Google companies

Edtech firms are breaking UK data laws, privacy campaigners claim

Edtech companies are breaking UK data laws, leaving children’s data vulnerable to commercial exploitation, privacy campaigners claim, as free distance learning software that has been adopted by schools during the pandemic are under intense scrutiny.

An investigation by children’s digital rights charity 5Rights is presented to the Information Commissioner’s Office and the Department for Education on Wednesday, highlighting the policies of popular edtech products Google Classroom and ClassDojo.

The research conducted an experiment on how school children interacted with Google Classroom, revealing how data was tracked by third parties and Google when the user clicked on external links. This data may be used to infer preferences and deliver personalized advertisements.

Both companies have opaque privacy terms which are incompatible with UK data protection law and confusing for teachers, he argued.

The research comes as European governments seek to limit the use of Big Tech in educational environments: parts of Denmark and Germany have banned the use of Google products in schools.

The Dutch data protection authority last year threatened to ban Google’s Chromebook laptops and educational software for failing to protect children’s privacy. Google changed its terms of service in the Netherlands and renegotiated its school contracts.

Edtech, or educational technology, has been widely adopted by schools during the pandemic, but the rush to remote learning meant the implications of using free software designed by Big Tech companies were not properly considered or regulated, activists say.

“The pandemic has both shown the usefulness of technology but simultaneously exposed the lack of surveillance,” said Lady Beeban Kidron, president of 5Rights.

Kidron came up with the UK’s age-appropriate design code, known as the Children’s Code, which was introduced in September last year. This forces technology companies to prevent children’s data from being used for marketing and advertising messages.

Violations of this regulation and the EU General Data Protection Regulation can result in a potential fine of up to 4% of global turnover for companies.

“It’s great to have distance learning platforms, but that doesn’t mean it’s free for everyone. A child’s search terms or browsing history can be used to target them with commercial products, and that’s not good,” Kidron said. “Rather than being unwanted in our schools, [tech companies] should be visitors with rules.

The analysis of the platforms’ terms of use means that schools are considered data controllers and responsible for protecting the privacy of their students. But the report says schools lack the understanding or resources to manage, review or fully perform these functions when this software is in place, due to the opaque wording of the terms.

The government should require edtech providers to clearly, publicly and transparently disclose the nature of the data collected and used on children, with regular independent audits, the report argues.

The ICO said it was interested in any evidence of non-compliant edtech.

“The relationship between edtech providers and schools is complex and we have provided tools and resources to support schools and education organizations across the UK,” he added.

On Google Classrooms, children’s data is collected if they click on an external link to Google services such as YouTube or Maps, to serve ads and collect data that could be used in future advertisements or personalizations.

This practice is common in courses, the research claims, and users are not notified that they are leaving an anonymous data environment. However, teachers can choose to prevent access to external sites.

“Google’s services for schools are governed by clear privacy policies and incorporate sophisticated security and encryption technology,” Google said.

Schools using Google services own and control their data, he added, and said data collected in the Google Classroom interface was not used for ads.

ClassDojo is a platform where teachers can grade children’s performance and behavior on an app shared with parents. The platform makes money by charging for additional features. The report argues that this could lead to discrimination and affect children’s records.

ClassDojo said it was fully compliant with data privacy laws and student comments were automatically deleted after one year.

Additional reporting by Bethan Staton in London