FTC announces a complaint and consent agreement against Chegg

FTC announces a complaint and consent agreement against Chegg

Since May 2022, education technology (edtech) companies have been on notice that the Federal Trade Commission (FTC) is closely monitoring the industry to ensure privacy protections for students in digital environments. The first of such enforcement actions arrived on October 31 when the FTC announced a complaint and consent agreement against  Chegg, a company that provides educational products and services for high school and college students. The Commission alleges that Chegg “failed to protect the personal information it has collected from its users and employees,” including students’ medical and financial data, as well as employees’ direct deposit information. The FTC’s May policy statement lists four focus areas for the Commission’s investigations n of edtech companies, including “Security Requirements,” noting that ed tech providers “must have procedures to maintain the confidentiality, security, and integrity of children’s personal information.” In this case, the Commission cited Chegg’s insufficient security practices as the basis for the complaint, noting the harms that resulted from the unauthorized disclosure of sensitive student and employee information. Notably, this is the second enforcement action focused on data security that the Commission has taken in the last month.

The Children’s Online Privacy Protection Act (COPPA) was not the basis for this enforcement action, so any consumer website that collects users’ personal information should take notice. Nonetheless, COPPA-covered edtech vendors do have heightened responsibilities, and the FTC cautioned in its policy statement that these companies may be found liable for unreasonable security practices even absent a breach. Accordingly, it is a good time to revisit the three other focus areas provided in the statement: (1) COPPA covered companies may not collect information from students beyond what is reasonably necessary to allow student participation, (2) they may only use the information to provide the online education service, and (3) they may not retain the information for longer than reasonably necessary to fulfill the purpose for which it was collected. 

While we do not yet know whether COPPA will form the basis for future actions, we do know that “the action against Chegg is part of the FTC’s aggressive efforts to ensure education technology companies protect and secure personal data they collect and do not collect more information than is necessary.”

 

Related Resources

  • Student Perspectives

    As Personal as Data Gets: The Privacy Implications of Wearable Technologies in Schools

    Jul 15, 2020Alexis Shore

    As workplaces and schools consider how to reopen safely, some organizations are looking to wearable technology to monitor health and activities. For example, t…

    Learn More
  • Advocate Perspectives

    The74: What Should Kids (and Parents) Know About Student Data and Online Testing? Some Suggestions From a Privacy Advocate — and Mom

    Jun 22, 2020

    Future of Privacy Forum contributor Olga Garcia-Kaplan recently contributed an opinion piece to The74 about the privacy implications of virtual proctoring and …

    Learn More
  • What We're Reading

    Introducing…Student Privacy Compass!

    Jun 4, 2020

    Today, we are excited to announce our transition from the FERPA|Sherpa to Student Privacy Compass!When the Future of Privacy Forum launched FERPA|Sherpa in 201…

    Learn More