FTC announces a complaint and consent agreement against Chegg

FTC announces a complaint and consent agreement against Chegg

Since May 2022, education technology (edtech) companies have been on notice that the Federal Trade Commission (FTC) is closely monitoring the industry to ensure privacy protections for students in digital environments. The first of such enforcement actions arrived on October 31 when the FTC announced a complaint and consent agreement against  Chegg, a company that provides educational products and services for high school and college students. The Commission alleges that Chegg “failed to protect the personal information it has collected from its users and employees,” including students’ medical and financial data, as well as employees’ direct deposit information. The FTC’s May policy statement lists four focus areas for the Commission’s investigations n of edtech companies, including “Security Requirements,” noting that ed tech providers “must have procedures to maintain the confidentiality, security, and integrity of children’s personal information.” In this case, the Commission cited Chegg’s insufficient security practices as the basis for the complaint, noting the harms that resulted from the unauthorized disclosure of sensitive student and employee information. Notably, this is the second enforcement action focused on data security that the Commission has taken in the last month.

The Children’s Online Privacy Protection Act (COPPA) was not the basis for this enforcement action, so any consumer website that collects users’ personal information should take notice. Nonetheless, COPPA-covered edtech vendors do have heightened responsibilities, and the FTC cautioned in its policy statement that these companies may be found liable for unreasonable security practices even absent a breach. Accordingly, it is a good time to revisit the three other focus areas provided in the statement: (1) COPPA covered companies may not collect information from students beyond what is reasonably necessary to allow student participation, (2) they may only use the information to provide the online education service, and (3) they may not retain the information for longer than reasonably necessary to fulfill the purpose for which it was collected. 

While we do not yet know whether COPPA will form the basis for future actions, we do know that “the action against Chegg is part of the FTC’s aggressive efforts to ensure education technology companies protect and secure personal data they collect and do not collect more information than is necessary.”

 

Related Resources

  • What We're Reading

    Introducing…Student Privacy Compass!

    Jun 4, 2020

    Today, we are excited to announce our transition from the FERPA|Sherpa to Student Privacy Compass!When the Future of Privacy Forum launched FERPA|Sherpa in 201…

    Learn More
  • What We're Reading

    Student Privacy During the COVID-19 Pandemic: Resources

    Apr 2, 2020

    This webpage provides a list of student privacy and security resources for schools and educators seeking guidance on how to provide privacy-protective online l…

    Learn More
  • Advocate Perspectives

    Mental Health Rights

    Dec 2, 2019Kathy Flaherty

    I experienced my first mental health crisis when I was a student in college. I was depressed, anxious, and could barely leave my room to go to class. I would s…

    Learn More