A playground made for K-12 students. The study found K-12 students' data was being shared. (Clara Pierce)
A study by two BYU professors and Internet Safety Labs found educational apps were selling student data. This led to a Utah law enacted this year to increase privacy protections for students.It began when Jennie Earl, a member of the Utah State Board of Education, wanted to investigate how educational apps were using student data."As a state agency, we want to provide the greatest amount of information for local schools to make sure there's transparency for the work that's going on there," Earl said.
The BYU David O. McKay School of Education prepares future teachers. Many teachers learned how to incorporate technology in the classroom. (Clara Pierce)
"(Earl) was able to put the project up for a vote and secure funding for it," Keith said. "She gave us a grant and we hired another, Internet Safety Labs, to join us."BYU professors Mark Keith and Justin Giboney worked with Internet Safety Labs, a non-profit that does network traffic testing, and a team of student researchers over the course of several years to uncover how the data was being used. The study was called "Utah EdTech App Data Collection and Sharing: 2023-25 Investigation" and was done in partnership with the Utah State Board of Education.First, they spent a year finding what educational apps were being used in Utah schools. Then, they looked into how these apps were using student data.According to Keith, they found a variety of ways apps were approaching data privacy agreements. They found that the minority of the apps were not violating the agreements but at the other extreme, there were those who knew they were in violation and refused to respond. Most fell into a middle group that initially denied wrongdoing but eventually agreed to make changes."61% of apps are sharing data elements with third parties. And 36% are sharing data elements with advertisers," the study said. The types of data collected from students included birth date, gender, ethnicity, income status, medical health information, address and more. This information would then be sold to data aggregators and brokers."There are hundreds of different data brokers," Keith said. "They want to sell your data to anyone who's willing to bid for it, so they'll collect all of it about you."
A college student studies using a computer. Many college students have also been required to use certain educational apps for their learning. (Clara Pierce)
Regardless of whether or not individuals use a virtual private network, this gives companies the ability to target advertisements to hyper-specific audiences."Any website you go to, even if you're behind a VPN, they can still track your hardware," Keith said. "They'll know who you are. Even if you never log in, even in some cases, they'll use your keyboard strokes."Adults can choose to use apps that sell their data. When kids are required to use educational apps for school — they don't get this choice."It's this interesting situation where the person who makes the choice about the risks is not the person who is exposing themselves," Keith said.Educators may not fully understand how these technologies work, especially when innovation can move faster than the law."There's this creed in technology circles, 'Let's move fast and break things' … Facebook made it famous," BYU professor Jason McDonald, who has studied educational technology, said. "I think a lot of people in technology have adopted that as a kind of motto."State laws can make a difference. BYU Law professor Clark Asay, who teaches information privacy law, explained that the U.S. has less federal regulation around information privacy than other countries."U.S. companies … have a lot of latitude in terms of collecting information, what they do with it. A lot of the constraints actually come from state laws," Asay said.Earlier this year, Utah passed H.B. 55, Privacy Compliance for Education Technology Vendors, in response to the study. This law increased student privacy protections and third-party compliance with the law."The state of Utah is one of the only states asking these types of privacy questions," Earl said.Utah has previously passed other student privacy laws."I would love to see other states come up with their own good ideas that we could learn from," Keith said.Some of Utah's other privacy laws include the Student Privacy Act and the Student Data Protection Act.
Tags
jennie earl
mark keith
justin giboney
clark asay
jason mcdonald
utah law
byu study
internet safety labs
personal data
internet privacy
utah state board of education
Share
Link to X (formally Twitter) User
