Blog

They are gutting the most important privacy law you never heard of.

These Republican lawmakers have introduced bills to weaken privacy.

You should have a choice whether a company uses photos of you or your family; you should be told when a company provides thousands of other companies and government entities access to photos of you.  There should be a law against this invasive use of your image and biometric data.  There is.  Illinois has one of the toughest biometrics laws in the country–the 2008 Biometric Information Privacy Act  (BIPA). The New York Times recently published a great piece about the importance of Illinois’ BIPA law: The best law you’ve never heard of.  The author, Shira Ovide, writes about BIPA:

“The law’s text is simple but profound, Adam Schwartz, a senior staff attorney with Electronic Frontier Foundation, told me.

First, companies behind technologies like voice assistants or photo recognition services can’t use people’s biometric details without their knowledge or consent. Few American privacy laws go this far — and probably none will again. Typically we must agree to whatever companies want to do with our data, or not use the service.

Second, BIPA forces companies to limit the data they collect. Those two principles are in Europe’s landmark data privacy law, too.

And third, the law lets people — not just the state — sue companies.”

Illinois Representatives Jim Durkin – Dan Caulkins – Thomas M. Bennett apparently want to gut the best privacy law in the U.S.

These Representatives introduced two bills to weaken BIPA:  HB560  and HB559. Durkin, Caulkins, and Bennett’s bills would make it almost impossible for you to sue the companies who misuse your biometric information. For information on how these bills would weaken BIPA, see this coalition letter opposing these bills.

HB559 recently passed out of committee on a 10-5 vote with 5 Republicans and 5 Democrats voting yes. This article from the Capitol News Illinois says this about HB559 the bill to gut BIPA: 

“Opponents are more concerned that the bill will render the existing law useless.

Sapna Khatri, advocacy and policy counsel for the ACLU of Illinois, noted that BIPA has been called the most effective and important privacy law in the country because of its simplicity.

“We are here because BIPA is working precisely as it was intended,” Khatri said. “This (new bill) is prioritizing corporate profits over personal privacy and granting companies wide latitude to collect and exchange our biometric information like currency. This is not a solution.”

Opponents to HB 559, such as Rep. Ann Williams, D-Chicago, and Rep. Jennifer Gong-Gershowitz, D-Glenview, argued that as technology advances, BIPA as it stands is imperative to protecting Illinois residents’ most personal private data.

“At a time when our neighbors and other states are modeling legislation around BIPA and issuing bans on the use of invasive biometric technology, like facial recognition, HB 559 presents a massive step back for Illinois,” Khatri said.”  [emphasis added]

What could have possibly enticed10 Illinois lawmakers to vote yes on this bill despite 266 people signing up to oppose HB559, while only 14 “people” (ie: Chamber of Commerce and the Illinois Civil Justice League-whose mission is to reduce the number of civil lawsuits) signed up in favor of HB559?

Why is this happening now? 

You may have read about companies like the facial recognition company Clearview AI who take photos shared on social media and then, without your permission, scrape up your family photos to add to their database. Clearview AI is facing several class action lawsuits  here and here and here, and this lawsuit in California that alleges:

 “The sheer volume of online photographs Clearview scrapes to capture faceprints for its database makes it a near certainty that anyone whose photographs are posted to publicly accessible portions of the internet will have been subjected to surreptitious and nonconsensual faceprinting.

The suit claims Clearview has “illicitly” and “illegally” collected more than three billion photos of “unsuspecting individuals,” giving it a database nearly seven times bigger than the FBI’s. 

Clearview has provided thousands of governments, government agencies, and private entities access to its database, which they can use to identify people with dissident views, monitor their associations, and track their speech,” the suit alleged. “Its mass surveillance technology disproportionately harms immigrants and communities of color.”  [emphasis added]

Clearview AI is not the only company scooping up your pictures for facial recognition. In a January 2020 class action decision, Facebook was found to have violated Illinois Biometric Information Privacy Act (BIPA) law and had to pay half a billion dollars: 

“The Illinois suit was filed in 2015, alleging that Facebook collected facial recognition data on images of users in the state without disclosure, in contravention of the state’s 2008 Biometric Information Privacy Act (BIPA). Similar suits were filed against Shutterfly, Snapchat and Google.”

We all lose if BIPA is weakened.  

Illinois has had one of the toughest biometrics laws in the country for 13 years–and with the increase in surveillance technology, other states are patterning bills after BIPA. Now is the time to increase (not weaken) privacy legislation.  After big companies like Facebook and Clearview AI got sued for illegally scraping people’s photos, there are suddenly bills in Illinois to weaken BIPA. Will these industry folks weaken privacy bills in your state, too?  Don’t let them.   

Illinois lawmakers should not make the mistake of weakening privacy rights. HB559 and HB560 should be stopped. Laws and elected officials should protect people, not corporate interests.

What you can do

  • If you are an Illinois resident, call your state rep and your state senator, tell them you are their constituent and urge them to oppose HB559 and any bills that weaken the protections of BIPA.
  • For anyone, call the leadership in the IL House, in particular new Speaker of the House Chris Welch and Minority Leader Jim Durkin, the chief sponsor of the bill.   

Speaker Welch (217) 782-5350 and (708) 450-1000

Leader Durkin (217) 782-0494 and (630) 325-2028

You can find the list of House leaders in each party here and all of their contact info is listed in this directory. Tell them that BIPA is the most protective privacy law in the US and putting corporate profits over protecting individual’s freedom is doing a disservice not just to Illinoisans but to anyone who values the Constitutional right to privacy. 

Blog

Parents: Two ways to find out what ed tech companies are collecting your child’s personal data

Parents, help fill in this FERPA Project Map for the folks at The Student Data Privacy Project.

https://www.studentdataprivacyproject.com/ferpa-project-map

1. This FERPA Map project

is sponsored by our friends at the The Student Data Privacy Project.  Their goal is to highlight the need for parents to know how the data for their children is being collected and protected by ed tech apps. Under FERPA, parents have that right but it is rarely being exercised or enforced. They are asking parents in all 50 states to send a letter to their District or school requesting their child’s data that is held by these private companies.  You can click on their website here to request their  FERPA template  letter.  When you send your letter to your district or school, please copy us at [email protected]  on your request.

2. It’s time we KNOW what data these edtech apps are collecting and how they are being used. 

We at the Parent Coalition for Student Privacy launched our own App Survey in January, for Data Privacy Day 2021. We are researching which edtech apps schools are asking students to use and whether they are sufficiently protective of children’s privacy.  You can take our App Survey here.  

Please let us know what online apps and programs your district or school is using, and check to see if they have been transparent about their privacy policies.  Your name and district will be kept confidential. Thank you to the MANY parents and educators who have already completed this App Survey.  Please continue to share and we will let you know the results soon.  If you have any questions or concerns, please feel free to email us at [email protected]  

 

 

Blog

Did College Board change its mind about requiring cameras on this year’s online AP exams? What security software will the online AP require?


College Board’s AP Guide said the 2021 Digital AP Exams Require Computers with Cameras–but then changed their mind?

Last week the College Board announced they were making changes to this year’s Advanced Placement exam administration, offering both paper or digital versions.  While reading about the online testing options, on the College Board website, I clicked on this 2021 AP® Exam Administration Planning Guide. (I downloaded and archived the AP Guide here on Feb 5, 2021.) 

This guide said students would  be required to use a computer that has a camera and would have to use their camera to take a picture of their photo ID prior to taking the digital AP exam.  The guide also said that schools must  “push” (install) exam application software on all devices to be used for digital testing.

The AP planning guide also said,  “The exam application includes security features to detect impersonation, plagiarism, or other cheating attempts, and restricts students from returning to answered questions or moving back and forth between unanswered questions.” [emphasis added]

 

 

I asked the College Board (on twitter) if students would be required to have their camera or microphone ON during the online tests:

February 10: College Board removed the wording about the camera requirement

Although College Board has not yet answered my Feb 8 twitter questions about the camera requirement or monitoring software, it does appear they removed any mention of  camera requirements on their updated February 10, 2021 AP Exam Administration Planning Guide It looks like College Board also removed any reference to the requirement that  students should take a picture of their photo ID with their computer camera, and upload it on the day of the exam.

However, this February 10 update does not address College Board selling/licensing of the data, nor does it address the online trackers we saw on the AP websites last year. The February 10 update also does not address what surveillance/proctoring software that schools and students will be required to upload and use.  The guidance still mentions “exam application” that technology staff will have to “push” to student devices. See text below surrounded by the red box.

https://apcentral.collegeboard.org/pdf/ap-exam-administration-planning-guide.pdf

The College Board’s lack of transparency about how it uses and shares and markets the troves of student data reminds us of the epistemic coup that Dr. Shoshana Zuboff wrote about in her recent New York Times Op-ed. 

Why it matters: College Board tracking, profiling, selling access to student data.

You will remember that last year, due to Covid-19 pandemic, the College Board administered the Advanced Placement (AP) exams in an online format for the first time. The technical problems of the online AP tests were widely reported, with students unable to complete their tests, unable to submit their answers even when they did complete the tests, and many claimed the online AP tests were discriminatory to disabled students. The 2020 botched AP tests led to a class action lawsuit against the College Board.  

In addition to the glitches and technical difficulties of the test administration, many were also concerned about hidden data collected during the online AP exams. It is well known that the College Board sells licenses to students’ personal data, such as test score ranges, names, and demographic information, and this data can be shared with third parties and even sold. 

In fact, another class action lawsuit was filed against the College Board last year for its deceptive practices, including selling student data to targeted advertisers such as Facebook.  

In 2020 Consumer Reports looked at how the College Board shared students’ data when online;  they found that the College Board was “tracking students and sending information about their activity to advertising platforms at companies such as Facebook and Google”  and “These practices seem to contradict the College Board’s explicit promises to consumers. The company may be sharing students’ information without consent.”    

We also looked at the data traffic and we found 25 trackers on the College Board’s websites–sending kids’ data to companies like YouTube, Facebook, Google, Adobe Marketing etc.  We also found Lucky Orange on the AP demo page which is a first party tracker that can record every keystroke and where the mouse moved, everything a student did on the webpage.

What monitoring software will the 2021 digital AP exam require? 

We do not know what software will be required for this year’s digital AP exams, because the College Board has not released that information yet. 

Examity?

The College Board already uses the monitoring/ proctoring software Examity for its Accuplacer tests.  Examity is one of five software proctoring companies listed in a lawsuit brought forth by Electronic Privacy Information Center (EPIC), for their “collection of personal information and the use of “secret algorithms” — amount to “unfair and deceptive trade practices.”  Interestingly, Examity has a requirement for students to submit pictures of their photo ID prior to the online exam, similar to the protocol mentioned in 2021 original AP Guide. 

Some other secure browser in conjunction with Cambium?

The College Board has already used another company,  Cambium Assessment, Inc.™ (CAI)—for this year’s online PSAT 8/9 exam delivery.  (Cambium Assessment was formerly owned by AIR, read about their 2019 purchase here.)   According this 2020-2021 College Board SAT Educator Guide, the Cambium platform was used for the first ever online PSAT online tests: 

College Board also posted this Testing System Overview description for the Cambium-based online assessments:   

Secure Browser 

“The secure browser is the student testing application used for the preadministration session as well as testing. It prevents students from using other applications and from copying test information and must be installed on all test taker devices. The secure browser you install depends on the operating system your students use.”

If your school already uses the CAI test delivery system and your students take the test on Chromebooks or iPads, you’ll need to change the assessment program in SecureTestBrowser. For Windows and Mac, you’ll need to install the College Board version of the secure browser.

Install the secure browser

Digital Test Practice

For hands-on practice administering digital tests, proctors should use the TA Interface Practice Site. Students can practice navigating the test and using the available tools in the Student Digital Test Preview.

Each site can be used independently, but we recommend also using them together to hold a test day simulation and practice allowing students into the testing session.

Proctors can also click through a short simulation on their own—no sign-on required.

Learn how to practice giving digital tests.

Student Tools

When students take the test, they’ll be able to use these tools:

  • Clock: Counts down the time left for each section and gives a 5-minute warning. Can be hidden.
  • Mark for review: Allows students to flag questions for later review.
  • Embedded Desmos calculator: Available onscreen for calculator-allowed questions.
  • Reference: Allows students to view standard mathematical formulas.
  • Notes: For digital note-taking; students also receive scratch paper.
  • Highlighter: Available for making text, questions, and answer options.
  • Line focus: Uses masking to guide students as they read.
  • Strikethrough: Allows students to eliminate answer options.
  • Zoom in/zoom out: Enlarges the text and images on a test page.

Find out which additional tools are available for students approved to test with accommodations.”

— quoted from College Board digital testing overview here: https://digitaltesting.collegeboard.org/digital-preparedness/testing-system-overview

———————————

It’s interesting that this digital PSAT 8/9 testing guidance says students can flag questions and go back to review them, as opposed to the current digital AP guidance which says the exam application  “restricts students from returning to answered questions or moving back and forth between unanswered questions.” 

It is also interesting that the online PSAT tests allowed students to use iPads but the 2021 online AP tests do not allow iPads. College Board also says schools should not assign the same device to multiple students for the digital AP tests. How will that work for schools who rely on students using computer labs or chromebook carts, or students at home who share a computer with a sibling? 

Remaining questions and concerns

  • Will the College Board allow third party tracking and sharing of student data during the online AP exam?  
  • What proctoring software will the digital AP exam use?
  • Will students still need to submit a photo ID? 
  • Will students’ keystrokes be logged, screens be recorded?  
  • Will the College Board allow disabled students the same approved accommodations for paper compared to digital exams?  
  • Finally, the elephant in the room: why must kids who study hard all year, have to agree to College Board’s (constantly changing) terms of service that allows the company to sell and market their data and strips students of their rights via a forced arbitration clause? 

Forced consent is not consent, and these provisions appear to be the company’s deceptive and legally dubious attempt to get around the laws in 21 states that bar school vendors from selling student data.

Blog

Google Lawsuit, COPPA, Investigating and Blocking Ad Trackers in Children’s Apps

Google cannot escape COPPA lawsuit

There was some big news last week on the children’s privacy front: A District Judge has ruled that Google and the apps they sell on their “store” cannot  dodge a lawsuit brought by the New Mexico Attorney General. Previously, a state court had said the case couldn’t proceed, but thanks to this decision, Google will face claims that apps they hosted in the “Designed for Families” section of their Google Play Store, and ad networks they employed, had actual knowledge they were targeting and marketing children’s data, in violation of COPPA, the Children’s Online Privacy Protection Act. The apps in question are owned by Tiny Lab Productions.

This court case will be significant in highlighting how apps use cookies and advertising tools to track children across the web. As explained in the decision, 

“Tiny Lab Productions (“Tiny Lab”), a Lithuanian company, is a developer of child-directed, mobile game apps including Fun Kid Racing, Candy Land Racing, Baby Toilet Race: Cleanup Fun, and GummyBear and Friends Speed Racing. AdMob [AdMob is owned by Google], Twitter/MoPub, InMobi/AerServ, Applovin, and ironSource (collectively, the “Ad Networks”) sold their proprietary software development kits (“SDKs”) to Tiny Lab for installation and use in its gaming apps. Id. ¶ 13. When a Tiny Lab app is downloaded onto a child’s device in New Mexico, the Ad Networks’ SDKs are also installed as app components. Id. ¶ 5. Once so embedded, while a child in New Mexico plays one of the apps, the Ad Networks’ SDK collects personal information about that child and tracks the child’s online behavior to profile the child for targeted advertising. Id. ¶¶ 43-46. This activity is invisible to the child and her parents” [emphasis added]

Think of an advertising SDK as a unique tag that identifies the user and follows him or her across the internet; an “Identifier for Advertisers” that allows advertisers to see what sites the user visits, and stays embedded on their device even after they are done using the original app.  Ad tracking tools like cookies, persistent beacons, and fingerprinting can be installed on a child’s device when they download an app or edtech platform and these are not transparent to the student, the teacher, or the parent. We know apps track us, but it is not always easy to see how or what they do with our data. 

Several parents have asked us:

  • How often do apps use children’s information for marketing purposes? 
  • Do edtech apps use ad trackers? 
  • How would you know if your child’s app is using adware or ad trackers?
  • What can parents do?

Thankfully, others including this bipartisan group of US Senators, are asking how edtech companies use children’s data.  The Federal Trade Commission (FTC), which oversees COPPA, is also asking how online platforms use children’s data. In a move led by Commissioner Christine Wilson, the FTC announced in December 2020 that it is using its 6(b) authority to investigate several big tech companies that handle children’s data. In a joint statement issued by the FTC says, “Despite their central role in our daily lives, the decisions that prominent online platforms make regarding consumers and consumer data remain shrouded in secrecy. Critical questions about business models, algorithms, and data collection and use have gone unanswered.” 

We agree with executive director of the Campaign for a Commercial-Free Childhood Josh Golin’s statement in Bloomberg News, “These 6(b) studies will provide a much-needed window into the opaque data practices that have a profound impact on young people’s well-being”.

These FTC studies come at a time when many are also calling for COPPA to be updated. Currently COPPA only covers children 12 and under and is confusingly and inconsistently applied to schools. Through advisory guidance (though not regulation), the FTC has said that schools can consent in place of parents, but only if the app is used ONLY for educational rather than marketing purposes. [You can see the joint letter we sent the FTC with 23 organizations when they threatened to weaken COPPA, and you can also read our separate PCSP comments to the FTC here.]

COPPA says that websites and online services, including apps and general audience sites that have actual knowledge they are collecting data from children under 13, must get prior parent approval before collecting, using or disclosing a child’s information. The FTC says this “includes a child’s name, address, phone number or email address; their physical whereabouts; photos, videos and audio recordings of the child, and persistent identifiers, like IP addresses, that can be used to track a child’s activities over time and across different websites and online services.” However, many agree that actual knowledge should be updated to constructive knowledge. As implied in the case of the above Google lawsuit, constructive knowledge means the company has enough information that they knew or should have reasonably known the app was directed towards children and they were allowing for the marketing of their personal data.

Why are companies allowed to use children’s data for advertising at all?  

Parents need transparency and control over how children’s data are collected and used. We believe children should be protected, not monetized or profiled by advertisers. We think that all advertising to children under the age of 18 by any app or program used in schools should be prohibited; any data gathered by these apps should be strictly used only for educational purposes.

Apple will prohibit automatic ad tracking

This idea of prohibiting ad tracking is not that novel. Last year Apple began requiring developers in its App Store to have Privacy Labels, listing which types of data the app collects and how it uses your data. Now, Apple has just announced a new transparency feature that will prevent apps from sharing your data with third parties, without opting-IN. Apple’s white paper that discusses their new policy and prevalence on embedded trackers is entitled A Day in the Life of Your Data, and is worth taking a look at.  As TechCrunch reports,

“The App Tracking Transparency feature moves from the old method where you had to opt-out of sharing your Identifier for Advertisers (IDFA) to an opt-in model. This means that every app will have to ask you up front whether it is ok for them to share your IDFA with third parties including networks or data brokers.”

“The feature’s most prominent evidence is a notification on launch of a new app that will explain what the tracker will be used for and ask you to opt-in to it. …app developers would have to ask users for permission in order to track and share their IDFA identifier for cross-property ad targeting purposes.”

This is how Apple describes the new system:

“Under Settings, users will be able to see which apps have requested permission to track, and make changes as they see fit. This requirement will roll out broadly in early spring with an upcoming release of iOS 14, iPadOS 14, and tvOS 14, and has already garnered support from privacy advocates around the world.”

Tools you can use to see trackers and block ads

There are several tools you can use to see and block trackers on your child’s device. Here are a few:   

  • Install uBlockOrigin tracker and ad blocker; it’s free and it shows you the trackers and blocks ads. We know of schools who have installed uBlockOrigin on every student Chromebook to stop ad tracking in schools.  Ask your school if they would be willing to install an ad blocker like uBlockOrigin on school issued devices. Go here to download uBlockOrigin https://github.com/gorhill/uBlock#ublock-origin or here https://ublockorigin.com/ ; either of these links will ensure you are using Origin. Read more about uBlockOrigin here. See an example (below) of the 14 trackers blocked while a student visited her College Board MyAP Classroom account.
  • MarkUp’s Blacklight lets you paste website urls into their analysis program to see what type of ads and trackers are being used. This tool gives detailed analysis and even flags trackers that evade cookie blockers.  https://themarkup.org/blacklight  See an example (below) of the different kinds of trackers found on a student’s Google Classroom account.
  • Use a web browser that blocks ads:  Brave web browser blocks ads and reportedly loads pages quicker than Chrome. Firefox also blocks ads and has many privacy and security extensions. 

Take our App Survey

In honor of World Data Privacy Day, on January 28, we launched an App Survey for parents, asking what apps your school uses and what privacy protections and transparency notifications are in place.  The response has been incredible and we encourage all parents to share and take this survey; of course your answers will remain confidential. Click here to take the survey and if you happen to install ad blockers, let us know what you find!  

uBlock and AP Classroom trackers

Blacklight and Google Classroom ad trackers

Blog

For Data Privacy Day — take our Survey: online apps used by districts and their privacy provisions

Today, January 28th is Data Privacy Day, the international annual day of action and awareness to promote the privacy of our personal data.

The Parent Coalition for Student Privacy is researching which ed tech apps schools are asking students to use and whether they are sufficiently protective of children’s privacy.

Since the pandemic hit, school districts across the nation have purchased many commercially-produced online apps and programs to implement remote learning. Even before last spring, districts had been using a large number of programs, many of which have access to personal student information. Many of these apps collect and use personal student data in ways that are not transparent and we do not understand.

More recently, this past December, the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) warned about “malicious cyber actors … targeting kindergarten through twelfth grade (K-12) educational institutions, leading to ransomware attacks, the theft of data, and the disruption of distance learning services.” This follows another warning the FBI put out in 2018 that the use of ed tech apps in schools posed a serious threat to children’s privacy and safety.

Please let us know what online apps and programs your district or school is using, and check to see if they have been transparent about their privacy policies. Your name and district will be kept confidential.

Click here to take the survey.

On Data Privacy Day and every day, it is important to protect children’s information. Below are a few resources to help.

The 2019 State Student Privacy Report Card lists and rates state laws based on Transparency, Parental and Student Rights; Limitations on Commercial Use of Data; Data Security Requirements; and Oversight, Enforcement, and Penalties for Violations. https://studentprivacymatters.org/map/map.html

Federal Laws enabling parents to protect their Children’s Privacy: FERPA, PPRA and COPPA https://studentprivacymatters.org/ferpa_ppra_coppa/ . Read how FERPA was weakened here and how to request to inspect your child’s education record maintained by your school or the state here.

Parent Toolkit for Student Privacy https://www.studentprivacymatters.org/wp-content/uploads/2017/05/Parent-Toolkit-for-Student-Privacy.pdf

Top 10 back to school privacy tips and resources https://studentprivacymatters.org/top-10-back-to-school-student-privacy-tips-and-resources-for-parents/