Good morning and happy new year! Thank you to all of you for your support of FPF’s work in 2019. As a quick recap, in 2019, FPF’s education privacy project:
- Released The Policymaker’s Guide to Student Privacy, School Safety & Privacy: An Animated Introduction, and the beginning of our series on applying FERPA;
- Collaborated with other organizations to draft and release the Principles for School Safety, Privacy, and Equity;
- Participated in the workshop and submitted comments in response to the FTC’s call for comments on the COPPA rule;
- Continued to serve as an active public voice on student privacy by speaking at or hosting 34 events; being quoted in 102 articles; and holding 6 bootcamps for edtech companies, district leadership, and educators, including our first recorded bootcamps.
We may have just ushered in a new decade, but many of the challenges and privacy trends we shared in our 2019 newsletters remain. Already, we’re seeing reports on new ways schools are tracking students in the classroom, wading through the more than 170,000 COPPA comments, and paying close attention to how colleges and universities are using beacon technology to monitor students’ movements around campus.
Catch the latest below, and feel free to contact the Future of Privacy Forum with questions or suggestions.
Anisha Reddy and Amelia Vance, Youth and Education Privacy Team, FPF
Top News
State legislative sessions have started in full force, and we’ll be keeping an eye out for education and child-related privacy bills; we just posted our comparison of child privacy in CCPA and the new Washington State bill here.
At the federal level, legislators are also keeping child privacy top of mind: on January 8th, Representatives Tim Walberg (R-MI) and Bobby Rush (D-IL) introduced a bill to amend COPPA to strengthen requirements to cover children under 16 (the current age is 13) and direct the FTC to study COPPA’s current “actual knowledge” standard.
- The bill would also require parental permission for sites to collect data from youth between 13 and 16, unlike California’s new consumer privacy law, (CCPA), which gives those rights to teens themselves.
- A previous bipartisan bill to amend COPPA was introduced in the Senate in March last year.
The FTC’s request for public comments on the COPPA Rule yielded 175,431 responses. FPF’s comments urged greater clarity around voice-enabled technology and the meaning of “actual knowledge,” and pointed out the need for better alignment with FERPA.
- 24 state attorneys general jointly called on the FTC to increase child privacy protections. Child advocates followed suit, asking for increased COPPA enforcement.
- YouTube asked the FTC to clarify how content creators can better comply with COPPA, and the FTC (and FPF) published specific information on COPPA for content creators.
- YouTube officially operationalized COPPA-compliant changes to the platform on January 6. Senator Markey commended the changes to the platform, finding the prohibition of “targeted, violent, unhealthy, and inappropriate advertising to kids on its main platform… a big win for the millions of families whose kids visit YouTube every day.”
Some school districts in Washington state are administering an unproven electronic “wellness” survey to students, and the results are available not only to school staff, but also sent (with “unique proxy identification code[s]” substituted for student names) to county employees to “gauge the students’ mental health” and “direct help to those who might be at risk for self-harm.”
- The data is also being “used for a study by Ph.D. researchers at Seattle Children’s Hospital, which created the screener, to test if the screening process actually works.”
- Both the survey itself and the initiative received broad criticism. According to one expert, “There hasn’t been any real conceptual and safety overview thinking about all the ramifications for how [the county] would use this data. There are no guardrails.’” (h/t Doug Levin)
With some news spilling over from the holiday break, we’ve seen significant media coverage on the ways K-12 and higher education institutions track students:
- The Boston Globe reported some schools are using headbands to monitor brain activity, velcro slippers with trackers to analyze how children move around the classroom and glasses that track eye movement.
- Colleges are providing students with smart speakers programmed to answer school-specific questions, and some even provide students with access to grade, enrollment, and financial information. A professor cautioned that “we simply have no idea what long-term effect having conversations recorded and kept by Amazon might have on [students] futures—even, quite possibly, on their health and well-being.”
- The Washington Post published an investigative piece on colleges that are monitoring student locations using beacon trackers. TeenVogue provides some insight into the student perspective: “Due to the secrecy of the [monitoring] program, the students were very angry and surprised. The opt-out process was hidden by the administration in a link in an email. The email was buried under a bunch of other unimportant university emails.” In another story, the Washington Post reported schools are experimenting with students using fitness trackers instead of in-person gym classes.
- Portland schools continue to discuss deploying body cameras on school resource officers, but concerns over ownership of the recordings have stalled the conversation; the school board would like to maintain ownership, while the police department believes department policies are sufficient.
- Open records requests revealed how different New Jersey school districts choose to filter online content.
- A Florida school district is considering installing vape sensors in school bathrooms. In addition to monitoring for smoke, the sensors raised privacy concerns for parents and privacy groups since they also may connect “with the school’s security cameras and detecting increased audio levels such as glass breaking, gunshots and shouting.” School districts in at least three other states (Ohio, Illinois, and New Jersey) have already implemented similar sensors.
FPF’s Brenda Leong testified before the House Oversight Committee about facial recognition on January 15, some of which touched on school safety issues. More information about the Oversight Committee’s hearing here.
Two college student organizations, Fight for the Future & Students for Sensible Drug Policy have launched a campaign to stop the use of facial recognition on college campuses. There has also been a flurry of articles about the use of facial recognition technology in schools, with particular focus on New York’s Lockport School District (these articles have some helpful background on the controversy):
- The New York Civil Liberties Union formally requested the Education Department rescind its approval of the system, citing privacy concerns.
- Several media outlets across the country (one even in Canada) have picked up the news, indicating widespread interest and concern over the use of facial recognition in schools.
- FPF previously wrote to the NY state legislature in support of a moratorium on facial recognition technology in schools in response to a bill that passed the NY Assembly (but ran out of time to be heard in the NY Senate in 2019).
- District Administration reports that Lockport isn’t the only school district piloting facial recognition programs. Vox’s Recode reports that some schools are implementing “appearance search” technology–not quite facial recognition–that presents pressing (and similar) privacy concerns.
FYI
- U.S. and EU privacy enforcement agencies will be looking at children’s privacy in 2020, reports Bloomberg.
- A bipartisan K-12 cybersecurity bill was introduced in Congress on December 16. The bill calls on DHS’s Cybersecurity and Infrastructure Security Agency to study K-12 cybersecurity risks and develop a cybersecurity toolkit for schools.
- The U.S. Department of Education and the U.S. Department of Health and Human Services released updated joint guidance on the intersection of FERPA and HIPAA.
- Everyone should read Audrey Watters’ article The 100 Worst Ed-Tech Debacles of the Decade. Whether you agree with her viewpoint and analysis or not, it is an excellent view into why many student privacy advocates tend to be skeptical and pessimistic about edtech.
- NPR’s Anya Kamenitz asks, “Does keeping kids offline breach their human rights?” in an article from MIT Technology Review.
- To meet an increased demand for mental health resources, more than 150 colleges are encouraging students to use mental health apps.
- Parents who purchase smartwatches to track their child’s location should be wary: researchers found that a cloud platform used to host the location data (as well as voice data, if the watch has voice capabilities) captured by several such smartwatches are exposed to significant security vulnerabilities.
- Universities are introducing voice technology on campus in various ways, ranging from giving students Echo Dots to implementing chatbots to help prospective students with the college application process.
Highlighted Resources
- ICYMI: On January 10th, FPF held a webinar on child privacy as part of our Privacy Legislation 101 series. You can watch the recording and see resources on the topic here.
- ICYMI: On January 13th, FPF’s Amelia Vance participated in TechFreedom’s event “Will Kids’ Privacy Crackdown Break the Internet? The Children’s Online Privacy Protection Act (COPPA) Rule.” Watch the livestream here.
- The FTC released a list of questions to consider when purchasing connected toys.
- Educators for Excellence released their 2020 teacher survey: “Voices from the Classroom.”
Recess
The New York Times Privacy Project published an imaginative fictional piece on the dangers of classroom surveillance.
Interested in staying updated? Subscribe to our newsletter here.
