Illustration: Sarah Grillo/Axios
The shift to online schooling is running roughshod over children's privacy rules and rights, experts say, and creating new inequalities.
The big picture: Minors are the only group that enjoys federal online privacy protections in the U.S., but that's not enough to protect their privacy rights as school districts and teachers scramble to move all classwork to the internet amid the pandemic.
Why it matters: These rules aren't just technicalities. If companies don't maintain rigorous data security and privacy practices, children’s personal information, photos and video could end up in the wrong hands.
What's happening: "We're trying to take brick-and-mortar school and shove it onto the internet, and the two things just aren't compatible," Karen Richardson, executive director for the Virginia Society for Technology in Education, told Axios.
- "Even the most dedicated parent or educator is going to have a really hard time figuring out what's actually happening with their students' data," Josh Golin, executive director of the Campaign for a Commercial-Free Childhood, told Axios.
One key problem is that the pandemic is porting educational inequalities online.
- Richer school districts can employ people to deal with privacy and cybersecurity compliance, choosing the apps and other digital products that best protect students and their data. Poorer school districts can't.
- "For under-resourced school districts, it's unlikely someone will have the time and expertise to make evaluations" about which educational tech products are best, said Golin.
The divide is particularly acute because much ed tech, a niche product category, already stacks up poorly to consumer tech from major firms when it comes to data privacy and security.
- "Most products are created to be easy to use," Amelia Vance, director of youth and education privacy at the Future of Privacy Forum, told Axios. "They're not created to have a gate to keep dangerous people out, or to keep students from causing mischief."
At the same time, teachers are busy and not always trained in technology and student privacy. That means they may be making snap judgments that compromise their students' privacy without even realizing it.
- Many districts, to be sure, have signed contracts to use software that's been widely vetted as secure. But in some cases, teachers decide what programs to use in their classrooms without first clearing them with the district.
- A 2018 survey from Common Sense Media found only 25% of teachers who participated in professional development on ed tech got trained in student data privacy requirements.
Background: Despite the concerns, the federal law protecting kids' privacy only goes so far.
- The 1998 Children's Online Privacy and Protection Act only covers children up to 13 years old. In early April, the FTC put out coronavirus-specific COPPA guidance.
- COPPA doesn't tell schools what to do. Rather, it limits how websites and online services can use kids' data, giving parents control over whether their children's information is collected. Schools can consent for data collection on parents' behalf, but only for non-commercial purposes.
Yes, but: FTC enforcement of COPPA has been "woefully insufficient," with the agency failing to act against widespread violations, the Campaign for a Commercial-Free Childhood's Golin said.
- The FTC has taken some action against major companies. Google and YouTube paid a record $170 million to settle allegations of violating the law by collecting personal information from children without parental consent. But there are many educational tech companies, and the FTC has limited time and resources — as do districts themselves.
- "School districts have so much on their plates right now that it is understandable, but certainly concerning, that student privacy and COPPA compliance may not be front of mind," Golin said.
Plus: If teachers want to record classroom sessions, that could run afoul of the law, too, Brad Shear, a privacy and tech attorney in Bethesda, Maryland, told Axios.
- Maryland, for example, is an all-party consent for recording state, so students are able to opt out of being recorded.
The bottom line: Privacy advocates say it's time to take concerns seriously. "There was a sense in the spring, we were in a sprint, just trying to survive," Golin said. "Now that we sense this is a marathon, not a sprint, this stuff needs to be much more important. We can't cut corners on privacy."