FTC announces a complaint and consent agreement against Chegg

FTC announces a complaint and consent agreement against Chegg

Since May 2022, education technology (edtech) companies have been on notice that the Federal Trade Commission (FTC) is closely monitoring the industry to ensure privacy protections for students in digital environments. The first of such enforcement actions arrived on October 31 when the FTC announced a complaint and consent agreement against  Chegg, a company that provides educational products and services for high school and college students. The Commission alleges that Chegg “failed to protect the personal information it has collected from its users and employees,” including students’ medical and financial data, as well as employees’ direct deposit information. The FTC’s May policy statement lists four focus areas for the Commission’s investigations n of edtech companies, including “Security Requirements,” noting that ed tech providers “must have procedures to maintain the confidentiality, security, and integrity of children’s personal information.” In this case, the Commission cited Chegg’s insufficient security practices as the basis for the complaint, noting the harms that resulted from the unauthorized disclosure of sensitive student and employee information. Notably, this is the second enforcement action focused on data security that the Commission has taken in the last month.

The Children’s Online Privacy Protection Act (COPPA) was not the basis for this enforcement action, so any consumer website that collects users’ personal information should take notice. Nonetheless, COPPA-covered edtech vendors do have heightened responsibilities, and the FTC cautioned in its policy statement that these companies may be found liable for unreasonable security practices even absent a breach. Accordingly, it is a good time to revisit the three other focus areas provided in the statement: (1) COPPA covered companies may not collect information from students beyond what is reasonably necessary to allow student participation, (2) they may only use the information to provide the online education service, and (3) they may not retain the information for longer than reasonably necessary to fulfill the purpose for which it was collected. 

While we do not yet know whether COPPA will form the basis for future actions, we do know that “the action against Chegg is part of the FTC’s aggressive efforts to ensure education technology companies protect and secure personal data they collect and do not collect more information than is necessary.”


Related Resources

  • Educator Perspectives

    A Conversation with Chris Hanson About Student Data Privacy

    Aug 11, 2020Juliana Cotto

    COVID-19 has placed districts, schools, and educators in unprecedented circumstances as they balance health concerns, academic responsibilities, and equity con…

    Learn More
  • What We're Reading

    Student Privacy, Special Education, and Online Learning: Navigating COVID-19 and Beyond

    Aug 6, 2020

    COVID-19 continues to disrupt education and has forced many schools to pivot to virtual, or online, learning for the fall semester. And virtual learning poses …

    Learn More
  • FPF Perspectives

    Advice Column: Assigning Students to Visit Websites

    Jul 27, 2020

    Got questions about student privacy issues? The Future of Privacy Forum’s new advice column connects you with subject matter experts to answer your most pressi…

    Learn More