs investigation over the past two years, we have found that educational technology services often collect far more information on kids than is necessary and store this information indefinitely. Make related materials accessible in a one-stop shop for various stakeholdersparents, teachers, administrators, and studentsto review all terms of service, privacy policies, and other digital privacy-related information. Respondents came from 45 states, Washington D.C., and Guam, as well as from 17 other countries around the world. While there are many steps you can take to protect your privacy on your own, the real protection comes when we protect each others privacy as a group. As our recommendations outline, parents, students, and school staff can take effective action to advocate for and raise awareness about student privacy. Choose a state on the map to show the different bills targeting LGBTQ rights and take action. Detracking in K-12 Classrooms. It should be clear to the parents and students which entity each document pertains to. Finally, (8) students need enhanced digital literacy education to take control of their privacy in the classroom. What are the privacy practices of those entities? It comes down to this: what do you want to protect? As a result, service providers should exercise extreme caution before following the suggestions in the Department of Education's guide. Tracking - grouping students by ability into different classrooms, or different schools - is a common, but often contentious, practice at all levels of education. Developed by the Future of Privacy Forum (FPF) and the Software & Information Industry Association (SIIA) in the fall of 2014, the Student Privacy Pledge is intended, in its own words, to safeguard student privacy regarding the collection, maintenance, and use of student personal information.18 While its not a law, the Student Privacy Pledge is indeed designed to be legally enforceable by the Federal Trade Commission (FTC), which may bring enforcement actions against companies that make but then break public promises. Teachers own digital literacy and privacy training is often overlooked when new ed tech services are introduced to the classroom. They learn not to trust online public spaces.. In this day and age, where children are often more technologically savvy than their parents, such laws may seem an anachronism. In 2016, Colorado passed the Student Data Transparency and Security Act (SDTSA)34 to improve protections for student personally identifiable information (PII). Lastly, see if the district or school officials can propose other solutions to your concerns. Ask the right questions. Avoid using school devices, accounts, and networks for personal activity. Encryption is crucial to protect sensitive student information from eavesdropping, and encrypting data in transit is widely recognized as absolutely necessary for even a minimal level of security. At both the state and federal level, tighter legislation is needed to close loopholes and give school districts the structure and resources necessary to provide transparency and choice to students and their families. In December 2015, the Electronic Frontier Foundation started a campaign to raise awareness about the risks to student privacy when companies collect students data. COPPA requires companies to obtain verifiable parental consent29 before collecting personal information from children under 13 for commercial purposes. Do not track students online behavior to create a profile on them, even when they navigate away from core educational services. Surveillance isnt normal, and it isnt okay. The district/school (Select all that apply. The federal definition also includes other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty. While the Pledge presumably was not intended to run counter to federal law, FERPA applies only to schools that receive federal funding, not to all schools across the country.22. For Haiku Learning, the schools, rather than individual students, retain the authority and ability to delete information from the application. Once they complete those classes, they finish their last two years . The best way to sharpen your expertise and protect your students is to enhance your own professional privacy knowledge. While EFFs focus has been on ed tech companies policies and practices rather than those of schools, it is important to highlight that school privacy policies and their implications change once ed tech is in the picture. Because the Terms of Service may change without notice, schools and districts should regularly re-read the terms to be aware of any relevant changes. You may also want to review your current followers to make sure you know and trust them. The law requires the states Department of Education to identify training resources and make them available to school districts, a crucial step toward ensuring long-term protection for student privacy. What kind of devices, applications, and other technology are being used to teach your child? Parents were also conscious of the possibility that their childrens data would be shared, sold, or otherwise commodified in the untapped industry of selling students information for advertising and profiling. The details were generally unclear, as school privacy policies said not a word about how our kids learning is essentially becoming Googles data. One Maryland parent wrote: The school system does not even acknowledge that our childs data is being collected and possibly sold. SOPIPA was the first attempt to regulate ed tech companies, and several other states have passed student privacy acts that track and expand on SOPIPA in their own states. The Family Educational Rights and Privacy Act (FERPA) is a federal law that applies to districts and schools that receive federal funding. Schools in Texas, Illinois, Wisconsin, Missouri and California have been testing out pilot programs that track students on campus through a device placed in their student identification card. Does the vendor give advance notice when it changes its data practices? Here are counterpoints you can use to push back against surveillance culture and help others understand the harm it does. Its easy to do an all or nothing, but I dont think its the right thing to do, Eric said. Industry self-regulation like the Student Privacy Pledge does not go far enough to remedy such loopholes. By limiting the definition to data to that is both collected and maintained on an individual level and linked to personally identifiable information, the Pledge seems to permit signatories to collect sensitive and potentially identifying data such as search history as long as it is not tied to a students name. 4. Oops something is broken right now, please try again later. We distributed an online survey on student privacy via EFFs website, blog posts, the EFFector newsletter, and social media between December 2015 and January 2017. Together, our survey testimony and legal analysis offer a user-focused approach to defining the problems and risks around student privacy, particularly lack of transparency, lack of choice, and a technical landscape that has outpaced legal safeguards. Instead, the survey results and case studies are meant to shed light on the human side of student privacy: the attitudes, perceptions, and types of individual concern and awareness that shape action around student privacy on the ground. Author: u/Xjanex98 Title: Is it legal for a university to track your IP address despite you wishing to remain anonymous? Hold a discussion group for a small group of parents. Here, again, Biden is moving forward with a forgiveness plan broader than anything . As technology becomes more and more baked into lesson plans and day-to-day teaching, it can be difficult for students or teachers to function without using school-issued devices or ed tech programs. UK warns Russia could target civilian ships in Black Sea The UK has warned that Russia could move to target civilian ships in the Black Sea, following the collapse of the crucial grain deal . After an introduction to EFFs approach to student privacy, we turn to our analysis. One California public school used students birthdates as passwords. A provider of a product that is marketed for and deployed in classrooms but was not necessarily designed for educational purposes is outside the Pledge. In some cases, student data is reported to school resource officers or the police, and it can be kept over time, creating a granular history of a students actions. Educational leaders must understand how to support their educational success by addressing their unique challenges. Some applications note that schools may implement their own privacy policies to govern personal data submitted to the services by student users. This privacy-implicating information goes beyond personally identifying information (PII) like name and date of birth, and can include browsing history, search terms, location data, contact lists, and behavioral information. Conduct privacy audits, both within the library and in the schools or districts larger ed tech ecosystem. Please check your email for a confirmation link. Thanks, you're awesome! Lets use an example scenario to explore how this could happen: Youre socializing with friends from your school, and some who go to other schools. Original Post: I have been using a fake email address to send emails to the tutors in my class regarding another student. One parent from an Arizona private school wrote, simply: Opt-out is possible in theory, but not in practice. Educate staff, colleagues, teachers, and decision makers about student privacy. Consider carefully how the school or districts AUP connects with the privacy practices of the ed tech provider. Worse, some parents found that their students participation in classroom technology continued even after they thought that had effectively opted out. Usually this requires very specific contract terms between the district and the company. This mission is executed through the enforcement of more than 400 federal statutes and focuses on smart immigration enforcement, preventin Track elected officials, research health conditions, and find news you can use in politics . 12. Telling Immigration Stories and Stories of Resilience. He negotiated with his daughters teacher so she could use a different computer and not have to use a Google account. Today, the Electronic Frontier Foundation (EFF) launched a new Surveillance Self-Defense guide for students and their parents, so they can learn more about how schools are watching them, and how they can fight back. The law contains a nonexclusive list of terms that the contract must contain, including a statement that student information does not belong to the service provider, a description of means through which the board may request deletion of student information, and a statement that the service provider will ensure the security and confidentiality of student information. Dont accept Terms of Service when you can get a contract. If it is able to revise this policy, it will be the . [If Other] What other devices were issued by your district/school? c. White middle-class students are more likely to be tracked up, while poorer students and students of color are more likely to be tracked down. 13. Since 2015, EFF has been taking a closer look at whether and how educational technology (or ed tech) companies are protecting students privacy and their data. Some companies may even sell this data or share it with third parties. You and your friends might be attending an LGBTQ+ event when the photo was taken. From there, the survey snowballed out, with respondents encouraged to share the survey link with others. But this did not lessen Matts concerns. Traditionally, a child is considered legally an adult at 21, but each state is free to legislate that limit to be 18 or some other number, and free to set it differently for different things. (Select one. Tracking is separating students by academic ability into groups for all subjects [1] or certain classes and curriculum [2] within a school. Instead, these numbers characterize the environments of our respondents, who overwhelmingly experienced a lack of transparency and lack of choice with regard to student privacy. Sometimes, parents did not receive any information about ed tech use until after the technology had already been implemented and was in active classroom use. Thats known as the chilling effect. Students need space to experiment and learn without being monitored and recorded by their schools at every turn., School discipline disproportionately targets students of color, and its reasonable to think that additional, and more comprehensive scrutiny of their lives will only add to that injustice. youre only monitored on campus), a lot of the information can leak between your personal and school life through your Internet activity or the devices you use. More. They sell ads, they track information on folks. Closing the skills gap for teachers is crucial because well-trained, informed staff are necessary to move beyond privacy by policy and implement verifiable, accountable privacy by practice. One of the biggest problems with privacy by policy is that it relies on all staff members being up-to-date on complex, sometimes vague policies, and having the time and resources to comply with them consistently. If you change your own tools and behavior, but your classmates dont, its more likely that information about you will be caught up in the surveillance they are under as well. Detracking means placing students with mixed abilities and academic achievement in the same classes. The quick answer is yes. Sometimes school districts use a loophole in the law to get around the parental consent requirement by characterizing ed tech companies as school officials. However, the school official exception28 is only applicable to a contracting company if specific conditions are met: The ease with which ed tech providers can take advantage of the school official exception described above prevents FERPA from going far enough to protect student data. Librarians have the training and experience to approach vendor relations and contract decisions with student privacy in mind. Get a seat at the negotiating table. Our narrow focus interacts with broader driving forces in ed tech. They simply mean that we heard the most about Google, and therefore are in a position to report the most stakeholder experiences with its products. Your friends who dont attend your school are now included in your schools surveillance system dragnet and dont know they have been surveilled. The U.S. Department of Education has published guidance for service providers to use learning analytics techniques to improve ed tech products.48 However, the guide ignores the privacy implications of using data analytics and readily acknowledges that a full discussion of privacy is beyond the scope of the document. Essentially, the guide assumes that data collection is a foregone conclusion, and doesn't begin to address the question of whether data should be collected in the first place, how to weigh the benefits and risks, how to get consent before collecting data, or how to manage the data once it's been collected. This means that Katherine is required by the school to use Google with a personalized Google account, and Google can create a profile of herthat is, a dossier of information that vendors collect on users for advertising, market research, or other purposesand use it for commercial purposes the moment she clicks away from G Suite for Education. This means its over 300 signatories19 have made what appears to be an essentially binding commitment to its 12 provisions. 3. One-third of all K-12 students in U.S. schools use school-issued devices.1 Google Chromebooks account for about half of those machines.2 Across the U.S., more than 30 million students, teachers, and administrators use Googles G Suite for Education (formerly known as Google Apps for Education), and that number is rapidly growing.3. Even the best policies and legislation are rendered toothless if staff members, administrators, and teachers are not equipped to implement them correctly.17, Parents overwhelmingly saw teachers and other school staff as unaware and non-expert in technology. Here we draw on our own interactions with ed tech stakeholders as well as the California Attorney Generals ed tech guidelines.47. FERPA, however, does not require schools to create or retain any such records. Getting student records for undocumented children. Transparency. But, soon after, discussions about abandoning local storage and migrating to Google Drive ran counter to Matts efforts to locally control students data. (See full survey in Appendix.). The best solutions for fighting back against surveillance dont need to involve a fancy tool or workaround. To learn more about how you can protect yourself, check out the rest of Surveillance Self-Defenses guides. Finally, the survey concluded with an open-ended question requesting any additional information respondents wanted to share, from which we collected the quotes that appear throughout the findings below. One public school parent in Pennsylvania wrote about their student accessing ed tech services on a personal device: I have no idea how to find out the extent of information they [ed tech providers] have access to on our personal computers. You might be doing political organizing for a cause, and if youre at a private or religious school, the school and/or your parents may not approve of it depending on the issue. A public school parent in Pennsylvania wrote: Teachers keep creating accounts for my child on cloud apps even though Ive asked the principal and teachers not to do this. Develop school and district-wide policies and procedures to evaluate proposed online service providers. Some programs upload this student data to the cloud automatically and by default. Data de-identification is almost exclusively mentioned in connection with providing information to third parties about their services, reporting on student performance in districts, or analyzing use of their services. Research and write about it in your school newspaper or other. Implementing a student GPS tracking system in your school should focus on safety first. We found a range of specific practices here, including: Of the 118 privacy policies we examined, only 46 state that the vendor uses encryption. It seems a lot of students dont care about privacy issues whatsoever. You turned off location tracking on your mobile device, but your friends havent. Parents should be given adequate time to review and consider all materials. Millions of U.S.-citizen children have undocumented parents and family members. Describe the different purposes for which various types of student data will be used. Data collection. Ask district or school officials to explain the process through which the current technology and policy was adopted, and how it might be changed. Generally, such weak credentials include personally identifiable information (such as student ID, first and last name, date of birth, etc. Take advantage of available settings and options in students devices and software to make sure they are as privacy-hardened as possible. What data are the technology providers and the school district collecting, respectively? You are only as protected as the least-protected person in your social group. Below, we outline specific recommendations and best practices. Are parents provided with written disclosures about data collection (such as a privacy policy)? Even in schools with opt-out policies on the books, families struggled to opt their children out of technology use. The problems with the Student Privacy Pledge are not in its 12 large, bold commitment statements, but in the fine-print definitions under them.20.