In this series, Privacy and Pandemics, the Future of Privacy Forum explores the challenges posed by the COVID-19 crisis to existing ethical, privacy, and data protection frameworks, and will seek to provide information and guidance to companies and researchers interested in responsible data sharing to support public health response. Previous posts include an FAQ on COVID-19 FERPA disclosures, corporate data sharing, the use of location data, and our list of COVID-19: Privacy & Data Protection Resources.
As school closures due to the COVID-19 pandemic sweep the country, administrators and educators are racing to provide online learning alternatives for their students. Though some of these alternatives include applications designed for educational uses, The Washington Post reports that educators are also using general audience services; teachers are hosting classroom sessions on Facebook Live and learning to use Instagram and TikTok to create resources for students.
While the idea of hosting classes on social media may sound engaging, many social media tools were developed for general audiences, not students, and are therefore unlikely to be compliant with student privacy laws and best practices. Providing lessons solely on social media also risks pressuring students to blur the lines between their academic and personal lives and excluding students who do not have social media accounts or who cannot stream videos due to limited internet connectivity.
Instead of turning to social media as an online learning solution, educators should carefully weigh the privacy and equity risks of using social media against the potential value to students, and determine whether any existing education technology (edtech) tools could meet the same objectives in more privacy-protective and equitable ways. Schools should create or highlight existing policies that teachers must follow related to the use of social media for online learning. And if those guidelines permit educators to use social media for online learning, the first step should be to obtain parental consent in order to keep the school in line with federal student privacy laws.
Legal Requirements
Student privacy laws, such as the federal Family Educational Rights and Privacy Act (FERPA) still apply to any online learning solutions adopted during the COVID-19 pandemic. Although schools, not companies, are subject to FERPA, most edtech companies are aware of these obligations and can help schools comply with the law. Social media platforms are not typically designed to help schools ensure FERPA compliance. EdTech companies are also often subject to state student privacy laws, while companies offering products to adults and general audiences are not.
FERPA prohibits schools from disclosing personally identifiable information (PII) from students’ education records without first obtaining written parental consent, subject to certain exceptions. FERPA’s definition of PII includes a host of information, including students’ grades, class schedules, class enrollment, and any information alone or in combination that is linked or linkable to students. This includes metadata collected by apps or services if the data can be used to identify students. FERPA also grants parents the rights to access their students’ education records and to seek correction of those records.
If classes are offered on social media platforms, students may need to log in to access and interact with materials posted, which would require the disclosure of FERPA-protected PII. Further, PII disclosed by a student on an online site or service at an educator’s direction would likely be considered FERPA-protected. FERPA protections would also likely apply if an educator creates an online classroom as a group on a social media site: creating the group could involve disclosure of PII under FERPA since the social media platform would have access to the class group and enrollment information based on the group members and class schedules based on user interactions, both of which could be FERPA protected PII.
The federal Children’s Online Privacy Protection Act (COPPA) also applies when students under the age of thirteen participate in many social media online learning initiatives. Unlike FERPA, COPPA applies to companies. COPPA regulates online service providers that are either directed to children under the age of thirteen or have actual knowledge that they collect, use, or disclose personal information from children under the age of thirteen. Any company regulated by COPPA must first obtain verifiable parental consent before collecting children’s personal information. A school may provide consent in lieu of a parent if the company uses students’ information solely for the benefit of the school and not for commercial purposes (e.g., using third-party trackers for advertising purposes is a commercial purpose). However, many social media platforms explicitly bar children under thirteen from participating on their platforms because, for example, the sites may monetize their products through advertising that involves sharing user data, or they may provide services or allow practices that may not be appropriate for young children.
If teachers use social media platforms for online learning despite the issues discussed above, educators should obtain parental consent. When asked for consent, parents should be fully informed about the platform, the information that educators will share with the platform, and the purpose of that disclosure. Parents must also be given the option to not consent, or later revoke their consent. If a parent does not provide consent, schools must provide the student with an alternative option. Access to education cannot be contingent on consent to the use of a specific tool.
Privacy Risks and Best Practices
As a best practice, schools should create policies regarding whether educators may use social media for online learning. If allowed, schools should require that parents be notified about if the information posted on these platforms will be accessible to the general public, how educators will evaluate their children for their participation on the platform, and how educators and schools will protect students’ FERPA rights with regard to students’ interactions with the platform. Schools also need to know exactly what data the platform collects, including metadata. In most cases, social media platforms built for a general audience routinely employ third-party trackers for advertising purposes, which would require parental consent under COPPA, not just school-provided consent.
Equity Risks
Educators should also consider the equity concerns underlying the use of social media for online learning. Many online learning initiatives adopted during this time will intensify the digital divide, as students with limited or no access to devices or internet connectivity could be cut off from educational services during the pandemic. Some features on social media platforms may be inaccessible to students who are vision-impaired or blind, which may unintentionally cause them to be excluded or disengaged from the classroom experience. Social media may also not be compatible with students’ Individualized Education Plans.
Moving online learning to social media platforms may also unintentionally merge students’ previously separate academic and personal lives. Students’ perceptions of how an educator factors information shared on their social media profiles into their evaluations or education record may limit how freely students engage with their online classroom. Students who do not already have accounts may feel pressured to create them. For some students, opting out of social media platforms may be a choice driven by necessity: US Immigration and Customs Enforcement (ICE) is known to surveil social media for undocumented immigrants. Moreover, students without a social media presence will not only feel like the odd one out, but they will also risk falling behind in classes or potentially missing the rest of their semester, depending on how long their school is closed.
Recommendations
Schools should create or highlight their existing policies on using social media for online learning. Educators should think critically about how they would use social media, its purpose and potential value to their classroom experience, and whether any pre-vetted educational tools would meet the same objectives. They should balance these considerations against the privacy and equity risks social media platforms pose to students. Although educators’ efforts to use online tools to maintain a robust education during this pandemic are admirable, they should not choose short-term familiarity or convenience over protecting their students’ privacy.
Resources from the U.S. Department of Education
- FERPA and Virtual Learning (one-page list of resources relevant to the current move to online learning)
- Protecting Student Privacy While Using Online Educational Services: Requirements and Best Practices
- Protecting Student Privacy While Using Online Educational Services: Model Terms of Service
- Data Security: K-12 and Higher Education
- FAQs on Photos and Videos Under FERPA
Other Resources
- FPF and ConnectSafely’s “Educator’s Guide to Student Privacy”
- Common Sense Media’s “Protecting Student Privacy on Social Media: Do’s and Don’ts for Teachers”
- NYC Department of Education’s Social Media Guidelines for Staff
- NCES’ “Forum Guide to Education Privacy,” pages 59-64
- Edutopia’s “How to Create Social Media Guidelines for Your School”
- Fagen Friedman & Fulfrost’s short “Ask Before You App” video
- District Administration’s “How to Create a K12 Social Media Policy”
- Fordham Law’s “Technology Security Checklist for Teachers”
