Remote learning apps used in schools tracked kids’ data without their knowledge, report says

Miami Herald | By Sommer Brugal | Updated May 26, 2022

When the coronavirus pandemic upended traditional methods of delivering education, school districts across the country and the globe turned to online learning platforms.

It was a quick pivot. Miami-Dade County Schools, for example, switched from in-person learning to fully remote learning in a two-week time frame that overlapped with spring break, offering what many thought would be a temporary fix.

But many of the same platforms used to support teaching during what turned out to be nearly two years of at-home learning tracked students without their knowledge and shared that data with big tech companies like Facebook and Google, which could monetize the students’ information by selling ads to companies that targeted the children,according to a newly released report by the advocacy group Human Rights Watch.

In Miami-Dade Schools, nearly all the online education platforms used during remote learning did so, according to the report.

Researchers analyzed 164 educational apps and websites used in 49 countries, providing the most up-to-date understanding of how these technologies impacted students while they learned from home.

The findings were shared with 13 news organizations across the globe, including McClatchy, the Herald’s parent company. The investigative nonprofit the Signals Network coordinated the consortium, EdTech Exposed, in addition to overseeing additional reporting and review.

The report found that many or most of the online platforms used globally, including those used in Miami-Dade County Public Schools, did the following:

▪ “Monitored children, secretly and without the consent of their parents,” collecting data about them, their families and what they did in the classroom

▪ Installed tracking technologies that, over time, followed children’s’ activities outside of classrooms

▪ Allowed advertising technology companies to access children’s data, which, over time, could be sold to later “target them with personalized context that follow them across the internet [that] distorted children’s online experiences, but also threatened to influence their opinion and beliefs”

▪ Few apps made public how outside companies would use the collected information.

▪ The majority of products examined “did not offer data protections specific to children.”

Of the apps that were analyzed, the report found that nearly 90% were designed to collect and send students’ information to outside companies, such as Facebook and Google, researchers found. In total, students’ information was sent to nearly 200 advertising technology companies.

The report did not determine what data specifically was collected and shared, though it did show what data the apps were intended to collect and where it would be sent, which raises concerns.

“Put another way, children are surveilled in their virtual classrooms and followed long after they leave, outside of school hours and across the internet,” wrote Hye Jung Han, the report’s lead researcher.

MIAMI-DADE SCHOOLS USED MULTIPLE PLATFORMS

On March 13, 2020, at the pandemic’s onset, the Florida Department of Education required public schools to close for two weeks to help curb the spread of the coronavirus. Many districts, though, including Miami-Dade, remained closed for the duration of the school year.

During Miami-Dade’s first week of remote learning, which was the week before spring break, the district reported more than 850,000 logins (including duplicates) into learning platforms like Edgenuity and Edmodo, according to the district at the time. Other platforms, such as Zoom and Khan Academy were also used during the spring of 2020.

When the district returned for the new year in August 2020, however, it used the controversial K12 learning platform. But after a disastrous start of the school year, the School Board voted to cut ties with the platform and instead direct teachers to use Microsoft Teams and Zoom to teach their classes.

By the start of this school year, the district had added Schoology, which is used by roughly 70,000 students, according to Miami-Dade schools staff.

All but one of the platforms used by Miami schools — Edgenuity — were included in the global report and found to have posed a risk or violated students’ privacy rights. (A risk, as defined in the report, indicates an app having one Google analytics ad tracker.)

For Han, the lead researcher, the forced pivot to online learning “made it impossible for children to protect themselves by opting for alternative means to access their right to education.”

STEPS TO ENSURE PRIVACY

According to the report, Schoology is designed to collect a user’s unique online identifier, which is then used to build online profiles indicating what that individual may want to purchase.

A spokesperson for the app’s parent company, PowerSchool, disputed those findings, telling the consortium that “the Schoology app does not collect users’ advertising IDs. Per PowerSchool’s Privacy Policy (section I:C3.2), PowerSchool does not rent, sell, or otherwise provide access to student personal information to third parties for marketing or advertising purposes.”

For its part, district staff said, the School Board executed an agreement with PowerSchool, the app’s developer, that said it “will not rent or sell information for marketing purposes and will not share or sell customer data with third parties for marketing purposes,” staff said.

Nevertheless, the agreement did grant PowerSchool “permission to use, copy, and/or combine with any De-identified Data.”

For Schoology and other apps, the district underwent a “competitive procurement process” where the app or product was evaluated by technical staff, users and administrators, district staff told the Herald.

Moreover, the version of Schoology the district uses, staff said, is an “enterprise platform customized for Miami-Dade schools and is not a free version” of the app.

Still, the district has said it’s taken steps to establish safeguards for its students and teachers and that it will “continue to uphold the security and privacy standards expected of all contracted providers.”