Virtual learning apps tracked and shared kids’ data and online activities with advertisers, report says

Millions of students who participated in virtual learning during the Covid-19 pandemic had their personal data and online behaviors tracked by educational apps and websites without their consent and in many cases shared with third-party advertising technology companies, a new report has found.

Human Rights Watch, an international advocacy organization, this week published the findings of an investigation conducted from March 2021 to August 2021 that looked into the educational services, including online learning tools, used by students all over the world when school districts shifted to remote learning.

Of the 164 products reviewed across 49 countries, Human Rights Watch found 146 (89%) appeared to engage in data practices that “risked or infringed on children’s rights.” These practices included monitoring or having the ability to monitor children without the students’ or parents’ consent, and collecting a range of personal data, according to the report, such as their identity, location, their online activity and behaviors, and information about their family and friends.

“Children, parents, and teachers were largely kept in the dark,” Hye Jung Han, children’s rights and technology researcher at Human Rights Watch, told CNN Business. “But even if they had known what was going on, they had no choice. Children had to either use these products and pay for it with their privacy, or be marked as absent and drop out of school during Covid-19.”

Han said the majority of the apps and websites examined by Human Rights Watch sent information about children to Google and Facebook, which collectively dominate the digital advertising market.

A spokesperson for Facebook-parent Meta told CNN Business the company has policies around how businesses can share children’s data and advertising restrictions for how minors can be targeted. A Google spokesperson said it requires developers and customers to abide by data and privacy protections, and prohibits any personalized or marketing ads aimed at minors’ accounts. “We are investigating the specific report claims and will take appropriate action if we find policy violations,” the spokesperson said.

The report was shared with a consortium of more than a dozen international news outlets, including The Washington Post, The Globe and Mail, and El Mundo.

Albert Fox Cahn, founder and executive director of the Surveillance Technology Oversight Project and a fellow at the NYU School of Law, said the findings add to mounting concerns around the collection of data among young people. In recent months, there has been intense scrutiny from lawmakers about the impact tech platforms have on teens.

“We already knew technologies were being abused and putting children at risk, but this report is really important because it shows the scale of harm and how the same mistake is being made by educators and governments around the world,” he said.

Under the Family Educational Rights and Privacy Act, a US law, policies are in place to provide broad privacy protections for student educational records and protect them from invasive online tracking.

“But schools and tech firms are circumventing the laws we’re supposed to have that make it harder for advertisers to track students and minors online,” Cahn said. “Platforms that, through loopholes, can make students some of the most surveilled individuals on the planet.”

John Davisson, director of litigation and senior counsel for the Electronic Privacy Information Center, called the issue “a regulatory failure, pure and simple.” But he said he’s encouraged by the Federal Trade Commission recently warning edtech vendors about their obligations to protect children’s privacy.

Last week, the FTC announced plans to crack down on companies illegally surveilling children during online learning. “Students must be able to do their schoolwork without surveillance by companies looking to harvest their data to pad their bottom line,” said Samuel Levine, director of the FTC’s Bureau of Consumer Protection, in a statement. “Parents should not have to choose between their children’s privacy and their participation in the digital classroom.”

Bart Willemsen, an analyst at research firm Gartner who focuses on privacy issues, said schools and ed tech providers have a responsibility to be fully transparent about what they’re potentially doing with data, have detailed control over how it is used, and establish why the data is needed at all.

“The data must serve a purpose, but the purpose cannot be advertising,” he said. “If it is not something we do in physical classrooms, it is not something that should be part of digital school life.”

He also said the collection of this type of information could have a long-lasting impact on their children’s digital footprint, as that data is not easily erased. “Parents have a role here,” he said. “Yet in situations like these, their strongest action is to let their voice be heard.”