Tag Archives: College Board

Blog, Link

Victory at last! NY Attorney General enforces law and makes College Board stop selling student data!

Last week, Tish James, the NY State Attorney General, won two big victories against businesses engaged in fraudulent and deceptive practices.  As was widely reported, the Trump Organization was fined more than $550 M and Trump himself was barred from engaging in business in NY for the next three years.   Yet the Attorney General’s victory over another huge business venture engaged in illegal practices was far less covered in the media, and in NYC, among local outlets, only the Daily News reported on it.

This other victory was a consent decree that the College Board signed with the AG office, in which the College Board agreed to stop the sale of personal student data of New York public school students, along with paying a fine of $750,000 – which is modest compared with the tens of millions of dollars the College Board has made from illegally selling this data over the last ten years.  Here is the press release from the AG office, dated Tuesday February 13; here is an article in Reuters.

For decades, the College Board has been selling student names, addresses, test scores, and whatever other personal information that students have provided them,  when they sign up for a College Board account and the Student Search program. According to the AG press release, in 2019 alone, the College Board improperly shared the information of more than 237,000 New York students.  Since New York’s student privacy law, Education §2-d, calls for a fine of up to $10 per student, the penalty for selling student data during that one year alone could have equaled more than $2 million.

And yet for years, on their website and elsewhere, the College Board has also  falsely claimed they weren’t selling student data.  Instead they called  it “licensing” data, a distinction without a difference.  For years, they also claimed that they never sold student scores, though that was false as well, as they do sell student scores within a range.

The College Board urges millions of students to sign up for their Student Search program, with all sorts of unfounded and deceptive claims, including that it will help them get into better schools or receive scholarships.  The reality is that their personal data is sold to over 1,000 colleges, programs and other companies – the names of which they refuse to disclose — who use it for marketing purposes and may even resell it to even less reputable businesses.

Many colleges also use the data to get more students to apply, merely to boost their selectivity rate and number of rejections, which then give them a higher ranking, a ruse reported in the Wall Street Journal and elsewhere. Though the College Board refuses to disclose how much they profit by this sale, it is likely more than $100 million a year nationally.  They used to charge about 50 cents a name, but currently they charge up to a half million dollars a  year or more to organizations that want access to this data.

Ever since the Education §2-d  was passed in 2014, as a result of the inBloom controversy, the sale of  personal student data by schools, districts, and their vendors has been absolutely banned.  Since that time, New York parents along with the Parent Coalition for Student Privacy, which I co-chair, have been urging city and state officials to include an explicit prohibition against this invasive and illegal practice in their contracts with the company, and yet up to now, the city and state have refused to do so.

After the law was passed, it would be nearly five years for the New York State Education Department to draft regulations to implement it.  Meanwhile, in In July 2018, an article in the NY Times revealed that an unnamed organization to which College Board had sold student data had resold it to a for-profit company that markets expensive programs to families of dubious value, and that this practice likely contributed to a thriving and largely unregulated commercial market in student data.

The article described how thousands of students attended a “Congress of Future Science and Technology Leaders” costing $985, and pointed out how much of the confidential data sold by College Board was  harvested through surveys administered to students right before they take the PSATs and SATs, or when they register for the test online.

The College Board not only refused to make it clear to students that providing this personal data was voluntary, but much of the data requested was protected by a federal law called the PPRA, or the Protection of Pupil Rights Amendment, meaning that students could not be asked these questions without explicit parental consent or opt out. We had warned about this earlier in a blog post in 2017, and complained about it to the US Department of Education, which  released guidance warning districts not to allow the College Board to continue this practice in May 2018.

In  2018, NYSED finally released proposed regulations for Education §2-d for public comment.  The organization I co-chair, the Parent Coalition for Student Privacy, along with the statewide coalition New York State Allies for Public Education (NYSAPE), submitted recommendations on how to strengthen and clarify those regulations, as did more than 240 parents and privacy advocates.

Yet behind the scenes, the College Board was lobbying hard to persuade State Education Department officials  to weaken the law with regulations that would include a special exemption to allow them to continue selling student data, with or without parental consent.  Through a Freedom of Information Law request, we later received emails sent by the Board to then-Commissioner Mary Beth Elia and her successor, Beth Berlin,  in 2018 and 2019, urging them create loophole for this purpose.  They pointed out that 80% of students do opt into the sharing of their data, including their GPAs, ethnicity, educational interests and the like.

They claimed that asking for parent consent before they shared the data would  cause 4,000 fewer New York high school graduates to attend four-year colleges every year – though they never backed up that claim.  They cited an unpublished study that showed that if a student had their data shared through the Student Search process, their probability of enrolling in the college that had received that data was increased by 22 percent – without even attempting to argue that this college would be of any higher quality than any other that had not purchased their data.  Moreover, when we finally got access to the study, a footnote revealed that this 22% increase only reflected an actual increase of .02 percentage points over the usual rate of .1%, since so few students actually did attend the colleges to which their data was sold.

In any case, the College Board’s lobbying efforts nearly worked, as on July 10, 2019, in the middle of summer, then- Chief Privacy Officer of State Ed Temitope Akinyemi released revised regulations for the law, without the knowledge of the state’s Data Privacy Advisory Board, on which I sit.  These regulations contained a special loophole for the College Board that would allow the continuing sale of the data as long as there was parental “consent.”  I, along with other parents stepped in to protest, and many parents sent in comments to the State, urging them to omit this unwarranted and damaging change in the regulations. Ad our Parent Coalition and NYSAPE wrote in a letter to NYSED after the new draft regulations were revealed,

“To create a new, huge loophole in the law that would allow the College Board, ACT or any other contractor or subcontractor to sell student data and/or use it for marketing purposes, by making the untenable claim that such sale or marketing purpose is not truly marketing if there is consent, is a drastic weakening of the law which should NOT be contemplated….

If the College Board lobbyists or its supporters would like to eliminate the prohibition of the sale or marketing of student personal data in the law, they should go to the Legislature and ask that it be amended. This should not be done through regulations or by attempting to redefine the meaning of the term “marketing.” 

I then wrote an oped  that was published in the Washington Post on Sept. 11, 2019, with the headline “Is New York state about to gut its student data privacy law?”  In the oped, I pointed out how the data that was sold could relate to the students’ “academic and extracurricular interests, career and field of study interests, family income, and religious preferences.” A longer and more specific list of data was listed on the webpage aimed at purchasers, revealing that, depending on the test taken, the data could include student email addresses, ethnicity, GPA, sports, or “educational aspirations.”  One had to dig even deeper into a SAT registration booklet, to discover that while their child’s “actual test scores” were not sold to third parties, “Colleges participating in Student Search … can ask for names of students within certain score ranges [emphasis mine].”

After the Washington Post oped was published,  Betty Rosa, then the Regents Chancellor and now the Commissioner of Education, sprang into action.  She called  for a special meeting in Albany to take place on September 19, with top SED officials, including then-Acting Commissioner Shannon Tahoe, the Chief Privacy Officer, and representatives from the College Board, as well as Lisa Rudley of NY State Allies for Public Education and me.  We were each requested to provide a one-pager beforehand, with our points about whether the regs should be altered to allow the continuation of this practice clearly laid out. (Mine is here.)

When the meeting was held, we argued these issues for about an hour, in a dark conference room in the State Education building.  The representatives from the College Board  maintained that they provided this data to organizations and colleges for purely charitable reasons, to help ensure that underserved students had more opportunities. Lisa and I argued among other things that the sale of this data merely contributed to an expensive marketing arms race between colleges, similar to that engaged in by drug companies,  that wasted millions of dollars that could be far spent on authentic outreach to students and/or improving the quality of education they provide.

Chancellor Rosa then asked us if there were any conditions under which it would be acceptable for the College Board to continue sharing this data with third parties.  I responded under three conditions:  One, that the Board disclose the names of all the organizations with whom they shared the data, (which to this day they still refuse to do); two, if parents were asked  and gave informed consent for this disclosure, including a clear and precise list of all the data elements the Board intended to share; and three, if the Board shared the information with these institutions for free, rather than for sale – which they should be willing to do, if their motives were as charitable as they claimed.

Chancellor Rosa then turned to the College Board, and asked them  if they’d be willing to comply with those conditions, and without even a moment of pause, they said no.  That was the end of the meeting.  A few weeks later, SED again revised the language of the proposed regulations and took out the special loophole that had previously been inserted to allow the College Board to sell data.

And yet the illegal collection of sensitive student data and its sale by College Board continued in New York State and elsewhere.  In October 2019, we wrote a blog post about this, including a fact sheet for parents, warning them to urge their kids not to answer any of the optional questions before taking these exams, and informing them that all that was required to be filled out was  their name, date of birth and  gender.  We also warned them about the Student Search program, and advised them not to allow their children to sign up for this program, unless they wanted their names and test scores to be sold.

The College Board then sent me a letter, demanding I  correct specific statements in our fact sheet, including the following.  While they had asked students about their “religion activities”, a topic which is illegal without parental consent, they had recently altered this question to inquire about their “religious interests” instead.  You can see their letter, my response, and their reply here.

In any case, the NYC Department of Education continued to ignore our entreaties and continued to sign larger and larger multi-million dollar contracts with the College Board every few years, for the PSAT, SAT and AP tests, without any prohibition against selling the personal student data they received as a result.

Similarly, many other districts in New York State continued to do so as well, without any apparent interest in trying to stop this illegal practice. We asked the State Education Department’s new CPO to put out guidance on the subject,  and to the Attorney General office to enforce the law, even posting a petition in November 2021 asking Tish James to intervene, that received more than 700 signatures, all to no avail. Since there is no private right of action in the student privacy law, meaning parents could not sue for this ongoing violation of their children’s privacy, we were stymied.

Instead, the College Board devised new evasive tricks, requiring students to sign up for their own accounts on the College Board website to take these exams and/or access their scores, even when these exams were administered by their schools with district funds.  When they did sign up, students were then asked to sign a waiver, saying that they “do so in their personal capacities, not as Students of School,” apparently in order to protect the College Board from liability in having to comply with the state laws in New York and elsewhere that prohibit school vendors from selling student data.

More bad publicity for College Board followed.  Consumer Reports revealed how they used trackers on their website, sending information about students’ online activity to advertising platforms at companies such as Facebook and Google. We followed up with a post on our Parent Coalition for Privacy website, in which Cheri Kiesecker documented how the company utilized hidden analytics tools, recording everything a user does on its website, including keystrokes and “behavior tagging”.

She also pointed out how with their ill-gotten gains, the College Board had accumulated assets at that time of more than $1.1 billion, much of it invested in off-shore bank accounts, and paid its CEO, David Coleman, over $1.5 million per year.  More recently, in 2022,  according to its  IRS 990, Coleman was paid more than $2.1 million per year in salary and benefits, while the Board’s President, Jeremy Singer was paid more than $1.8 million per year.  The organization also provides first-class or charter travel to key employees or officers, according to Pro Publica, unusual for an education non-profit.

Then in January of 2022, we got a big break.  It was announced that Tish James had asked Zephyr Teachout, a renowned anti-trust attorney, to take a leave from her faculty position at Fordham Law to work at the AG office for a year, as a “special advisor and senior counsel for economic justice.”  Zephyr had run for Governor  in 2014 and for Attorney General in 2018 and was highly respected for her progressive positions on a range of issues, including education and privacy.

I reached out to Zephyr with my concerns about the College Board, and starting in the summer and fall of 2022, the AG office began investigating this issue.  According to last week’s press release, the College Board stopped selling the data collected in schools via PSAT and SAT exams some time in 2022 after their investigation had begun, but continued selling student data collected via AP exams through 2023.

In July of 2023, the Panel for Educational Policy approved a DOE $18 million five-year contract with the College Board for PSAT/SAT exams and other materials.  In the Request for Authorization document posted  on the DOE website, a section at the end entitled “Vendor Responsibility” that described just a few of the lawsuits filed against the College Board contained this statement:

In October 2022, the NYAG’s requested information from College Board to assess its compliance with Education Law section 2-D and information relating to its financial aid products. College Board advised that the matters are on-going and continues to cooperate with NYAG.

I heard nothing more about the issue for another seven months. Then last week, while lying in bed, listening to the radio in the morning on February 14 – yes Valentine’s Day – the WNYC announcer briefly reported on this consent decree.

So after ten years of advocacy, we seemed to have achieved the goal of halting this illegal practice by  the College Board, at least in NY state.  Yet a few questions and concerns remain, including how the Attorney General’s office intends to enforce this prohibition.

Moreover, the privacy addendum for the DOE contract with the College Board, called the “Parent Bill of Rights”[PBOR]  posted on the DOE website still does not fully comply to the law.  It says that the company, its subcontractors and others with whom it discloses this data will not encrypt student data “where data cannot reasonably be encrypted”, even though encryption at all times is required by Education §2-d.  This is a serious violation of the law and risks damaging breaches, as have occurred too many times with DOE vendors.

Education §2-d also requires that data minimization and deletion be specified in all contracts, yet the DOE PBOR for the AP exam says the company  will delete data acquired through the exam only “when all NYC DOE schools and/or offices cease using College Board’s products/services,” which could be never. The PBOR for the SAT/PSAT is even worse, as it specifies no actual date that any student data will ever be deleted. As we saw with the Illuminate breach, when nearly the data of nearly a million current and former NYC students was breached, lax data deletion contracts has allowed DOE vendors to retain the data of students far too long, even those who have long graduated from high school and left the system. It is critical that both the  encryption and data deletion provisions in the College Board contracts with DOE be strengthened and enforced.

Three other points of warning to parents: There is a bill that was submitted in the State Legislature in 2021, and resubmitted this session by Senator Sanders and Assemblymember Hyndman, S4203 and A2388 that would amend the law to allow the College Board to keep selling students data.  We wrote a memo in opposition to this bill in 2021.  If you are a constituent of either of these legislators, please urge them to withdraw this bill.

Secondly, if your child has taken or intends to take the SAT exam outside of the school day, separate from the school context, this consent decree will not stop the sale of their data, as the state student privacy law only covers the practices of public schools, districts, and their vendors.  So if you do not  want your child’s personal info to be sold, including their names, scores, ethnicity, etc., to organizations and colleges, including those that may be score-optional, make sure your child does not sign up for the Student Search program.

Finally, as of 2019, there were at least twenty other states which have the same prohibition against selling student data by school and district vendors, including California, Illinois, and others. Here and below is the list of such states, along with the state law that prohibited this and the year that it was passed, according to the State Student Privacy Report Card, published by the Parent Coalition and the Network for Public Education.

If you are a parent of a high school student in one of these states, please reach out to us at [email protected] with your concerns, as we plan to contact the Attorneys General of these states to urge them to act as Tish James has now done, to halt this damaging and illegal practice, and hopefully impose even bigger fines.  Thanks!

Blog

Did College Board change its mind about requiring cameras on this year’s online AP exams? What security software will the online AP require?


College Board’s AP Guide said the 2021 Digital AP Exams Require Computers with Cameras–but then changed their mind?

Last week the College Board announced they were making changes to this year’s Advanced Placement exam administration, offering both paper or digital versions.  While reading about the online testing options, on the College Board website, I clicked on this 2021 AP® Exam Administration Planning Guide. (I downloaded and archived the AP Guide here on Feb 5, 2021.) 

This guide said students would  be required to use a computer that has a camera and would have to use their camera to take a picture of their photo ID prior to taking the digital AP exam.  The guide also said that schools must  “push” (install) exam application software on all devices to be used for digital testing.

The AP planning guide also said,  “The exam application includes security features to detect impersonation, plagiarism, or other cheating attempts, and restricts students from returning to answered questions or moving back and forth between unanswered questions.” [emphasis added]

 

 

I asked the College Board (on twitter) if students would be required to have their camera or microphone ON during the online tests:

February 10: College Board removed the wording about the camera requirement

Although College Board has not yet answered my Feb 8 twitter questions about the camera requirement or monitoring software, it does appear they removed any mention of  camera requirements on their updated February 10, 2021 AP Exam Administration Planning Guide It looks like College Board also removed any reference to the requirement that  students should take a picture of their photo ID with their computer camera, and upload it on the day of the exam.

However, this February 10 update does not address College Board selling/licensing of the data, nor does it address the online trackers we saw on the AP websites last year. The February 10 update also does not address what surveillance/proctoring software that schools and students will be required to upload and use.  The guidance still mentions “exam application” that technology staff will have to “push” to student devices. See text below surrounded by the red box.

https://apcentral.collegeboard.org/pdf/ap-exam-administration-planning-guide.pdf

The College Board’s lack of transparency about how it uses and shares and markets the troves of student data reminds us of the epistemic coup that Dr. Shoshana Zuboff wrote about in her recent New York Times Op-ed. 

Why it matters: College Board tracking, profiling, selling access to student data.

You will remember that last year, due to Covid-19 pandemic, the College Board administered the Advanced Placement (AP) exams in an online format for the first time. The technical problems of the online AP tests were widely reported, with students unable to complete their tests, unable to submit their answers even when they did complete the tests, and many claimed the online AP tests were discriminatory to disabled students. The 2020 botched AP tests led to a class action lawsuit against the College Board.  

In addition to the glitches and technical difficulties of the test administration, many were also concerned about hidden data collected during the online AP exams. It is well known that the College Board sells licenses to students’ personal data, such as test score ranges, names, and demographic information, and this data can be shared with third parties and even sold. 

In fact, another class action lawsuit was filed against the College Board last year for its deceptive practices, including selling student data to targeted advertisers such as Facebook.  

In 2020 Consumer Reports looked at how the College Board shared students’ data when online;  they found that the College Board was “tracking students and sending information about their activity to advertising platforms at companies such as Facebook and Google”  and “These practices seem to contradict the College Board’s explicit promises to consumers. The company may be sharing students’ information without consent.”    

We also looked at the data traffic and we found 25 trackers on the College Board’s websites–sending kids’ data to companies like YouTube, Facebook, Google, Adobe Marketing etc.  We also found Lucky Orange on the AP demo page which is a first party tracker that can record every keystroke and where the mouse moved, everything a student did on the webpage.

What monitoring software will the 2021 digital AP exam require? 

We do not know what software will be required for this year’s digital AP exams, because the College Board has not released that information yet. 

Examity?

The College Board already uses the monitoring/ proctoring software Examity for its Accuplacer tests.  Examity is one of five software proctoring companies listed in a lawsuit brought forth by Electronic Privacy Information Center (EPIC), for their “collection of personal information and the use of “secret algorithms” — amount to “unfair and deceptive trade practices.”  Interestingly, Examity has a requirement for students to submit pictures of their photo ID prior to the online exam, similar to the protocol mentioned in 2021 original AP Guide. 

Some other secure browser in conjunction with Cambium?

The College Board has already used another company,  Cambium Assessment, Inc.™ (CAI)—for this year’s online PSAT 8/9 exam delivery.  (Cambium Assessment was formerly owned by AIR, read about their 2019 purchase here.)   According this 2020-2021 College Board SAT Educator Guide, the Cambium platform was used for the first ever online PSAT online tests: 

College Board also posted this Testing System Overview description for the Cambium-based online assessments:   

Secure Browser 

“The secure browser is the student testing application used for the preadministration session as well as testing. It prevents students from using other applications and from copying test information and must be installed on all test taker devices. The secure browser you install depends on the operating system your students use.”

If your school already uses the CAI test delivery system and your students take the test on Chromebooks or iPads, you’ll need to change the assessment program in SecureTestBrowser. For Windows and Mac, you’ll need to install the College Board version of the secure browser.

Install the secure browser

Digital Test Practice

For hands-on practice administering digital tests, proctors should use the TA Interface Practice Site. Students can practice navigating the test and using the available tools in the Student Digital Test Preview.

Each site can be used independently, but we recommend also using them together to hold a test day simulation and practice allowing students into the testing session.

Proctors can also click through a short simulation on their own—no sign-on required.

Learn how to practice giving digital tests.

Student Tools

When students take the test, they’ll be able to use these tools:

  • Clock: Counts down the time left for each section and gives a 5-minute warning. Can be hidden.
  • Mark for review: Allows students to flag questions for later review.
  • Embedded Desmos calculator: Available onscreen for calculator-allowed questions.
  • Reference: Allows students to view standard mathematical formulas.
  • Notes: For digital note-taking; students also receive scratch paper.
  • Highlighter: Available for making text, questions, and answer options.
  • Line focus: Uses masking to guide students as they read.
  • Strikethrough: Allows students to eliminate answer options.
  • Zoom in/zoom out: Enlarges the text and images on a test page.

Find out which additional tools are available for students approved to test with accommodations.”

— quoted from College Board digital testing overview here: https://digitaltesting.collegeboard.org/digital-preparedness/testing-system-overview

———————————

It’s interesting that this digital PSAT 8/9 testing guidance says students can flag questions and go back to review them, as opposed to the current digital AP guidance which says the exam application  “restricts students from returning to answered questions or moving back and forth between unanswered questions.” 

It is also interesting that the online PSAT tests allowed students to use iPads but the 2021 online AP tests do not allow iPads. College Board also says schools should not assign the same device to multiple students for the digital AP tests. How will that work for schools who rely on students using computer labs or chromebook carts, or students at home who share a computer with a sibling? 

Remaining questions and concerns

  • Will the College Board allow third party tracking and sharing of student data during the online AP exam?  
  • What proctoring software will the digital AP exam use?
  • Will students still need to submit a photo ID? 
  • Will students’ keystrokes be logged, screens be recorded?  
  • Will the College Board allow disabled students the same approved accommodations for paper compared to digital exams?  
  • Finally, the elephant in the room: why must kids who study hard all year, have to agree to College Board’s (constantly changing) terms of service that allows the company to sell and market their data and strips students of their rights via a forced arbitration clause? 

Forced consent is not consent, and these provisions appear to be the company’s deceptive and legally dubious attempt to get around the laws in 21 states that bar school vendors from selling student data.

Blog

Parents question College Board’s use of student data

Is College Board allowing third party advertisers, keystroke loggers, and behavioral analytics to track students?  “Recording everything they do?”

With the move to online learning, many parents are asking edtech companies, “What are you doing with my child’s data?”  That seems a reasonable question. As a parent myself, I have wondered how the College Board uses and monetizes students’ data.  Similar to a recent investigation by Consumer Reports, I recently discovered that College Board allows third parties such as Facebook and advertisers such as Adobe Marketing, Google Ads, Bing Ads, Yahoo and more to track users on multiple College Board websites. However, in addition to these ad trackers, I documented where the College Board apparently utilized hidden analytics tools, including one that records everything a user does on a website and offers keystroke logging and “behavior tag” analysis of users.  I also discovered that College Board apparently required typing samples from students, asked students to give College Board an unlimited right to use their AP written and oral responses, and College Board changed their AP Terms of Service after students agreed to them in Fall of 2019.  I wonder how many parents or students know this about College Board.

The College Board, a signatory to the Student Privacy Pledge which promises not to sell students’ personal data for behavioral advertising and promises to only disclose data for educational purposes, is also the owner of the PSAT, SAT, and Advanced Placement (AP) exams.  The College Board appears to be a very profitable “non-profit” that also receives considerable public subsidies. This report suggests the College Board is a hedge fund which has money in multiple offshore accounts, and has assets in excess of $1.1 Billion.  According to 2018 tax records, College Board paid David Coleman, their CEO, an annual salary of over $1.5 Million, and paid multiple staff salaries in the $300-500,000 range, including Trevor Packer the VP of AP programs, whose annual salary in 2018 was $526,359. As seen in this letter to a parent, the College Board uses its non-profit status to claim exemption from California’s Consumer Privacy Act.

College Board sells licenses to access student data. Do they also sell student data for advertising purposes?

The College Board profits from selling exams but also profits from licensing students’ data. As we wrote in this 2017 Washington Post piece, the College Board profiles students’ geographic, attitudinal and behavioral information and sells licenses to institutions and researchers, allowing access to student data.

“The College Board sells licenses to access the data through a tagging service called College Board Search. The Segment Analysis Service™ is one of three featured tools of the Search, along with the Enrollment Planning Service™, and the Student Search Service®. These are “enhanced tools for smart recruitment.” The College Board’s Authorized Usage Policies states, “Student Search Service in connection with a legally valid program that takes such characteristics into account in furtherance of attaining a diverse student body.”…and allows college admission professionals to identify prospective students based on factors such as zip code and race and to “Leverage profiles of College Board test-takers for all states, geomarkets, and high schools.”

In December 2019, the College Board was named in a class action lawsuit for improperly obtaining and selling student data. The lawsuit, which was recently amended, mentions selling student data to targeted advertisers such as Facebook,

“While students were made to believe the results of these tests would significantly impact their futures, to College Board the tests served a wholly different purpose – i.e., to obtain highly valuable personal student information to benefit its own business interests and increase its revenues, which exceeded $1 billion in 2018. College Board obtained the students’ personal information using unfair and deceptive practices and then unlawfully released, transferred, disclosed, disseminated and sold the information. The deceptive practices used by College Board to obtain the personal information included: (a) misrepresenting that it did not sell the information; (b) misrepresenting that it only disclosed nonidentifiable information to third-party targeted advertisers such as Facebook; (c) requiring students to create online accounts for the purported purpose of registering for exams when, in fact, the online accounts provided College Board with a mechanism to obtain massive amounts of personal information that it then unlawfully disclosed and disseminated to third parties…If only one third party were to purchase the personal information of the 2.5 million children who take the AP Exams the total price would be $1,175,000. Obviously, College Board sells data to as many customers as possible.”  [Emphasis added]

Recent changes to College Board’s AP platform: everyone must join online.

In August of 2019 the College Board changed how students and teachers use Advanced Placement (AP) curriculum and assessments by creating new online tools, the online AP Classroom / MY AP account. According to the College Board,

“It all starts with joining the online system. This step unlocks new digital tools and resources that students, teachers, and coordinators can use throughout the year, including an AP question bank and Personal Progress Checks. … Students who don’t already have a College Board account must create one.” [Emphasis added]

The College Board AP Central website boasts “Everything streamlined. Everything online.” In creating the required online College Board account, AP students are asked to provide substantial personal information. Here is a non-exhaustive list: Student email address*, Student home address*, Student Date of Birth*, Student cell phone number, race, parent education level, parent name, parent email address, classes the student has taken or intends to take.  (*=required)  Note: the student MUST also agree to the privacy policy and Terms and Conditions* when creating this required account: “By submitting this information, you are accepting the Site Terms and Conditions and Privacy Policy governing the College Board’s website.”  Take it or leave it.  College Board is the only company offering high school students an exam to earn college credit.

In the fall of 2019, College Board also began requiring school AP Coordinators to register students for the AP exams and electronically submit an  AP Participation Form, with “a few final questions” and an AP Survey.  As of this writing, I was unable to find the 2019-2020 AP Participation Form, final questions, or the AP Survey mentioned in the AP Coordinator’s Manual Part 1 and Part 2.  What are schools agreeing to when they register students for AP exams? What are students agreeing to when they create an AP account,  use AP Classroom, or take AP exams? 

College Board has changed the AP Terms of Service/ Terms and Conditions since Fall 2019.

Since Fall of 2019,  we have found at least 4 different versions of AP Terms for students.  Which set of AP terms are students beholden to?  Here is a capture of the October 2019 MyAP terms thatstudents could see and were required to agree to, when they created their online AP account; here is slightly different public version of MyAP terms. Here are the APCoronavirus terms, and here is a capture of the  MyAP terms as of July 2020, that students see if they log into their MyAP account.  Which set of AP terms are students agreeing to?  Excerpts from this Fall 2019 version of  MyAP Terms and Conditions state,

  • “You acknowledge that it is not the responsibility of College Board to determine whether your school is required to obtain parental consent”
  • “AP Student End Users. Any data provided about you may be used (in the aggregate and/or anonymously) for research purposes, to prepare research reports, and/or in AP Exam ordering and registration processes. Occasionally, College Board researchers and their subcontractors may contact students to invite their participation in surveys or other research. Data collected from the AP Classroom system could also be shared with researchers and partners.”
  • “College Board does not serve Ads in the Services or use Customer Data for Advertising purposes.”    See full version of these terms archived here.

To view and send their AP scores, per screen capture above, students were required to agree to these new (July 2020) Terms and Conditions which added new language, including the following:

  • “Students access AP Services as authorized users of their respective Schools. However, when Students take AP Exams, they do so in their personal capacities, and the scores they earn are their own. Accordingly, in order to take AP Exams, Students are required to enter into a separate agreement by accepting the AP Terms & Conditions prior to taking their first AP Exam.
  • Similarly, when Students access College Board services that are not AP Services, Students again do so in their personal capacities, not as Students of School. Non-AP Services may include, but are not limited to, SAT® registration, college score sends, linking a College Board account to Khan Academy®, creating a college list on BigFuture™, or applying for a scholarship.
  • AP Classroom and Pre-AP Classroom are hosted by Academic Merit, LLC, a third-party platform that is prohibited from using data collected on AP Classroom and Pre-AP Classroom for any purpose other than delivering services to College Board.
  • College Board may use Data for its internal research purposes. College Board may also disclose aggregated and/or de-identified Data with trusted third parties.” [Emphasis added]

The  new language in the July Terms says students who took the AP exam do so in their personal capacity–-this is concerning.  The school had to register the students for the AP exams and the school had to agree to the Terms in the elusive Participation Form– so why do students suddenly have to agree to new Terms saying they took the exam at their personal capacity – AFTER the fact ?  What is College Board trying to avoid?

Further, I find it problematic that students had to go onto the College Board website (apparently with ad trackers and analytics trackers) to even READ the AP Terms and Conditions.  And in at least two cases, (October and July  MyAP Terms), students actually had to submit personal information: create an account and log-in to see the MyAP Terms which they were required to agree to.

It makes my head spin trying to keep all these AP Terms and Privacy Policies straight.  But imagine being a 16 or 17 year old, trying to navigate this.  Should students be agreeing to all of these Terms and Conditions just to take an exam and see their scores?

Can students opt out of sharing their personal data with subcontractors and researchers?  If College Board does not use customer data for advertising purposes, why are there several advertising companies tracking users on College Board websites?  If the data are anonymous, why are researchers and subcontractors contacting students? Selling student data and targeted advertising are prohibited by the Student Privacy Pledge and by many state laws. Interestingly, this Bulletin for AP Students and Parents states College Board will not sell or share or rent student data; however, pay attention to the exceptions.

 “Except as described in this publication, or to share with our operational partners for the purpose of administering testing services and generating score reports, the personal information you provide to College Board will not be sold, rented, loaned, or otherwise shared.” [Emphasis added]

Selling student data

This November 2019  Wall Street Journal piece,  For Sale: SAT-Takers’ Names. Colleges Buy Student Data and Boost Exclusivity, reports that College Board sells student test score ranges, names, and demographic information,

“College Board sells lists of high-school students’ names, ethnicities, parents’ education and approximate PSAT or SAT scores, at 47 cents a name. Each year, 1,900 schools and scholarship programs buy combinations from among 2 million to 2.5 million names, College Board said, declining to say how many names in total it sells. Schools target combinations of geography, socio-economic class and academic interests. A college could buy a list of, say, soccer-playing Caucasian girls from Colorado, Wyoming and Montana who scored 1,200 to 1,300 on the PSAT, are interested in engineering and whose parents didn’t attend college.”

This case study from a College Board stakeholders’ workshop clearly lists “Buy Names –> Analyze” and “Purchase Flow”; other pages of the case study list tagging and analysis of student data by ethnicity, family income-band, socioeconomic communities, marketing zones and listing student names that have not been sold on any order.

In May 2018, the U.S. Department of Education issued significant guidance that prohibits states  or districts to allow testing companies like College Board to sell or re-disclose student assessment data, including test score ranges, without parent consent.

Regarding testing companies,  their pre-test surveys, and student privacy,  the U.S. DoE guidance states,

“In connection with these college admissions examinations, testing companies administer voluntary pre-test surveys asking questions about a variety of topics ranging from academic interests, to participation in extra-curricular activities, to religious affiliation. …the testing companies then sell this information to colleges, universities, scholarship services, and other organizations for college recruitment and scholarship solicitation.

…The administration of these tests and the associated pre-test surveys by SEAs and LEAs to students raises potential issues under the Family Educational Rights and Privacy Act (FERPA), the confidentiality of nformation provisions in the Individuals with Disabilities Education Act (IDEA), the Protection of Pupil Rights Amendment (PPRA), and several recently enacted State privacy laws, and generally raises concerns about privacy best practices.”

“contracts between testing companies and SEA, LEAs, should include provisions assuring that before PII is disclosed nonconsensually, the testing companies (when acting on behalf of the SEA, LEA, or school) will comply with the privacy protections required by Federal law, specifically FERPA and IDEA. When contracting with the testing companies, SEAs, LEAs, and schools should also specify in their contracts that there is a general prohibition under both FERPA and IDEA regarding the unauthorized use and re-disclosure of PII from students’ education records (including any biographical or demographic information about the students provided by the SEA, LEA, or school to the testing companies, and the students’ test scores or test score ranges)”. [Emphasis added]

No Contract for AP?

In this October 2019 letter, I asked the Colorado Board of Education for help with transparency about the data collected and shared via the new online 2019-20 AP format. Colorado’s Student Data Collection Use and Security law requires contracted education providers and their subcontractors to be transparent about data elements collected, their purpose, how used and shared. However, as mentioned in the letter above, I could not find a single school or district in Colorado who had posted a signed AP contract with College Board. School administrators that I spoke to alleged their AP contract negotiations with College Board had stalled for over two years, and they were unable to get College Board to sign an AP contract.

Is College Board refusing to sign AP contracts because they don’t want to be transparent about their use of student data?

AP Exams Moved Online, at Home. College Board President said students’ cameras and microphone would be turned on.

For the first time ever, College Board announced that the  2020 AP exams would be administered online and students would take the AP exams at home. When explaining what this online, at-home exam would look like for students, on April 15, 2020 EdSurge quotes the College Board president, Jeremy Singer, as saying the camera and microphone will be turned on and the exam will use the same software as the pre-test Demo.

AP testing was chaotic and fraught with technical glitches

During the first week of the online AP exams, College Board frequently posted updates on Twitter. Students responded with frantic questions including asking why the College Board required a typing sample on the test, when they did not ask for a typing sample on the Demo. Thousands of stressed-out students  reported that they were unable to submit their completed AP test because of technical glitches and problems with the online submission process. This May 20, 2020 Verge article entitled, “Students are failing AP tests because the College Board can’t handle iPhone photos” quotes a student commenting on the College Board’s  tweet tips being too late to help. OneZero writes about Fake Tweets, Broken Tests, and a Misinformation Campaign: How The College Board Botched Spring Semester. The Washington Post Answer Sheet also wrote about the botched online AP tests; author Valerie Straus questions the actual number of students unable to submit their test responses.

The botched online AP tests resulted in another lawsuit against College Board.

The Washington Post Answer Sheet and Valerie Straus followed up on the subsequent class action lawsuit. The lawsuit on behalf of students who encountered problems taking the online AP exam, claims breach of contract and discrimination against students with disabilities. (The College Board added a new submission procedure during the second week of testing; this new procedure came too late for the many students who were unable to submit their exams the first week.)  The amended complaint also alleges that College Board required students with disabilities to log into the College Board’s BigFuture website to check the status of their disability accommodations and also claims that College Board did not honor student accommodations for breaks,

“The lawsuit asks that the College Board accept any test answers from last week’s AP tests that can be shown to have been completed in time by time stamp, photo and email. It charges that the College Board ignored warnings that giving AP tests online would discriminate against students with disabilities and those who did not have access to technology or the Internet at home to take the exams. [College Board] instructed all students with disabilities who had applied for accommodations to log in to Defendants’ “Big Future” platform to find their accommodation decisions. Had M.W. not been disabled and searching for her accommodations, she would not otherwise have been required to log into Big Future. M.W.’s Defendants accommodations letter states that she is entitled to “extra breaks.” However, when changes to the AP Exam format were announced, M.W. learned that the at-home AP Exam format did not allow for any breaks whatsoever.”

It’s important to note that College Board’s BigFuture Scholarship Search collects students’ disability type, religious affiliation, citizenship status, ethnic and minority background and special conditions such as cancer or hemophilia.  At the time of this writing, I could not find a specific privacy policy or terms of service for how BigFuture uses or shares this personal and sensitive information. However, this archived College Board website states that while College Board never shares disability status or test scores, they do share (sell licenses to?) test score ranges, including AP score range, if students opt-in to Student Search Services.

Practice, Practice, Practice: College Board tells students to take the online pre-test AP Demo.

To avoid testing glitches, students were instructed multiple times to go to the College Board website and practice with the exam Demo  before their actual exam, to make sure they were familiar with the online format and to confirm their device and browser were compatible.

I took the online AP Exam Demo.  I was shocked at what I saw. 

Granting College Board Unlimited Right to Use Student Data?

This permission to allow College Board unlimited right to use student data for educational research and instructional purposes was AUTO FILLED to “Accept”.  I am told this same question,  auto filled to “Accept”, also appeared on the actual AP exams.  How many students declined this permission?

We know data can be re-identified or machine matched. (See here, here, here.) This permission notice only states that student name and school will not be used, but College Board collects a student’s date of birth, student ID, parent and student address, email address, cell phone, location, device information, etc. This permission for data use apparently includes oral responses; a person’s voice is personally identifiable (more on biometric data below).  Will the College Board tell us how many students actually agreed to grant the College Board the unlimited right to use, reproduce, and publish their free response data?  “Educational research” is very broad; can students ask to see how their data are used, shared, or profiled?  Can a student change their mind, retract their consent and ask to have any shared data deleted?

Required Typing Sample Before Every Online AP Exam? 

Many students on Twitter and Reddit said they had to submit the same online typing sample for every AP exam. Students were apparently instructed to type the same short sentences about plagiarism, cheating, and how their grandfather picks up quartz and valuable jewels.  These sentences used every letter of the alphabet, and students were told to copy them word for word, typing in their typical typing style during the 30 minute pre-test session. There was no typing sample on the AP Demo exam.  

Your typing pattern is a biometric identifier, unique to you, like a fingerprint or DNA. 

Many states have biometric privacy laws protecting voice and unique characteristics of an individual that can be used to authenticate a person’s identity (oral response data is mentioned in the consent for unlimited right to use data, above). Keystroke data are specifically protected under California Consumer Privacy Act.  If students were asked to submit typing samples, did College Board obtain informed user consent where necessary and how are College Board or third parties using this biometric data? As this PC World article states, “AI-based typing biometrics might be authentication’s next big thing”,

“Identifying or authenticating people based on how they type is not a new idea, but thanks to advances in artificial intelligence it can now be done with a very high level of accuracy, making it a viable replacement for other forms of biometrics.”

Finally, when taking the AP Demo, I had no choice but to accept the Terms and Conditions.

I couldn’t go on to complete the first question of the Demo exam, unless I checked yes. I had 3 minutes and 30 seconds to read and understand these long legal Terms and Conditions. I ran out of time; the clock expired, but the “Continue” box remained greyed-out until I clicked “I agree to the Terms and Conditions”.  I am also told that students had to click “I agree” to the Terms and Conditions in order to complete the online AP exam. This type of “forced consent” feels more like entrapment.  Will the College Board report the statistics on how many students even opened these Terms and Conditions, and how many students  just clicked agree without opening the Terms?  This Deloitte study found that in general, 97% of  young people agree to conditions without ever reading them.

Third parties,  behavioral analytics, and ad trackers on College Board websites  

To see a detailed report of trackers that Lightbeam and Ghostery found on College Board websites, click here.

I took the practice AP Demo using the Firefox browser with the Lightbeam plug-in and Ghostery add-ons, independently; these tools are free to the public, easy to use and show third party connections and traffic between your device and the internet. I was shocked at what I saw.  When I visited this College Board AP Exam Day Experience (with Coronavirus updates) webpage, I clicked on Demo which brought me to this AP2020 exam demo webpage.

I visited only these 2 College Board public facing websites, which according to Lightbeam and Ghostery, had 26 third parties including YouTube (there was a video tutorial on the AP exam day experience webpage), Google Ads (Doubleclick), Bing Ads (Microsoft), Adobe digital marketing, a Geolocation detector, 2 site analytics trackers including a first-party screen recording and analytics tool called LuckyOrange, found on the College Board’s AP Demo test page.

LuckyOrange:  Keystroke Logger and Behavior Tags

Lucky Orange claims to let you see everything a visitor did on your webpage, offers recordings, ability to see where visitors click, how they use their mouse, and offers keystroke logging and behavior tags.  The Lucky Orange website says,

“Lucky Orange will automatically create a recording of every visitor to your website.  …Filter through millions of recordings instantly and segment the data by browser, OS, referring source, location, device, behaviors, and more. …Watch how customers use their mouse …Segment by location. Segment by device.  …Similar to a DVR, you can play back everything a visitor did.”

Why didn’t College Board disclose their use of this invasive screen recording to users?  What data did College Board enable Lucky Orange to collect, and will this data be shared or licensed?  Can users ask to see their Lucky Orange data and also have it deleted?

Facebook and ad trackers were also found on the SAT registration website.

We have also seen Facebook connecting to College Board websites in the past. In February 2019 while registering for the SAT via the College Board website, this student had 36 different third parties interacting, including Facebook, and Yahoo, Google, Bing, Adobe ads. Ghostery blocked 5 Advertising Trackers: Adobe Audience Manager, Adobe Test and Target, Yahoo.DOTtag, Bing Ads [Microsoft], Facebook Custom Audience and 1 Social Media Tracker:  Facebook Connect and 1 Unknown Google Tracker on the College Board SAT registration website.

College Board Privacy Statement mentions sharing nonidentifiable data with Facebook & marketing companies. 

When creating your account on the College Board website, clicking on Privacy Policy takes you to this College Board Privacy Center page. Further clicking on Privacy Statement brings you here with a dizzying array of options to “Learn More”. Choose Cookies and Do Not Track Signals. You will see that College Board allows third parties to collect user information; they specifically mention third parties such as Facebook.

“We do use third parties, such as Facebook, to provide information about our educational products. Only hashed, nonidentifiable information is provided to these third parties. Only individuals that have independently created an account on our site and opted in to receive marketing communications from us may receive College Board interest-based advertising on such third-party sites. No personally identifiable information is shared with those third parties.” …“The College Board participates in the Adobe Marketing Cloud Device Co-op to better understand how you use our website across various devices.” [Emphasis added]

Google/YouTube data collection are also mentioned.  Why isn’t Lucky Orange mentioned?  What other third parties are collecting student data from the College Board websites?

Note: Hashing is not anonymous.

It’s also important to note that according to this FTC blog, hashing data fails to provide effective anonymity. As Wolfie Christl explains in this Cracked Labs report, hashed data is not really anonymous; it’s a pseudonym that companies can use to share and match data to individual users across devices and platforms. 

Did the College Board direct students to their AP website and AP Demo page, asking students to take the Demo exam, while allowing third parties to collect student information for Digital Marketing and Google ads, and also behavioral analytics, recording students’ mouse clicks and “everything they do”?  What is the educational purpose in digital marketing and recording everything a user does?

I asked the College Board about AP data collection, sharing, third parties.  They said that only ONE third party had access to student AP data.

In April 2020 I asked the College Board 8 questions about data collection and third party sharing associated with their new online AP tests.  Here are the College Board’s April 28, 2020 answers, by way of assistance from the Colorado Board and Department of Education.  See full letter and College Board’s relayed response here.  One question I asked: What third parties or subcontractors will have access to student data and for what purpose? College Board’s response listed only ONE third party  or subcontractor (ETS) had access to student data. (Remember, this version of  My AP Terms and Conditions  seemingly contradicts this College Board statement as it lists FOUR College Board AP Subcontractors: Academic Merit LLC,  Alorica Inc., Educational Testing Service, Paperscorer. The College Board response doesn’t mention additional subcontractors or website third party trackers, advertisers, analytics or cloud storage companies. They declined to answer many of my questions “in order to protect the integrity of test security”. College Board’s response also said they would not require students to have their cameras turned on to take the AP exam, which contradicts the College Board President’s statement.

U.S. Senators also asked about College Board’s third parties and collection of student data.

Valerie Straus wrote about Senators’ letters sent to both databrokers and edtech companies in her August 2019 Washington Post Answer Sheet piece, Legislators ask 50-plus firms to explain how they use the ‘vast amount of data’ they collect on students. Senators received responses from many of these companies, as mentioned in this footnote comment in the Campaign for Commercial-Free Childhood and Center for Digital Democracy’s March 2020 letter which asks the FTC to conduct studies on companies collecting data from children, including ed tech companies. The CCFC letter and footnote state,

“The Senators received responses from 37 ed tech companies and 3 data brokers. …Most companies claimed they retain the information in identifiable form until the data is no longer relevant to provide the service; at that point, they anonymize the data and retain the derivative data in aggregate form. Several stated they obtained additional data from third parties like National Student Clearinghouse or social media sites, and many stated they work with third-party contractors or vendors to provide services in connection with their software or courseware (and include contracts prohibiting personal data from being used for any purpose other than providing services specific to those programs). Many companies stated that they do not disclose data collection to parents or entertain requests to delete or correct data because they understand that to be the schools’ responsibility. Finally, many companies said they store information on cloud-based servers, and only four companies said the students’ data is encrypted.”

When I reached out to the Senate for follow up, I was unable to get a copy of the College Board’s response. The Senate Aide I spoke to said they were not releasing the response letters at this time but I was able to ask questions about the responses in general. I asked if any of these companies said they do audits to ensure their third parties are using student data only as permitted by their contractual obligations. I also asked if responding companies used geolocation or collected student IP addresses, which is important with schools shifting to online learning at home with personal devices and home internet. How do these edtech companies or their third parties track and use student data from their homes?

Student data is a predictive goldmine.

When people talk about moving assessments and curriculum to online learning, I am reminded of this 2015 quote about (paper based) state tests given at the end of the year; the author said they were “Initiated in the dark ages of data poverty” but “better, faster, cheaper data is available from other sources”. What other sources? Online assessments with embedded data collecting algorithms? Online transcripts and data badges and online tools that measure and track student strengths, weaknesses, passions and emotional patterns are being promoted. Before collecting or sharing these predictive and sensitive data, parents must have equitable options, give informed consent, and the ability to refuse sharing sensitive student data with organizations and companies.

As this Parent Toolkit for Student Privacy explains,

“When students browse the internet — whether at home or school — their information is collected by online companies, bundled as consumer profiles, and then sold in the shadowy data market. Because this data has the potential to accurately predict feelings, motivations, and behaviors, it may be purchased by colleges, employers, mortgage lenders and insurance underwriters to evaluate an individual’s suitability for those services and products.”

We live in a world where schools are pushing the boundaries of surveillance technologies, with facial recognition and data collecting digital learning platforms, where machines reading our emotions is a $20 billion dollar industry. Corporations are pushing for digital identities on blockchain for everything from immunity passports to education,  Artificial Intelligence (AI) is embedded in edtech tools and cloud platforms where machines can automatically make predictions about students, virtual tutors will provide “personalized” learning to students, and algorithms are keeping students out of college. We have teachers conducting brain scans in the classroom, a headband that measures student brain waves, and a scarf that will buzz if the student is distracted. Researchers now suggest using digital fingerprints and personality profiles from your social media posts to predict your future job.  We have K-12 online assessments that  measure students’ social emotional skills and student engagement by how fast the student answers, and infers that the “lack of test engagement is a symptom around a lot of deep-rooted problems”.

Moving testing to an online platform means increased opportunity for data collection, use of artificial intelligence and data analytics. In regards to student data and online assessments, the answer is not more data or online tests with hidden algorithms, or tests that instead measure students’ emotions, mental health, or personality. The answer is not simply a different test company. The answer is not compelling a student to agree to terms of service; privacy is not a right you can click away. College Board and other organizations, non-profit or otherwise, who are using student data must respect children’s privacy, agree to stringent data sharing contracts that require parent consent and transparency about data elements collected and shared, review algorithms for accuracy and bias before collection and processing of student data, prohibit advertising, and never sell (or license) student data. We need enforceable laws surrounding student data collection and use, with steep penalties for misuse. Privacy is a basic human right, not a luxury, and children should be protected, not profiled, stereotyped, licensed or used for profit.  Organizations collecting and using student data can and should do better.

Blog

How NY State Ed Department is trying to weaken student privacy by allowing the selling & marketing of personal data

Update 10/10/19: This post was reprinted with the title Is New York state about to gut its student data privacy law? in the Washington Post Answer Sheet on Sept. 11,  along with responses from ACT and College Board.

As a result of the comments and concerns expressed by many parents and privacy advocates, the NY State Education Department decided to omit the provision they had added to the proposed regs to allow for the sale or commercial use of student data with parent consent.  Yet a third version of these regulations will be posted shortly for public comment, and will be voted on in January by the Board of Regents.

The New York Board of Regents is currently considering whether to approve a radical weakening of the state student privacy law, which would allow the College Board, the ACT and other companies that contract with schools or districts to use the personal student information they collect for marketing purposes – even though the original New York law that was passed in 2014 explicitly barred the sale or commercial use of this data. Parents and all others who care about protecting children’s privacy should send in their comments to the state now, by clicking here or sending their view to [email protected]. Deadline for public comment is Sept. 16. More on this below.

Starting in 2014, many states, including New York, approved legislation to strengthen the protection of student privacy, due to a growing realization on the part of parents that their children’s personal data was being shared by schools and districts with a wide variety of private companies and organizations without their knowledge or consent. The US Department of Education had weakened the federal student privacy law known as FERPA twice over the past decade, rewriting the regulations during the Bush and Obama administrations to allow for non-consensual disclosures for different purposes.

At that time, few parents were aware how federal law had been altered to allow their children’s information from being passed into private hands. Then controversy erupted over the plans of nine states and districts to share personal student data with a comprehensive databank called inBloom, developed with more than $100 million of funding from the Gates Foundation.

InBloom Inc. was designed to collect a wide variety of personal student data and share it with for-profit vendors to accelerate the development and marketing of the ed tech industry, to facilitate the adoption of online instruction and assessment. As a result of widespread parental activism and concerns, all nine states and districts that had originally intended to participate in the inBloom data-sharing plan pulled out, and 99 new state student privacy laws were passed across the country between 2014 and 2018.

New York was one of the first to pass a new student privacy law. In March of 2014, our State Legislature approved Education Laws § 2-c and §2-d , which among other things, prohibited the state from sharing student data with inBloom or another comprehensive databank, and also regulated the way schools and vendors must secure student data, including imposing a complete ban on the sale of personal student information or its use for marketing purposes .

As a result of these provisions, New York received a grade of A- in the category of “Limitations on the Commercial Use of Data” in our State Student Privacy Report Card, released last January by the Parent Coalition for Student Privacy (PCSP), which I co-chair, and the Network for Public Education. In turn, this high mark raised New York’s overall grade for protecting student privacy in our rating system to B-, the second highest grade of any state after Colorado. (You can check out the interactive map that grades every one of the fifty states on its student privacy laws, overall and in seven different categories).

Yet to the frustration of many parents and privacy advocates, it would be nearly five years before New York State Education Department drafted any regulations to implement its 2014 student privacy law. In October of 2018, NYSED finally released proposed regulations for public comment. In March 2018, PCSP along with the statewide coalition New York State Allies for Public Education (NYSAPE), submitted recommendations on how to strengthen and clarify those regulations, as did more than 240 parents and privacy advocates.

After the initial period of public comment had ended, instead of strengthening the regulations, the NYSED gutted them, and now proposed allowing student data to be used for commercial purposes as long as there was parental “consent” – a huge loophole that would create the opportunity for districts, schools and vendors to misuse this data in myriad ways.

In their rationale to the Board of Regents, posted here, NYSED officials were frank about their reasons for revising the proposed regulations in this way: to allow the College Board and ACT to offer “college search services to students and parents who consent to the release of college entrance test data to colleges and higher education institutions by college admissions testing companies.”

Yet the College Board and ACT do not just share the test score data in the ordinary ways that parents expect, that is, send these scores to whatever specific colleges that their children have applied to attend. They also sell personal student data to many unspecified organizations and institutions which then re-sell it to unscrupulous for-profit companies.

In particular, the College Board makes untold millions of dollars from marketing personal student data through their “Student Search Service”. Much of this confidential data is deceptively harvested through surveys administered to students right before they take the PSATs and SATs, or when they register for the test online, a practice that we have written about previously and more recently has been criticized by the US Department of Education.

In May of 2018, the Privacy Technical Assistance Center (PTAC) of the US Department of Education released guidance that if states and districts contract with the College Board or ACT to give these exams to students, as is increasingly the case across the country including in New York City, they may be violating federal privacy laws in several different ways.

First of all, as PTAC officials pointed out, the supposedly “voluntary” surveys given to students before taking the PSAT or SAT may include questions relating to highly sensitive issues including their religion, grade point averages and/or family income. Often, it’s not clear to these students that they have a choice not to offer this information, and since they are already feeling high levels of anxiety before taking these exams, they may feel pressured to do so. They certainly are not told that the data is sold will be sold at a profit by the College Board. In any case, some questions relating to sensitive issues cannot be asked legally of students who are under 18 without the prior notification and opt out or consent of their parents, according to the federal law known as the Protection of Pupil Rights Amendment (PPRA).

As the PTAC guidance document also makes clear, “the testing companies then sell [personal student] information to colleges, universities, scholarship services, and other organizations for college recruitment and scholarship solicitation.” If students are asked to take these exams by their districts, and the data is offered to third parties without explicit parental consent, this widespread practice also likely violates both FERPA and IDEA, the Individuals with Disabilities Education Act, the latter which has special provisions to protect the private data of students with disabilities.

To make things worse, the College Board is deceptive about whether this data is actually sold. In the College Board privacy policy for the “Student Search Service,” they falsely reassure parents that “The College Board does not sell student information.“

Yet on another page on their website, they hedge this claim by saying they don’t “sell information about participating students to any third party without the student’s permission.” [Never mind that many of these students have not reached the age of consent.]
On a different, third page on their website designed for potential commercial customers, the purchase price of this data is made clear: 47 cents per student name.

The College Board is just as cagey and at times contradictory about what specific student data is shared with third parties through their “Student Search Service.” On their privacy policy page, they say the data may relate to the students’ “academic and extracurricular interests, career and field of study interests, family income, and religious preferences.”

A longer and more specific list of data is listed on the Student Search webpage, revealing that, depending on the test taken, it may include student email addresses, ethnicity, GPA, sports, or “educational aspirations.” On that same page, the College Board affirms that “we never share” information through this service relating to a student’s “disability status, self-reported parental income, Social security number, phone numbers, or actual test scores.”

Parents are forced to dig even deeper into a SAT registration booklet, to discover that while their child’s “actual test scores” may not be sold to third parties, “Colleges participating in Student Search … can ask for names of students within certain score ranges[emphasis mine].”

So unknowingly, students who are asked to answer questions from a survey before the administration of these exams may at the same time be unknowingly giving their permission to sell their data to a variety of institutions and organizations, who in turn, may then redisclose the data to other organizations and/or for-profit companies.

Last summer, in July of 2018, in an explosive article entitled “For Sale: Survey Data on Millions of High School Students,” the NY Times exposed how the College Board sells the personal information they collect via these surveys to various “partners,” who in turn may re-sell the data to for-profit companies, allowing them to use the information to market their dubious products and services to unsuspecting families.

The article described how thousands of students attended a “Congress of Future Science and Technology Leaders” costing $985, run by the for-profit National Leadership Academies. The company had bought their names and other data from an unnamed university, which in turn had purchased it from the College Board: “In filling out those surveys, the teenagers ended up signing away personal details that were later sold and shared with the future scientists event.” Once the data is sold by the College Board, it is nearly impossible to monitor any other use or redisclosures of the data.

College Board is far from the only untrustworthy actor in this regard. ACT has been similarly surreptitious about what personal student data is collected and sold to colleges and other third parties, through the survey on the online ACT Student Profile Section that students are asked to voluntarily fill out when registering or before taking the exam.

Without their knowledge, ACT allegedly identified student disability status through this information on the score reports sent to colleges and sold this information to colleges and other third parties. After this practice was discovered, a class action lawsuit was filed in August 2018 in the US District Court in Los Angeles. In a recent legal filing, ACT informed the court that it will no longer sell student disability status in the data collected voluntarily by students, but refused to admit to flagging its regular score reports with this information.

As Joel Reidenberg, a professor at the Fordham University School of Law, the head of the Center on Law and Information Policy told the NY Times, “The harm is that these children are being profiled, stereotyped, and their data profiles are being traded commercially for all sorts of uses — including attempts to manipulate them and their families.”

A research report co-authored by Professor Reidenberg found that there exists a thriving marketplace in student data, in which brokers offer a wide variety of sensitive student information for sale, including their ethnicity, income, religion, and interests, and that this data could “be used for a range of malicious purposes, including discrimination and identity theft.”

In 2014, after both New York and California passed laws prohibiting the selling of personal student data or their use for any commercial purposes, College Board and the ACT stepped in, realizing how these laws represented a severe threat to their thriving business in student data.

In Colorado, the College Board stepped in to persuade legislators to provide a special exemption from the law for their benefit – to allow school vendors to “sell, rent, or trade” personal student information for the “purpose of providing the student with information about employment, educational scholarship, financial aid, or postsecondary educational opportunities “ – as long as parents or students over the age of thirteen gave their consent.

In Arizona, Nebraska, North Carolina, Texas and Washington D.C. as well, their student privacy laws incorporated these exemptions, to allow the College Board and ACT to continue selling personal data for these purposes.

Now, these same companies, College Board and ACT, have apparently persuaded the NY State Department of Education to rewrite our state law by creating an expansive new loophole that would allow these practices to continue, by redefining the term “marketing” in the following way:

“Where a parent or eligible student requests a service or product from a third-party contractor and provides express consent to the use or disclosure of personally identifiable information by the third-party contractor for purposes of providing the requested product or service, such use by the third-party contractor shall not be deemed a marketing or commercial purpose prohibited by this Part.”

As PCSP and NYSAPE wrote in a letter to NYSED after the new draft regulations were revealed,

“To create a new, huge loophole in the law that would allow the College Board, ACT or any other contractor or subcontractor to sell student data and/or use it for marketing purposes, by making the untenable claim that such sale or marketing purpose is not truly marketing if there is consent, is a drastic weakening of the law which should NOT be contemplated….

If the College Board lobbyists or its supporters would like to eliminate the prohibition of the sale or marketing of student personal data in the law, they should go to the Legislature and ask that it be amended. This should not be done through regulations or by attempting to redefine the meaning of the term “marketing.”

In fact this loophole could benefit many other vendors, and even perhaps schools or districts that may want to profit off the use of student data, by asking for parental or student consent in surreptitious ways, for example requesting that they click on a button to signal their “consent” without carefully reading the privacy policy. Even if students or their parents knowingly consented to the initial marketing use or sale of the data, once the transfer of information has occurred, it is nearly impossible to track how it will be commercialized from that time on.

This wholesale rewriting and evisceration of the New York student privacy law should not be allowed. The deadline on public comment on the new regulations is September 16, and the Board of Regents are due to vote on the new regulations during their monthly meeting on October 8-9. Parents and all others who care about protecting children’s privacy should send in their comments now, by clicking here or sending their view to [email protected].

They should also call their Regents members, to urge them to reject these regulations which would violate the original intent of the law, and would open a Pandora’s box of an unfettered marketplace of personal student data, with potentially damaging results.