FPF Comments on the FTC and Department of Education Student Privacy and Ed Tech Workshop
On Friday, November 17th, 2017, the Future of Privacy Forum filed comments with the Federal Trade Commission and the Department of Education in conjunction with their upcoming workshop, to be held on December 1st. The workshop will examine the privacy issues inherent to the use of educational technology in schools, and consider the intersection of the Federal Educational Rights and Privacy Act (FERPA) and the Children’s Online Privacy Protection Act (COPPA). FPF’s comments are focused on two areas that merit additional clarity: 1) when schools’ consent to ed tech providers for data collection about students under thirteen years old is sufficient under COPPA; and 2) whether the rights and safeguards typically provided to parents under COPPA accrue to schools when administrators consent to data collection from young students. In our comments, we argue that schools should be able to provide consent for the use of ed tech tools when they will be used exclusively for educational purposes; and that when schools provide consent for the use of ed tech for educational purposes, COPPA rights and safeguards should accrue to the school.
While FERPA’s requirements for schools, parents, and ed tech providers are fairly clear, COPPA is ambiguous as to how schools may provide consent to the use of ed tech products in schools for children under the age of 13. Section M of the FTC’s FAQ on COPPA states that “schools may act as the parent’s agent and can consent to the collection of kids’ information on the parent’s behalf.” But this statement could be interpreted either as similar to FERPA’s school official exception, or as requiring that, since schools are acting as “the parent’s agent,” they must actively seek out parental consent before they can consent use of an ed tech tool. In some cases, ed tech providers have approached that ambiguity by attempting to shift the liability to the schools via contract, which often places a larger burden on the schools than is appropriate.
In many circumstances, it is appropriate that schools have the authority to provide consent for the use of ed tech products. Certain basic functions that require consent under COPPA would be thrown into disarray were the schools not able to provide that consent. Some schools could be unable to perform basic functions that rely on outside parties, such as operation of administrative information systems, and teachers could also be forced to design lesson plans around some students but not others. Parental consent to share student information is likely still appropriate for less integral functions, like using student information in the yearbook, or announcing the honor roll. When the school is permitted under COPPA to consent to an ed tech product being used, the rights that COPPA confers should also apply to a school, including any rights to control, access, review, and delete data. In some cases, providing parents with that right, while only providing the school with the right to consent on students’ behalf, could raise the specter of parents changing their childrens’ academic results; this would undermine the administrability and intergrity of some ed tech tools.
Increased clarity on FERPA and COPPA responsibilities for schools will allow for the responsible use of valuable and innovative ed tech products to assist students, and we look forward to discussing these issues further at the Student Privacy and Ed Tech workshop on December 1st.
