Oct. 17, 2024

On Sept. 10, along with NYCLU and AI for Families, we wrote the Mayor, the DOE Chancellor, and the Commissioner of  Health about our deep concerns with the way in which the online mental health company Teenspace allows for the sharing of personal information with unnamed third parties for marketing purposes in a manner that would be illegal if the contract was signed by the DOE rather than the Dept. of Health. Their parent company, Talkspace, is being paid $26 million over three years by the city to provide free counseling to students, and the Mayor, the Commissioner of Health and the DOE have all been aggressively encouraging NYC students to sign up for these services, with no mention of how their personal data may be used for predatory marketing and other commercial purposes which could further undermine their mental health.   More on this here.

On Sept. 23,  Dept. of Health responded, arguing that they did not have to abide by the state student privacy law since they were not an education agency, but assuring us that their contract was no less  protective.  On Oct. 8,  we received the Talkspace contract via a Freedom of Information Law request.

The contract did not dispel our concerns.  Since we sent our initial letter, we had discovered that when a NYC student visits the Teenspace website on their phone, their personally identifiable information is shared with 15 ad trackers and 34 cookies, as well as Facebook, Amazon, Meta, Google, and Microsoft among other companies, which we saw from using the Blacklight  privacy audit tool. These findings were later confirmed by a security company that does privacy analyses.  These findings are particularly concerning, given how the city is suing many of these companies for how they are designed to be addictive to children in order to maximize their revenues via targeted advertising.

Our follow-up letter to the Dept. of Health is below, copied to  other city officials.  If you’d like to hear more about Teenspace and other threats to student privacy, please attend our privacy briefing on Wed. October  23 at 7 PM EST; you can register here.