Edtech companies are breaking UK data laws, privacy campaigners claim

Edtech companies are flouting UK data laws and leaving children’s data vulnerable to commercial exploitation, privacy campaigners claim, as free distance learning software launched by schools during the pandemic comes under scrutiny.

An investigation by children’s digital rights charity 5Rights will be presented to the Information Commissioner’s Office and the Department for Education on Wednesday, highlighting the policies of popular edtech products Google Classroom and ClassDojo.

The study conducted an experiment that tracked how schoolchildren interacted with Google Classroom and revealed how third-party and Google data was tracked when the user clicked on external links. Preferences can be derived from this data and personalized advertising can be placed.

The two companies have opaque data protection rules that are incompatible with UK data protection law and confusing for teachers, she argued.

The research comes as European governments try to limit the use of Big Tech in educational institutions: Some regions in Denmark and Germany have banned the use of Google products in schools.

The Dutch data protection authority last year threatened to ban Google’s Chromebook laptops and educational software for failing to protect children’s privacy. Google has changed its terms of service in the Netherlands and renegotiated its school contracts.

Edtech, or educational technology, has been widely embraced by schools during the pandemic, but the rush to distance learning has meant the impact of using free software developed by big tech companies hasn’t been adequately accounted for or regulated, activists argue.

“The pandemic has demonstrated the usefulness of the technology, but at the same time exposed the lack of oversight,” said Lady Beeban Kidron, chair of 5Rights.

Kidron proposed the UK’s age-appropriate design code, known as the Children’s Code, launched last September. It forces tech companies to stop children’s data from being used for marketing and advertising messages.

Violations of this and of the EU General Data Protection Regulation can be punished for companies with a possible fine of up to 4 percent of global sales.

“It’s great to have distance learning platforms, but that doesn’t mean it’s free for everyone. A child’s search terms or browsing history could be used to target them with commercial products, and that’s not good,” Kidron said. “Instead of being unwanted in our schools, [tech companies] should be visitors with rules.”

Analyzing the platforms’ terms of service means that schools are considered data controllers and responsible for protecting the privacy of their students. However, the report claims that due to the opaque wording of the terms, schools do not have the understanding or resources to fully manage, audit or comply with these obligations when this software is in place.

The government should require edtech vendors to clearly, publicly and transparently disclose the types of data collected and used about children, with regular independent audits, the report argues.

The ICO said it was interested in evidence of edtech breaking the law.

“The relationship between edtech providers and schools is complex and we have provided tools and resources to support schools and educational organizations across the UK,” it added.

Google Classrooms collects data from children when they click on an external link to Google services such as YouTube or Maps to serve ads and collect data that could be used for future advertising or personalization.

This practice is common in the classroom, research claims, and there’s no warning to users that they’re leaving an anonymous data environment. However, teachers can prevent access to external websites.

“Google’s services for schools are subject to clear privacy policies and have sophisticated security and encryption technology,” Google said.

Schools using Google services own and control their data, she added, saying the data collected within the Google Classroom interface is not used for ads.

ClassDojo is a platform that allows teachers to assess children’s performance and behavior in an app shared with parents. The platform makes money by charging for additional features. The report argues that this could lead to discrimination and affect children’s records.

ClassDojo said it was fully compliant with privacy laws and student feedback was automatically deleted after a year.

Additional reporting from Bethan Staton in London

Comments are closed.