# Standards and Regulatory References — EdTech Privacy Assessment

## Primary Legislation

### COPPA — 16 CFR Part 312

- **Section 312.5(c)(4) — School Exception**: An operator is not required to obtain verifiable parental consent under Section 312.5(a) where the operator collects personal information from a child for the use and benefit of the school, and for no other commercial purpose.
- **FTC FAQ J.2**: "Schools should not be able to consent on behalf of the parent to the collection of information that is not needed for the educational purpose for which the school authorized the collection."
- **FTC FAQ J.3**: "A school's ability to consent for a parent is limited to the educational context — where an operator collects personal information from students for the use and benefit of the school, and for no other commercial purpose."

### FERPA — 20 U.S.C. Section 1232g

- **Section 1232g(a)(1)(A)**: Parents have the right to inspect and review education records maintained by the educational agency or institution.
- **Section 1232g(b)(1)**: Educational agencies shall not permit the release of education records without written consent, with exceptions.
- **Section 1232g(b)(1)(A)**: Exception for school officials with legitimate educational interests.
- **34 CFR 99.31(a)(1)**: School official exception permits disclosure to contractors performing institutional services, provided they are under the school's direct control, use records only for authorised purposes, and meet the school's criteria for school official designation.
- **34 CFR 99.33(a)**: Third parties receiving education records may not re-disclose without consent unless specific conditions are met.

### GDPR — Applicable Provisions for EdTech

- **Art. 6(1)(e)**: Processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority — applicable to schools' educational mission.
- **Art. 8**: Parental consent for children in information society services — applies when consent is the lawful basis; may not apply when public task is the basis.
- **Art. 28**: Data processing agreement required when school (controller) engages EdTech vendor (processor).

### UK GDPR and AADC

- All 15 AADC standards apply to EdTech services likely to be accessed by children.
- ICO has confirmed that EdTech platforms are in scope of the AADC even when used in school context.

## US State Student Privacy Laws

### California — Student Online Personal Information Protection Act (SOPIPA, 2014, Bus. & Prof. Code Section 22584)

- Prohibits operators of school-directed websites from: (a) using student information for non-educational targeted advertising; (b) selling student information; (c) using student information to create commercial profiles; (d) disclosing student information for non-educational purposes.
- Requires operators to implement reasonable security measures.
- Requires deletion of student information at the school's or district's request.

### New York — Education Law Section 2-d (2014, Amended 2020)

- Requires educational agencies to develop data privacy and security policies.
- Third-party contractors must execute data-sharing agreements.
- Parents must be notified of third-party access to student data.
- Breach notification required within specified timelines.
- Data must be encrypted in transit and at rest.

### Illinois — Student Online Personal Protection Act (SOPPA, 105 ILCS 85, Effective 2021)

- Extends COPPA-like protections to all K-12 students (not limited to under 13).
- Requires schools to provide parental notification before deploying EdTech.
- Prohibits operators from using covered information for targeted advertising, creating commercial profiles, or selling data.
- Requires data breach notification to schools within 30 days and to affected families within 10 days.

### Colorado — Student Data Transparency and Security Act (C.R.S. 22-16-101, 2016)

- Requires school contracts to specify data elements, purposes, security, and deletion.
- Prohibits targeted advertising directed at students based on data acquired through school use.
- Requires operator to delete data within 60 days of school's request.

### Connecticut — Student Data Privacy Act (PA 16-189, 2016)

- Prohibits operators from using student data for targeted advertising.
- Requires deletion of data within 30 days of request.
- Operators must maintain security standards.

### Texas — SCOPE Act (Tex. Bus. & Com. Code Section 521.401, 2017)

- Prohibits using covered information for non-educational purposes.
- Requires security standards and incident response procedures.
- Mandates deletion of data at end of contract or upon request.

### Virginia — Student Data Governance Plan (Va. Code Section 22.1-289.01, 2015)

- Requires schools to adopt data governance plans.
- Vendors must comply with school data governance policies.

### Maryland — Student Data Privacy Act (Md. Code Educ. Section 4-131, 2015)

- Prohibits using student data for advertising.
- Requires data security.
- Mandates deletion at end of contract.

## Voluntary Standards

### Student Privacy Pledge (FPF/SIIA)

Administered by the Future of Privacy Forum and the Software and Information Industry Association. Signatories commit to:
1. Not sell student personal information
2. Not behaviourally target advertising to students
3. Not create advertising profiles of students
4. Not change privacy policies without notice and choice
5. Enforce strict data retention and deletion limits
6. Support access to and correction of student information
7. Use data only for authorised educational purposes
8. Maintain comprehensive data security
9. Not disclose data except for legitimate educational purposes
10. Require downstream compliance

Over 400 EdTech companies are signatories as of 2024.

### CoSN (Consortium for School Networking) Trusted Learning Environment Seal

- Certification for school districts demonstrating strong data privacy practices.
- Covers: leadership, business practices, data security, professional development, and classroom practices.

### ISTE Standards for Students and Educators

- International Society for Technology in Education standards address digital citizenship including privacy awareness.
- ISTE 2.c.2: Students demonstrate an understanding of and respect for the rights and obligations of using and sharing intellectual property.

## Enforcement Decisions

- **Edmodo (FTC, 2023)**: USD 6 million penalty. Edmodo used student data collected under the COPPA school exception for advertising, exceeding the scope of the school exception. FTC order required deletion of data and prohibited future advertising use.
- **Google/YouTube (FTC, 2019)**: USD 170 million settlement included tracking on channels used in educational contexts.
- **InBloom (State enforcement, 2014)**: Student data aggregation platform shut down after New York, Louisiana, and other states raised FERPA and privacy concerns about centralised storage with inadequate access controls.
- **Chegg (FTC, 2023)**: FTC ordered comprehensive data security program after four breaches exposed student data. Required data minimisation and regular deletion.
- **New York AG v. Illuminate Education (2022)**: Settlement for data breach affecting 820,000 students. Required enhanced encryption, incident response, and notification procedures.

## Research

### Common Sense Media — Privacy Evaluations of EdTech Products (Ongoing)

- Publishes annual privacy evaluations of popular EdTech products used in schools.
- Evaluates transparency, data collection, data sharing, security, and compliance.
- Found that in 2023, only 22% of EdTech products evaluated received a "pass" rating for privacy practices.

### Fordham CLIP — Transparency and the Marketplace for Student Data (2018)

- Research finding that many EdTech vendors collect more data than necessary for educational purposes.
- Found widespread sharing of student data with third parties for non-educational purposes.
- Recommended stronger contractual protections and enforcement.