14 ms·

60% of school apps are sending student data with third parties without consent

agogdog 6y ago
What's the recourse from the student here? submit your data to third parties or fail? Inevitable lawsuit fuel?
- sldksk 6y ago
  Students are broke, so no lawsuit fuel.
  - nostromo 6y ago
    Municipalities are insured for lawsuits, and have the power of taxation; they are an attractive target for many lawyers.
- jimktrains2 6y ago
  Raising awareness and trying to get policy changed? Civil disobedience? If you have even a small percentage of the student body you have more than enough to affect change. Basically the same options citizens have, but at a much smaller scale, meaning individual contributions matter more.
- fny 6y ago
  Under FERPA, students have the right to contact your school and tell them to delist your directory information or submit pseudonymous information instead. However, data that is not considered PII isn't an issue, so even if you chose to anonymize yourself, they can still use Google Analytics to track your behaviors and remain compliant.
cle 6y ago
I looked at the full report too (https://me2ba.org/school-mobile-apps-student-data-sharing-behavior/ https://me2ba.org/school-mobile-apps-student-data-sharing-be...) and I still can’t find what the actual apps are. Who are the worst offenders? How do I know if I’m affected?
- deleted 6y ago
  [deleted]
godelski 6y ago
Is this legal? There's pretty strict regulations on what data you can share as an educator. Does this not apply to them? I imagined since HIPPA applies to anyone working with medical data that FERPA would apply to anyone working with education data (these companies).
- deleted 6y ago
  [deleted]
- fny 6y ago
  It is legal. What's protected under FERPA is data generated by the school that is given to a technology provider, not data generated by an app user. So yes, a school app can legally use Google Analytics or Facebook like buttons. So for as long as you're not sending PII, you're in the clear. ...However, it's actually allowable to send PII if the sending meets the following criterion: - Provides a service or function that the school would otherwise use its own staff - Be under the direct control of the school with regard to the use and maintenance of the PII from education records - Collection and use of the PII must be consistent with the school or district’s annual notification of rights under FERPA - Not re-disclose or use the education data for unauthorized purposes.
  - ryandrake 6y ago
    Not a lawyer, but wouldn’t COPPA [1] apply, at least if the student is under 13? 1: https://www.ftc.gov/enforcement/rules/rulemaking-regulatory-reform-proceedings/childrens-online-privacy-protection-rule https://www.ftc.gov/enforcement/rules/rulemaking-regulatory-...
    - fny 6y ago
      COPPA permits a school to obtain parental consent on the operator’s behalf, as long as the operator uses the information only on behalf of the school pursuant to the agreement between the school and the operator.
- gaius_baltar 6y ago
fn-mote 6y ago
While I am sure there are major issues in this area, I am not sure if this report provides an appropriate measure of them. My biggest concern is that there is no mention of G Suite Education or districts using Google-branded products (e.g. Google Classroom, Google Meet, Gmail), presumably[1] with an agreement that limits data sharing. Without distinguishing these use cases, it is hard to take the article seriously. If taken seriously, the graphs comparing Android and iOS apps (buried in the actual report, Figure 11) would be completely damning: > Android apps are about 8 times more likely than iOS apps to include very high-risk SDKs. Android apps are 3.5 times more likely than iOS apps to include high-risk SDKs. [1] Evidence that this does not exist would be interesting, but I would be very suprised to find out that large districts have no such agreements. Small districts? Sure, they are at the mercy of the vendor. [2] EFF article from 2015 saying at that time information was shared for non-advertising purposes. https://www.eff.org/press/releases/google-deceptively-tracks-students-internet-browsing-eff-says-complaint-federal-trade https://www.eff.org/press/releases/google-deceptively-tracks...
- II2II 6y ago
  > presumably[1] with an agreement that limits data sharing I have worked for both a municipal government and school boards. The difference in attitudes is astonishing. At the government level, the agreement is not enough. Confidential data, including personal information, must be hosted on servers within the country in order to ensure the data cannot be accessed by a third party without legal recourse. For school boards, an agreement suffices.
chiefalchemist 6y ago
I'd like to highlight that 60% of apps isn't synonymous with 60% of students. That is, if a dominant app(s) is used by e.g., 80% of students then the impact on privacy and such is even higher. Full disclosure: I recently finished reading "The Age of Surveillance Capitalism." While I understood the gist of the situation, the book shifted my paranoia even further.
canada_dry 6y ago
> the owners of the most (third parties accessing student data) were Google Hardly a shocker. Google has been successfully pushing their classroom.google.com at school boards for several years. Schools of course don't ask many tough questions and (I suspect) when installing/setting up it's next-next-finish. Students (and parents) really don't have a choice if their school advocates using the service. Glad my kids have long graduated so I haven't the need to fight to keep Google's hands out of (our) children's lives!
- luke2m 6y ago
  Yep. I’m in a k12 school, and we have google classroom on ipads and every proprietary thing you can think of. All my teachers have this annoying apple teacher image in their email signatures. No choice.
- varenc 6y ago
  I would expect Google Classrooms to be particularly good at not sending data to _third_ parties! They're already Google, so are not a third party. In this case it's at least clear and obvious that Google is being trusted with student data. And being Google, they already have in-house services for ad tracking, analytics, and what not. You're still sending data to Google, but at it seems less likely it'd then be sent out to other third parties with unclear privacy policies.
  - Wowfunhappy 6y ago
    This is also why I think concern over "third parties" is misguided. It needlessly advantages the biggest tech companies, and encourages them to get even bigger.
    - genocidicbunny 6y ago
      I think the definition of 'third party' really needs an update. It should include other business units of a company not related to the product. Google's Ad unit should have no access to the data generated from the Classrooms sites.
musicale 6y ago
Well, presumably 100% of Chromebooks are sending student data to Google; whether or not that qualifies as "third parties" and/or "consent" is debatable.
- realsimplesynd 6y ago
  Person in US school system here. I’ve had to use Chromebooks for school, and all I can think about is what Richard Stallman would do if he were in the US school system right now.
  - crazypython 6y ago
    I told him about part of a local school district. He politely told me, if he were a student, it would make him hate the system, even though the rules are very reasonable.
    - teddyh 6y ago
      Or maybe the rules aren’t actually “reasonable”.
gault8121 6y ago
In the report, not the summary, Firebase is listed as the most used 3rd party, with Firebase Messaging and Firebase Analytics being designated as "High Risk." When the report says "these apps are sending data to Google" it sounds like they are sending ad tracking data to commercialize off of this data, but tools like Firebase are common web hosting platforms, not data tracking tools. This is like saying data is being sent to Amazon Web Services. Here is the report: https://me2ba.org/school-mobile-apps-student-data-sharing-behavior/ https://me2ba.org/school-mobile-apps-student-data-sharing-be... As an edtech founder, I 100% agree that there should be more time spent holding school apps accountable for the data that they sent out, but this report doesn't accurately capture the risks present and how to hold organizations accountable.
- mro_name 6y ago
  IMO there's no such thing as a trustworthy 3rd party. To say the least they are very rare and not the big ones. They just can't care about all the small customers. If they mess one up it's no big deal for them. But if you are small and happen to be messed up it is a big deal for you. Asymmetry is a huge problem. And yes, what would XY-Analytics be other than stalking, put bluntly?
  - stingraycharles 6y ago
    The point is that Firebase may not even be a third party, but rather the hosting platform of the application. Like the parent says, it’s like saying that AWS is a third party and a high risk threat.
    - ectopod 6y ago
      Firebase is a hosting platform and a third party.
    - mattacular 6y ago
      AWS is a third party and if you use their services, they are handling your data. I suppose it's up to you to consider how much of a risk that is to your business.
jonas21 6y ago
They seem to consider any use of an SDK or library to be "data sharing". For example, if an app uses OkHttp (an open-source HTTP client library) [1] then it counts as data sharing. That doesn't seem right... [1] https://square.github.io/okhttp/ https://square.github.io/okhttp/
- esrauch 6y ago
  I feel like they must have just seen it was a library from Square and assumed it sent data to Square. I doubt that 40% of the apps were written with no SDK or library.
- GeneralTspoon 6y ago
  Yeah this entire thing just reeks of low effort clickbait. Classing OkHttp as "Medium Risk" is ridiculous (especially since under the hood it's been the default HTTP library on Android since something like 5.0). That alone signals that the authors don't have the the skills or expertise to carry out this study. It's a shame - since I bet there is definitely data being leaked places it shouldn't be in apps like these, and a proper investigation would be interesting.
dmclamb 6y ago
FERPA has no teeth. :(
temp737282 6y ago
Students are afforded very little privacy. I'm sure you've heard of administration software that lets school staff view and control student's computers remotely. One of my teachers even showed to the class that he was able to view the screen of a student who was absent from class, without the student's knowledge. The software also logs keystrokes (yes, including passwords) and browsing history. If that wasn't bad enough they also enforce custom certs so they can MITM ssl traffic. Many students log into their personal accounts on their school computers without realizing that they've compromised their passwords and sensitive personal information. Schools are also notoriously bad at security. My school force disabled Firefox updates, meaning every browser remained unpatched after multiple CVEs, one of which allowed websites to execute arbitrary code on the host's machine (sandbox escape).
- nine_k 6y ago
  I think it's good to teach the kids that these devices are not theirs in any way. They should expect no privacy whatsoever while using them. Later they will handle similarly any devices provided by employer. Tell the kids not to use such devices for anything that can raise an eyebrow, let alone raise a concern. Doing leetcode problems? Fine. Browsing Wikipedia? Fair enough. Watching educational videos on YouTube? Proceed with caution. Playing games? A bad idea, stop. Opening your private email / social network account / instant messenger? Please never don't do it again, and change your password just in case. This of course, is hard for kids. For many of them, it's the only real computer they have a chance to put their hands on. Which is, of course, bad. But fixing that is not very expansive: a reasonable used laptop can be had for $200, an RPi + a reasonable monitor, for less than $100. I hope most US families with kids who are genuinely interested in technology can afford it. (Getting the parents interested is a different problem.)
  - closeparen 6y ago
    In general we teach children not to do "anything that can raise an eyebrow" because it's wrong. Because the raised eyebrows of the adults who care for them are based in compassion, protection, and legitimate moral authority. And if they find themselves scheming about how to avoid the eyebrows then they are knowingly and intentionally doing something wrong, self-destructive, or both. And that is not the kind of people they are, or want to be. I think many parents would be profoundly uncomfortable spending significant money so that their children can evade supervision and guidance by authorities they are meant to respect. My own parents were pretty liberal, and it would still creep them out.
crazypython 6y ago
I asked Remind– a teacher-student communication app– to remove pings to Facebook ads, DoubleClick.net, and Google Ad Services from their site when students viewed messages. Allegedly they were being used to track the performance of ads they bought, and that the ad companies promised in their ToS not to use it for ad targeting. They were polite and removed it after 2 weeks. Last time I checked they added Twitter ads analytics again...
- tolbish 6y ago
  At this rate we'll need to give kids weekly throwaway identities akin to how we use throwaway email addresses and throwaway social media accounts.
- m463 6y ago
  I would say a lot of schools themselves add those things, just to do analytics. Heck, my doctor's website has google and doubleclick links - on the pages where I'm communicating with my doctor, or viewing test results! I complained and they said "our website is a convenience"
  - hedora 6y ago
    Did you point out they’re breaking the law when you complained?
canadianfella 6y ago
With?
jMyles 6y ago
Today's kids need end-to-end encryption. https://blog.nucypher.com/todays-kids-need-end-to-end-encryption/ https://blog.nucypher.com/todays-kids-need-end-to-end-encryp...
- juki 6y ago
  End-to-end encryption doesn't help when it's the app (i.e. one of the ends) that is sending the data away.
  - jMyles 6y ago
    That just needs bolder thinking about what represents the 'end'. If the phrase "end-to-end encryption" means strictly from network interface to network interface, without regard to application layer concerns, then part of the conversation is already missing.
    - hunter2_ 6y ago
      Between the NIC and the human is a massive stack that might be called the user agent (using that phrase way more broadly than just "browser" here) and so long as the human can audit all of it, it's reasonable to let all of it access the unencrypted data in an E2E scheme. But we know that's not merely unreasonable for the average user, but truly impossible for even the expert user, thanks to stuff like Intel Management Engine / AMD Secure Technology. Therefore the E2E scheme should attempt to keep the unencrypted data away from as much of the user agent stack as possible, perhaps ideally confining it to HID components. But then all you've got is unaltered human speech flowing from one human to another, with no data processing to chop it up, calculate on it, conditional logic based on it, nothing! It's quite a conundrum.
gnicholas 6y ago
> Android apps are much more likely than iOS apps to be sending data to third parties, and are much more likely to be sending to high or very high-risk third parties This seems like an important conclusion because most schools do not use Android. I run and edtech startup and we don't even have an Android app. No school has ever asked for one (individuals have, but not enough for us to build one). Most schools use Chromebooks or iPads.
- warrenm 6y ago
  Chromebooks are going to be doing a lot of "send to Google (and its affiliates)"
- indymike 6y ago
  Most chromebooks can now run Android apps, too
warrenm 6y ago
Only 60%? I would've expected this to be closer to 100%, honestly
duxup 6y ago
This year my son was assigned a login and password for a learning site by his school. I logged in the day it was assigned. Google Chrome immediately notified me that the login and password were part of a leak. I contacted the school IT to let them know that the service they used seemed to be compromised ( other parents saw the same alert), but they seemed confused how I would know the logins were compromised... Most school IT teams are woefully underfunded, and often aren't making decisions on what they use.
- Anthony-G 6y ago
  If the learning site was Edmodo, I wouldn’t worry about it. I was a member at the time and they notified me promptly¹. To date, it’s the only account I have that’s listed on Troy Hunt’s “Have I Been Pwned?”² but I was impressed with how they handled it and reassured that the passwords were stored with the bcrypt algorithm. 1. https://support.edmodo.com/hc/en-us/articles/115007376848-Important-Notice-About-Your-Edmodo-Account https://support.edmodo.com/hc/en-us/articles/115007376848-Im... 2. https://haveibeenpwned.com/ https://haveibeenpwned.com/
- Spooky23 6y ago
  Government agencies with “special” employee classes like schools are really stupid about funding choices. My neighbor makes >$100k as a coach — great guy, very talented, but ridiculous when you consider that they have like 10 IT people for a district with 15 schools, and the director makes $60k and gets a stipend for teaching some elective course. They meander along with a patchwork of consulting engagements through grants.
- ArnoVW 6y ago
  This being Hacker News I guess not, but did you use a user / password that you had used before on another site? Because in that case Chrome was just telling you that "one of the many sites you use (where you used this pwd) has been hacked in the past"
  - duxup 6y ago
    The username and passwords were issued by the site, you did not pick them and could not change them.
cromwellian 6y ago
Seems like literally any cloud hosting at all is considered third party by them, which would limit schools to running LAN based apps only with all local or LAN storage. They have an overly broad definition of 'third party', because the usual concerns are data being leaked and used for advertising, not hosting servers, databases, disks, or other app services, which usually have some privacy terms. Some people might think a non-cloud based solution for a school would be better, but would almost certainly be worse. Schools are terrible at IT, security, updates, provisioning, etc and very quickly, it would be hacked, if not by external people, than by one of their own students.
cm2012 6y ago
And in no case has any student been harmed by it. In general people on HN waaaay overestimate the danger of banal data sharing.
- JadeNB 6y ago
  > And in no case has any student been harmed by it. How can you possibly make such an assessment?
  - cm2012 6y ago
    Same way US law does. Absent specific laws, to have a claim you have to demonstrate tangible harm in some way. Burden of proof is on the claimant. And in 95% of the cases HN complains about, its impossible to find harm.
    - JadeNB 6y ago
      > Same way US law does. Absent specific laws, to have a claim you have to demonstrate tangible harm in some way. Burden of proof is on the claimant. And in 95% of the cases HN complains about, its impossible to find harm. I don't think you have any idea whether any of these students has even tried to find harm; but, even if you do know that, the inability to prove harm is a legal standard, but it's a far different thing from no harm being done. (I just recently read Rothstein's The color of law, which makes clear, for example, the situation in which people of colour today find themselves, where I think any reasonable person would agree that they have clearly been harmed by long-term racist policy-making in the US, but where there is no one person who meets the legal standard of having done them harm, and so no-one from whom they can seek legal redress.)
- teddyh 6y ago
  I beg to differ: https://www.rfc-editor.org/rfc/rfc7258.html https://www.rfc-editor.org/rfc/rfc7258.html
  - cm2012 6y ago
swiley 6y ago
There really should be a law against mandated use of non-free software, at least with children who won't know any better.
- Seirdy 6y ago
  Agreed. Children can't give informed consent to whatever the software may be doing behind the scenes (or in the backend) esp. if it handles their personal data. This is exactly the sort of thing the AGPL was made for: it should be possible for others to host and inspect software rather than blindly trust.
  - Aerroon 6y ago
    To be fair, very few people can really give informed consent on this topic. There's a million and one ways that you could be taken advantage of in a scheme like this.
    - tremon 6y ago
      That the subject matter is too complex to comprehend should be an additional reason to ban this practice entirely, not to accept it under the guise of "fairness".
    - swiley 6y ago
      Yeah that's why there are people who argue non-free software should be illegal entirely but it's much harder to convince people of this (although Apple and Google certainly have made it an easier case to make.)
    - Seirdy 6y ago
      This is true, but the right to inspect software has meaning even if it isn't used. It can be used by other people besides the proverbial "average Joe", and non-techs can ask tech friends about software. Every technical person also started out as a non-technical child. This is also a baseline, not the endgame. Software freedom is a necessary but insufficient condition for user freedom. I wrote about other conditions as well. HN discussion: https://news.ycombinator.com/item?id=25982860 https://news.ycombinator.com/item?id=25982860
chovybizzass 6y ago
It should be codified into law that schools have to use open source software.
cmeacham98 6y ago
"Without consent" is misleading and implies that everything is ok if they asked for consent. In reality, students are effectively coerced into giving consent if they want to graduate. When I went to University a few years ago no alternative was offered for almost all programs we used, even third party. Online submissions and gradebook (hosted canvas), anti-plagiarism (usually turnitin), etc. All these critical or straight up requires services I had to agree to. Maybe if I had made enough of a fuss I could have got an exemption but there was no easy way. I'd argue in privacy-related legislature like the GDPR students should be treated as incapable of consenting (to services used with their school), similar to how children are incapable of consenting to sex.
deleted 6y ago
[deleted]
8bitsrule 6y ago
This should be a gigantic red flag. Esp. where schooling is mandatory. The parents should know -the details- and consent. Every school district should be required to provide full details of at least: provider, data collected, anonymization status, all parties with access to data, and for how long. And District and parents must be notified of any changes in very short order. That way the District must be aware of it. The providers and District should also be appraised of their possible lliabilities: 1) If they don't provide that information, 2) If anything goes very wrong. Which is quite likely.
fossuser 6y ago
They forced us in high school to use a service called “TurnItIn” which I really disliked because they took ownership of your writing and added it to their database to diff against all future submissions. It’s supposed to prevent plagiarism, but it made me frustrated to be forced to aid in this system or fail. Being a public school student in the US sucks most of the time - no power and miserable adults. It’s like being imprisoned with some of the dumber, less successful people from the previous generation in charge of you and they have a lot of discretion over your future success. Some teachers are great obviously and make a huge difference, but many are truly awful. If they’re requiring services like turnitin as a matter of policy it’s not a surprise other stuff would be poorly handling student data too. School’s don’t value it, and even if they did - they don’t have the technical capability to fix it.
- mattmanser 6y ago
  I was going to give you some friendly advice that having the clichéd attitude that everyone else is stupid really makes for a miserable life. But then realized you're not a high school student as you joined in 2009 and you're called 'fossuser'. Bit of a lost cause maybe, but seriously, let the superiority complex go, it really doesn't help make you happy. I say this from experience.
  - fossuser 6y ago
    Everyone isn’t stupid - today I work with wonderful, very smart people I can learn from. HN and a lot of places online have wonderful people too. The average American public school teacher? They’re not that bright and they can be petty. I usually didn’t have trouble because I was a good student. Some examples: - Teacher in health class said BAC wasn’t lethal until 40%, when I mentioned I think it was .4% she said I forgot to multiply by 100. On the final the multiple choice answers for lethality ranged from 10% to 40% BAC. She also had an obvious hyper-Christian abstinence only lean despite state law to teach actual sex Ed. - Art teacher in elementary school called home and humiliated me in front of the class because I was talking about video games with another student while working on arts and crafts (this teacher hated video games). - Middle school history teacher hated children, picked favorites, and was just generally mean, would bully kids in the class. She was worse than most middle school students. It’s not a superiority complex, I had wonderful teachers too that cared about students and were kind. The incentives and pay of public schools are such that you get a lot of bad ones (and they’re impossible to fire). When I tried to tell adults about what was going on they often dismissed it with condescending nonsense “oh it’s a tough age” - no some of these people you have in charge of us are legitimately crazy and should not be in charge of children. Children have no power in school and it often sucks to be there.
anticristi 6y ago
Let me add to the rant. I complained to the Swedish Data Protection Authority (IMY) twice about such school apps. Their answers were consistently "we don't have the resources to pursue this case". With such a weak regulatory environment, the result is fairly expected. GDPR and data protection is not just a Google and Facebook thingy. My privacy needs to be respected by both big and small players.
- simpss 6y ago
  Turn to the European ombudsman and start forcing your government to work. https://www.ombudsman.europa.eu/en/publication/en/3510 https://www.ombudsman.europa.eu/en/publication/en/3510
donatj 6y ago
I work for a large educational company you have probably heard of on a product you may or may not have. I was on vacation a couple years ago, and in some downtime I was just scanning PRs awaiting code review, because I am bad at work/life balance. Lo and behold, there was a PR ready to go that would have exposed students directly to a third party. A reputable third party, but a third party nonetheless. It had the requisite votes but the user had not merged it. I very quickly threw up a blocking review and called my boss. I made quite a stink about it to my boss, but he didn’t seem to think it was a big deal. I went up the chain to his boss, and he also didn’t see what the problem was. At this point I call my bosses boss and basically beg him to talk to legal about it. He does, and they put the kibosh on the whole thing right out the gate. I’m sure I burned some political capital that day, but in my book at least it was well worth it. Hanlon's Razor in full effect. Even then though, I know these people well and know they’re not dumb, the way the web is structured makes it really easy to expose people and not even realize it.
- jon-wood 6y ago
  So often these things happen with the best of intentions. We use OS level geofencing support in our mobile apps at work to provide some functionality to customers, and have been looking at providers of better support for that recently to try and work round some problems. During a call someone mentioned they were looking at a provider who provides a full location history for debugging purposes, which was being looked on favourably (who doesn't want better debugging?) until I stepped in and pointed out we don't want to be anywhere near a full precise location history for our users. It provides basically no benefit to us other than debugging being a bit easier, and the massive risk that if someone's account for this service is compromised they've potentially facilitated stalking our users.
  - sneak 6y ago
    The third party doctrine in the US also means that this data is accessible without a warrant from the provider, if the provider turns it over on a request. The fact that it's your location doesn't matter, it's the provider's data to do with as they wish (including rat you out to police fishing expeditions) if they feel like it. Then again, anyone who has location services on systemwide on an iOS or Android device is sending this log to Apple/Google anyway (because location services transmits all of the visible Wi-Fi APs to Apple/Google to improve location). https://en.wikipedia.org/wiki/Third-party_doctrine https://en.wikipedia.org/wiki/Third-party_doctrine
ArnoVW 6y ago
We're creating a CRM / ERP SaaS specifically for consultancies. After spending some lawyer fees two years ago we've concluded that 'free consent' does not exist when your school or company proscribes a SaaS solution. If you say "do not consent" can you still use the application in the same way? Can you refuse to use the tool? Without impacting career or school results?
prakhargurunani 6y ago
This is why I switched to Supabase for my upcoming projects.
maxehmookau 6y ago
Only 60%? That surprises me.
gerash 6y ago
So if the report labels Google Sign-in and Firebase analytics high risk what's the point of reading it.
LatteLazy 6y ago
<off topic> I see a lot of sentences like this with wrong prepositions. It should be "sending ... to" third parties not "with" them. I see this error far more often than other errors and no one seems to object. "On accident" (it should be by accident) seems to be common parlance now. Are we changing how prepositions work?
shlant 6y ago
At Common Sense Media we have a project that evaluates various edtech apps for privacy concerns. You can check it out here: https://privacy.commonsense.org/ https://privacy.commonsense.org/
FriedrichN 6y ago
Schools are often big offenders when it comes to violating privacy. It's usually a combination of ignorance and arrogance. They don't know what they're allowed to do and assume they're allowed to do a lot more than they actually are. "You're a student, you signed up, now you belong to us!"
herbst 6y ago
When i did projects with and for our local university we had clear rules about where which data is allowed to go to. Which mostly ment not using any US services, and choose European services smartly. I still don't get why this kind of data protection is not more common especially for things like education.
alephu5 6y ago
This is tangential to the issue, but when I was in school, around 2005 in the UK we had a fascinating IT class where the the teacher explained all the different facts that can be derived from a simple loyalty card (the kind you use in shops to collect points and claim rewards). I don't remember all the details but I remember feeling alarmed by how much they can learn about you, and haven't ever used one since. I think it would be great to look at some benign hypothetical software platforms, with students, and run through this same exercise to understand why data protection matters.
maest 6y ago
Oh, this reminds me: One of my email addresses somehow ended up as the main parent address for a random student at Institut Els Pallaresos, a Catalan school. To be clear, I have no connection to this person, the emails just started coming out of the blue. I've chased the school to stop sending me emails; they said they'll update the email on the account, but nothing changed. I currently receive timely updates about this child concerning the following: * school events * grades * misbehaving in school * missed classes (the kid skips a lot of classes btw) * performance I am also able to use my email to sign into the account on ieduca (the software platform the school uses) and see a bunch of personal information (e.g. home address). I've repeatedly pointed this out to the school and they've done nothing about it. At this point I've resorted to sending all emails to spam.
- tokai 6y ago
  Maybe report the school? https://apdcat.gencat.cat/ca/seu_electronica/tramits/reclamacio/ https://apdcat.gencat.cat/ca/seu_electronica/tramits/reclama...
- account42 6y ago
  > (e.g. home address). Have you considered contacting the kid's parents about this?
  - maest 6y ago
    I'm already feeling uncomfortable having access to this private information. I don't want to make use of it in any way, and there's no telling how the family would receive the news.
erikerikson 6y ago
Did anyone find the list of apps they tested or reviewed (if I understand their references to AppFigures properly)? They, for example, show a picture of an app for Sioux Falls but the text is not findable in the report. It seems irresponsible not to report what they reviewed clearly.

What's the recourse from the student here? submit your data to third parties or fail? Inevitable lawsuit fuel?

sldksk 6y ago
Students are broke, so no lawsuit fuel.
- nostromo 6y ago
  Municipalities are insured for lawsuits, and have the power of taxation; they are an attractive target for many lawyers.
jimktrains2 6y ago
Raising awareness and trying to get policy changed? Civil disobedience? If you have even a small percentage of the student body you have more than enough to affect change. Basically the same options citizens have, but at a much smaller scale, meaning individual contributions matter more.
fny 6y ago
Under FERPA, students have the right to contact your school and tell them to delist your directory information or submit pseudonymous information instead. However, data that is not considered PII isn't an issue, so even if you chose to anonymize yourself, they can still use Google Analytics to track your behaviors and remain compliant.

cle 6y ago

I looked at the full report too (https://me2ba.org/school-mobile-apps-student-data-sharing-behavior/ https://me2ba.org/school-mobile-apps-student-data-sharing-be...) and I still can’t find what the actual apps are. Who are the worst offenders? How do I know if I’m affected?

deleted 6y ago
[deleted]

godelski 6y ago

Is this legal? There's pretty strict regulations on what data you can share as an educator. Does this not apply to them? I imagined since HIPPA applies to anyone working with medical data that FERPA would apply to anyone working with education data (these companies).

deleted 6y ago
[deleted]
fny 6y ago
It is legal. What's protected under FERPA is data generated by the school that is given to a technology provider, not data generated by an app user. So yes, a school app can legally use Google Analytics or Facebook like buttons. So for as long as you're not sending PII, you're in the clear. ...However, it's actually allowable to send PII if the sending meets the following criterion: - Provides a service or function that the school would otherwise use its own staff - Be under the direct control of the school with regard to the use and maintenance of the PII from education records - Collection and use of the PII must be consistent with the school or district’s annual notification of rights under FERPA - Not re-disclose or use the education data for unauthorized purposes.
- ryandrake 6y ago
  Not a lawyer, but wouldn’t COPPA [1] apply, at least if the student is under 13? 1: https://www.ftc.gov/enforcement/rules/rulemaking-regulatory-reform-proceedings/childrens-online-privacy-protection-rule https://www.ftc.gov/enforcement/rules/rulemaking-regulatory-...
  - fny 6y ago
    COPPA permits a school to obtain parental consent on the operator’s behalf, as long as the operator uses the information only on behalf of the school pursuant to the agreement between the school and the operator.
gaius_baltar 6y ago

fn-mote 6y ago

While I am sure there are major issues in this area, I am not sure if this report provides an appropriate measure of them. My biggest concern is that there is no mention of G Suite Education or districts using Google-branded products (e.g. Google Classroom, Google Meet, Gmail), presumably[1] with an agreement that limits data sharing. Without distinguishing these use cases, it is hard to take the article seriously. If taken seriously, the graphs comparing Android and iOS apps (buried in the actual report, Figure 11) would be completely damning: > Android apps are about 8 times more likely than iOS apps to include very high-risk SDKs. Android apps are 3.5 times more likely than iOS apps to include high-risk SDKs. [1] Evidence that this does not exist would be interesting, but I would be very suprised to find out that large districts have no such agreements. Small districts? Sure, they are at the mercy of the vendor. [2] EFF article from 2015 saying at that time information was shared for non-advertising purposes. https://www.eff.org/press/releases/google-deceptively-tracks-students-internet-browsing-eff-says-complaint-federal-trade https://www.eff.org/press/releases/google-deceptively-tracks...

II2II 6y ago
> presumably[1] with an agreement that limits data sharing I have worked for both a municipal government and school boards. The difference in attitudes is astonishing. At the government level, the agreement is not enough. Confidential data, including personal information, must be hosted on servers within the country in order to ensure the data cannot be accessed by a third party without legal recourse. For school boards, an agreement suffices.

chiefalchemist 6y ago

I'd like to highlight that 60% of apps isn't synonymous with 60% of students. That is, if a dominant app(s) is used by e.g., 80% of students then the impact on privacy and such is even higher. Full disclosure: I recently finished reading "The Age of Surveillance Capitalism." While I understood the gist of the situation, the book shifted my paranoia even further.

canada_dry 6y ago

> the owners of the most (third parties accessing student data) were Google Hardly a shocker. Google has been successfully pushing their classroom.google.com at school boards for several years. Schools of course don't ask many tough questions and (I suspect) when installing/setting up it's next-next-finish. Students (and parents) really don't have a choice if their school advocates using the service. Glad my kids have long graduated so I haven't the need to fight to keep Google's hands out of (our) children's lives!

luke2m 6y ago
Yep. I’m in a k12 school, and we have google classroom on ipads and every proprietary thing you can think of. All my teachers have this annoying apple teacher image in their email signatures. No choice.
varenc 6y ago
I would expect Google Classrooms to be particularly good at not sending data to _third_ parties! They're already Google, so are not a third party. In this case it's at least clear and obvious that Google is being trusted with student data. And being Google, they already have in-house services for ad tracking, analytics, and what not. You're still sending data to Google, but at it seems less likely it'd then be sent out to other third parties with unclear privacy policies.
- Wowfunhappy 6y ago
  This is also why I think concern over "third parties" is misguided. It needlessly advantages the biggest tech companies, and encourages them to get even bigger.
  - genocidicbunny 6y ago
    I think the definition of 'third party' really needs an update. It should include other business units of a company not related to the product. Google's Ad unit should have no access to the data generated from the Classrooms sites.

musicale 6y ago

Well, presumably 100% of Chromebooks are sending student data to Google; whether or not that qualifies as "third parties" and/or "consent" is debatable.

realsimplesynd 6y ago
Person in US school system here. I’ve had to use Chromebooks for school, and all I can think about is what Richard Stallman would do if he were in the US school system right now.
- crazypython 6y ago
  I told him about part of a local school district. He politely told me, if he were a student, it would make him hate the system, even though the rules are very reasonable.
  - teddyh 6y ago
    Or maybe the rules aren’t actually “reasonable”.

gault8121 6y ago

In the report, not the summary, Firebase is listed as the most used 3rd party, with Firebase Messaging and Firebase Analytics being designated as "High Risk." When the report says "these apps are sending data to Google" it sounds like they are sending ad tracking data to commercialize off of this data, but tools like Firebase are common web hosting platforms, not data tracking tools. This is like saying data is being sent to Amazon Web Services. Here is the report: https://me2ba.org/school-mobile-apps-student-data-sharing-behavior/ https://me2ba.org/school-mobile-apps-student-data-sharing-be... As an edtech founder, I 100% agree that there should be more time spent holding school apps accountable for the data that they sent out, but this report doesn't accurately capture the risks present and how to hold organizations accountable.

mro_name 6y ago
IMO there's no such thing as a trustworthy 3rd party. To say the least they are very rare and not the big ones. They just can't care about all the small customers. If they mess one up it's no big deal for them. But if you are small and happen to be messed up it is a big deal for you. Asymmetry is a huge problem. And yes, what would XY-Analytics be other than stalking, put bluntly?
- stingraycharles 6y ago
  The point is that Firebase may not even be a third party, but rather the hosting platform of the application. Like the parent says, it’s like saying that AWS is a third party and a high risk threat.
  - ectopod 6y ago
    Firebase is a hosting platform and a third party.
  - mattacular 6y ago
    AWS is a third party and if you use their services, they are handling your data. I suppose it's up to you to consider how much of a risk that is to your business.

jonas21 6y ago

They seem to consider any use of an SDK or library to be "data sharing". For example, if an app uses OkHttp (an open-source HTTP client library) [1] then it counts as data sharing. That doesn't seem right... [1] https://square.github.io/okhttp/ https://square.github.io/okhttp/

esrauch 6y ago
I feel like they must have just seen it was a library from Square and assumed it sent data to Square. I doubt that 40% of the apps were written with no SDK or library.
GeneralTspoon 6y ago
Yeah this entire thing just reeks of low effort clickbait. Classing OkHttp as "Medium Risk" is ridiculous (especially since under the hood it's been the default HTTP library on Android since something like 5.0). That alone signals that the authors don't have the the skills or expertise to carry out this study. It's a shame - since I bet there is definitely data being leaked places it shouldn't be in apps like these, and a proper investigation would be interesting.

dmclamb 6y ago

FERPA has no teeth. :(

temp737282 6y ago

Students are afforded very little privacy. I'm sure you've heard of administration software that lets school staff view and control student's computers remotely. One of my teachers even showed to the class that he was able to view the screen of a student who was absent from class, without the student's knowledge. The software also logs keystrokes (yes, including passwords) and browsing history. If that wasn't bad enough they also enforce custom certs so they can MITM ssl traffic. Many students log into their personal accounts on their school computers without realizing that they've compromised their passwords and sensitive personal information. Schools are also notoriously bad at security. My school force disabled Firefox updates, meaning every browser remained unpatched after multiple CVEs, one of which allowed websites to execute arbitrary code on the host's machine (sandbox escape).

nine_k 6y ago
I think it's good to teach the kids that these devices are not theirs in any way. They should expect no privacy whatsoever while using them. Later they will handle similarly any devices provided by employer. Tell the kids not to use such devices for anything that can raise an eyebrow, let alone raise a concern. Doing leetcode problems? Fine. Browsing Wikipedia? Fair enough. Watching educational videos on YouTube? Proceed with caution. Playing games? A bad idea, stop. Opening your private email / social network account / instant messenger? Please never don't do it again, and change your password just in case. This of course, is hard for kids. For many of them, it's the only real computer they have a chance to put their hands on. Which is, of course, bad. But fixing that is not very expansive: a reasonable used laptop can be had for $200, an RPi + a reasonable monitor, for less than $100. I hope most US families with kids who are genuinely interested in technology can afford it. (Getting the parents interested is a different problem.)
- closeparen 6y ago
  In general we teach children not to do "anything that can raise an eyebrow" because it's wrong. Because the raised eyebrows of the adults who care for them are based in compassion, protection, and legitimate moral authority. And if they find themselves scheming about how to avoid the eyebrows then they are knowingly and intentionally doing something wrong, self-destructive, or both. And that is not the kind of people they are, or want to be. I think many parents would be profoundly uncomfortable spending significant money so that their children can evade supervision and guidance by authorities they are meant to respect. My own parents were pretty liberal, and it would still creep them out.

crazypython 6y ago

I asked Remind– a teacher-student communication app– to remove pings to Facebook ads, DoubleClick.net, and Google Ad Services from their site when students viewed messages. Allegedly they were being used to track the performance of ads they bought, and that the ad companies promised in their ToS not to use it for ad targeting. They were polite and removed it after 2 weeks. Last time I checked they added Twitter ads analytics again...

tolbish 6y ago
At this rate we'll need to give kids weekly throwaway identities akin to how we use throwaway email addresses and throwaway social media accounts.
m463 6y ago
I would say a lot of schools themselves add those things, just to do analytics. Heck, my doctor's website has google and doubleclick links - on the pages where I'm communicating with my doctor, or viewing test results! I complained and they said "our website is a convenience"
- hedora 6y ago
  Did you point out they’re breaking the law when you complained?

canadianfella 6y ago

With?

jMyles 6y ago

Today's kids need end-to-end encryption. https://blog.nucypher.com/todays-kids-need-end-to-end-encryption/ https://blog.nucypher.com/todays-kids-need-end-to-end-encryp...

juki 6y ago
End-to-end encryption doesn't help when it's the app (i.e. one of the ends) that is sending the data away.
- jMyles 6y ago
  That just needs bolder thinking about what represents the 'end'. If the phrase "end-to-end encryption" means strictly from network interface to network interface, without regard to application layer concerns, then part of the conversation is already missing.
  - hunter2_ 6y ago
    Between the NIC and the human is a massive stack that might be called the user agent (using that phrase way more broadly than just "browser" here) and so long as the human can audit all of it, it's reasonable to let all of it access the unencrypted data in an E2E scheme. But we know that's not merely unreasonable for the average user, but truly impossible for even the expert user, thanks to stuff like Intel Management Engine / AMD Secure Technology. Therefore the E2E scheme should attempt to keep the unencrypted data away from as much of the user agent stack as possible, perhaps ideally confining it to HID components. But then all you've got is unaltered human speech flowing from one human to another, with no data processing to chop it up, calculate on it, conditional logic based on it, nothing! It's quite a conundrum.

gnicholas 6y ago

> Android apps are much more likely than iOS apps to be sending data to third parties, and are much more likely to be sending to high or very high-risk third parties This seems like an important conclusion because most schools do not use Android. I run and edtech startup and we don't even have an Android app. No school has ever asked for one (individuals have, but not enough for us to build one). Most schools use Chromebooks or iPads.

warrenm 6y ago
Chromebooks are going to be doing a lot of "send to Google (and its affiliates)"
indymike 6y ago
Most chromebooks can now run Android apps, too

warrenm 6y ago

Only 60%? I would've expected this to be closer to 100%, honestly

duxup 6y ago

This year my son was assigned a login and password for a learning site by his school. I logged in the day it was assigned. Google Chrome immediately notified me that the login and password were part of a leak. I contacted the school IT to let them know that the service they used seemed to be compromised ( other parents saw the same alert), but they seemed confused how I would know the logins were compromised... Most school IT teams are woefully underfunded, and often aren't making decisions on what they use.

Anthony-G 6y ago
If the learning site was Edmodo, I wouldn’t worry about it. I was a member at the time and they notified me promptly¹. To date, it’s the only account I have that’s listed on Troy Hunt’s “Have I Been Pwned?”² but I was impressed with how they handled it and reassured that the passwords were stored with the bcrypt algorithm. 1. https://support.edmodo.com/hc/en-us/articles/115007376848-Important-Notice-About-Your-Edmodo-Account https://support.edmodo.com/hc/en-us/articles/115007376848-Im... 2. https://haveibeenpwned.com/ https://haveibeenpwned.com/
Spooky23 6y ago
Government agencies with “special” employee classes like schools are really stupid about funding choices. My neighbor makes >$100k as a coach — great guy, very talented, but ridiculous when you consider that they have like 10 IT people for a district with 15 schools, and the director makes $60k and gets a stipend for teaching some elective course. They meander along with a patchwork of consulting engagements through grants.
ArnoVW 6y ago
This being Hacker News I guess not, but did you use a user / password that you had used before on another site? Because in that case Chrome was just telling you that "one of the many sites you use (where you used this pwd) has been hacked in the past"
- duxup 6y ago
  The username and passwords were issued by the site, you did not pick them and could not change them.

cromwellian 6y ago

Seems like literally any cloud hosting at all is considered third party by them, which would limit schools to running LAN based apps only with all local or LAN storage. They have an overly broad definition of 'third party', because the usual concerns are data being leaked and used for advertising, not hosting servers, databases, disks, or other app services, which usually have some privacy terms. Some people might think a non-cloud based solution for a school would be better, but would almost certainly be worse. Schools are terrible at IT, security, updates, provisioning, etc and very quickly, it would be hacked, if not by external people, than by one of their own students.

cm2012 6y ago

And in no case has any student been harmed by it. In general people on HN waaaay overestimate the danger of banal data sharing.

JadeNB 6y ago
> And in no case has any student been harmed by it. How can you possibly make such an assessment?
- cm2012 6y ago
  Same way US law does. Absent specific laws, to have a claim you have to demonstrate tangible harm in some way. Burden of proof is on the claimant. And in 95% of the cases HN complains about, its impossible to find harm.
  - JadeNB 6y ago
    > Same way US law does. Absent specific laws, to have a claim you have to demonstrate tangible harm in some way. Burden of proof is on the claimant. And in 95% of the cases HN complains about, its impossible to find harm. I don't think you have any idea whether any of these students has even tried to find harm; but, even if you do know that, the inability to prove harm is a legal standard, but it's a far different thing from no harm being done. (I just recently read Rothstein's The color of law, which makes clear, for example, the situation in which people of colour today find themselves, where I think any reasonable person would agree that they have clearly been harmed by long-term racist policy-making in the US, but where there is no one person who meets the legal standard of having done them harm, and so no-one from whom they can seek legal redress.)
teddyh 6y ago
I beg to differ: https://www.rfc-editor.org/rfc/rfc7258.html https://www.rfc-editor.org/rfc/rfc7258.html
- cm2012 6y ago

swiley 6y ago

There really should be a law against mandated use of non-free software, at least with children who won't know any better.

Seirdy 6y ago
Agreed. Children can't give informed consent to whatever the software may be doing behind the scenes (or in the backend) esp. if it handles their personal data. This is exactly the sort of thing the AGPL was made for: it should be possible for others to host and inspect software rather than blindly trust.
- Aerroon 6y ago
  To be fair, very few people can really give informed consent on this topic. There's a million and one ways that you could be taken advantage of in a scheme like this.
  - tremon 6y ago
    That the subject matter is too complex to comprehend should be an additional reason to ban this practice entirely, not to accept it under the guise of "fairness".
  - swiley 6y ago
    Yeah that's why there are people who argue non-free software should be illegal entirely but it's much harder to convince people of this (although Apple and Google certainly have made it an easier case to make.)
  - Seirdy 6y ago
    This is true, but the right to inspect software has meaning even if it isn't used. It can be used by other people besides the proverbial "average Joe", and non-techs can ask tech friends about software. Every technical person also started out as a non-technical child. This is also a baseline, not the endgame. Software freedom is a necessary but insufficient condition for user freedom. I wrote about other conditions as well. HN discussion: https://news.ycombinator.com/item?id=25982860 https://news.ycombinator.com/item?id=25982860

chovybizzass 6y ago

It should be codified into law that schools have to use open source software.

cmeacham98 6y ago

"Without consent" is misleading and implies that everything is ok if they asked for consent. In reality, students are effectively coerced into giving consent if they want to graduate. When I went to University a few years ago no alternative was offered for almost all programs we used, even third party. Online submissions and gradebook (hosted canvas), anti-plagiarism (usually turnitin), etc. All these critical or straight up requires services I had to agree to. Maybe if I had made enough of a fuss I could have got an exemption but there was no easy way. I'd argue in privacy-related legislature like the GDPR students should be treated as incapable of consenting (to services used with their school), similar to how children are incapable of consenting to sex.

deleted 6y ago

[deleted]

8bitsrule 6y ago

This should be a gigantic red flag. Esp. where schooling is mandatory. The parents should know -the details- and consent. Every school district should be required to provide full details of at least: provider, data collected, anonymization status, all parties with access to data, and for how long. And District and parents must be notified of any changes in very short order. That way the District must be aware of it. The providers and District should also be appraised of their possible lliabilities: 1) If they don't provide that information, 2) If anything goes very wrong. Which is quite likely.

fossuser 6y ago

They forced us in high school to use a service called “TurnItIn” which I really disliked because they took ownership of your writing and added it to their database to diff against all future submissions. It’s supposed to prevent plagiarism, but it made me frustrated to be forced to aid in this system or fail. Being a public school student in the US sucks most of the time - no power and miserable adults. It’s like being imprisoned with some of the dumber, less successful people from the previous generation in charge of you and they have a lot of discretion over your future success. Some teachers are great obviously and make a huge difference, but many are truly awful. If they’re requiring services like turnitin as a matter of policy it’s not a surprise other stuff would be poorly handling student data too. School’s don’t value it, and even if they did - they don’t have the technical capability to fix it.

mattmanser 6y ago
I was going to give you some friendly advice that having the clichéd attitude that everyone else is stupid really makes for a miserable life. But then realized you're not a high school student as you joined in 2009 and you're called 'fossuser'. Bit of a lost cause maybe, but seriously, let the superiority complex go, it really doesn't help make you happy. I say this from experience.
- fossuser 6y ago
  Everyone isn’t stupid - today I work with wonderful, very smart people I can learn from. HN and a lot of places online have wonderful people too. The average American public school teacher? They’re not that bright and they can be petty. I usually didn’t have trouble because I was a good student. Some examples: - Teacher in health class said BAC wasn’t lethal until 40%, when I mentioned I think it was .4% she said I forgot to multiply by 100. On the final the multiple choice answers for lethality ranged from 10% to 40% BAC. She also had an obvious hyper-Christian abstinence only lean despite state law to teach actual sex Ed. - Art teacher in elementary school called home and humiliated me in front of the class because I was talking about video games with another student while working on arts and crafts (this teacher hated video games). - Middle school history teacher hated children, picked favorites, and was just generally mean, would bully kids in the class. She was worse than most middle school students. It’s not a superiority complex, I had wonderful teachers too that cared about students and were kind. The incentives and pay of public schools are such that you get a lot of bad ones (and they’re impossible to fire). When I tried to tell adults about what was going on they often dismissed it with condescending nonsense “oh it’s a tough age” - no some of these people you have in charge of us are legitimately crazy and should not be in charge of children. Children have no power in school and it often sucks to be there.

anticristi 6y ago

Let me add to the rant. I complained to the Swedish Data Protection Authority (IMY) twice about such school apps. Their answers were consistently "we don't have the resources to pursue this case". With such a weak regulatory environment, the result is fairly expected. GDPR and data protection is not just a Google and Facebook thingy. My privacy needs to be respected by both big and small players.

simpss 6y ago
Turn to the European ombudsman and start forcing your government to work. https://www.ombudsman.europa.eu/en/publication/en/3510 https://www.ombudsman.europa.eu/en/publication/en/3510

donatj 6y ago

I work for a large educational company you have probably heard of on a product you may or may not have. I was on vacation a couple years ago, and in some downtime I was just scanning PRs awaiting code review, because I am bad at work/life balance. Lo and behold, there was a PR ready to go that would have exposed students directly to a third party. A reputable third party, but a third party nonetheless. It had the requisite votes but the user had not merged it. I very quickly threw up a blocking review and called my boss. I made quite a stink about it to my boss, but he didn’t seem to think it was a big deal. I went up the chain to his boss, and he also didn’t see what the problem was. At this point I call my bosses boss and basically beg him to talk to legal about it. He does, and they put the kibosh on the whole thing right out the gate. I’m sure I burned some political capital that day, but in my book at least it was well worth it. Hanlon's Razor in full effect. Even then though, I know these people well and know they’re not dumb, the way the web is structured makes it really easy to expose people and not even realize it.

jon-wood 6y ago
So often these things happen with the best of intentions. We use OS level geofencing support in our mobile apps at work to provide some functionality to customers, and have been looking at providers of better support for that recently to try and work round some problems. During a call someone mentioned they were looking at a provider who provides a full location history for debugging purposes, which was being looked on favourably (who doesn't want better debugging?) until I stepped in and pointed out we don't want to be anywhere near a full precise location history for our users. It provides basically no benefit to us other than debugging being a bit easier, and the massive risk that if someone's account for this service is compromised they've potentially facilitated stalking our users.
- sneak 6y ago
  The third party doctrine in the US also means that this data is accessible without a warrant from the provider, if the provider turns it over on a request. The fact that it's your location doesn't matter, it's the provider's data to do with as they wish (including rat you out to police fishing expeditions) if they feel like it. Then again, anyone who has location services on systemwide on an iOS or Android device is sending this log to Apple/Google anyway (because location services transmits all of the visible Wi-Fi APs to Apple/Google to improve location). https://en.wikipedia.org/wiki/Third-party_doctrine https://en.wikipedia.org/wiki/Third-party_doctrine

ArnoVW 6y ago

We're creating a CRM / ERP SaaS specifically for consultancies. After spending some lawyer fees two years ago we've concluded that 'free consent' does not exist when your school or company proscribes a SaaS solution. If you say "do not consent" can you still use the application in the same way? Can you refuse to use the tool? Without impacting career or school results?

prakhargurunani 6y ago

This is why I switched to Supabase for my upcoming projects.

maxehmookau 6y ago

Only 60%? That surprises me.

gerash 6y ago

So if the report labels Google Sign-in and Firebase analytics high risk what's the point of reading it.

LatteLazy 6y ago

<off topic> I see a lot of sentences like this with wrong prepositions. It should be "sending ... to" third parties not "with" them. I see this error far more often than other errors and no one seems to object. "On accident" (it should be by accident) seems to be common parlance now. Are we changing how prepositions work?

shlant 6y ago

At Common Sense Media we have a project that evaluates various edtech apps for privacy concerns. You can check it out here: https://privacy.commonsense.org/ https://privacy.commonsense.org/

FriedrichN 6y ago

Schools are often big offenders when it comes to violating privacy. It's usually a combination of ignorance and arrogance. They don't know what they're allowed to do and assume they're allowed to do a lot more than they actually are. "You're a student, you signed up, now you belong to us!"

herbst 6y ago

When i did projects with and for our local university we had clear rules about where which data is allowed to go to. Which mostly ment not using any US services, and choose European services smartly. I still don't get why this kind of data protection is not more common especially for things like education.

alephu5 6y ago

This is tangential to the issue, but when I was in school, around 2005 in the UK we had a fascinating IT class where the the teacher explained all the different facts that can be derived from a simple loyalty card (the kind you use in shops to collect points and claim rewards). I don't remember all the details but I remember feeling alarmed by how much they can learn about you, and haven't ever used one since. I think it would be great to look at some benign hypothetical software platforms, with students, and run through this same exercise to understand why data protection matters.

maest 6y ago

Oh, this reminds me: One of my email addresses somehow ended up as the main parent address for a random student at Institut Els Pallaresos, a Catalan school. To be clear, I have no connection to this person, the emails just started coming out of the blue. I've chased the school to stop sending me emails; they said they'll update the email on the account, but nothing changed. I currently receive timely updates about this child concerning the following: * school events * grades * misbehaving in school * missed classes (the kid skips a lot of classes btw) * performance I am also able to use my email to sign into the account on ieduca (the software platform the school uses) and see a bunch of personal information (e.g. home address). I've repeatedly pointed this out to the school and they've done nothing about it. At this point I've resorted to sending all emails to spam.

tokai 6y ago
Maybe report the school? https://apdcat.gencat.cat/ca/seu_electronica/tramits/reclamacio/ https://apdcat.gencat.cat/ca/seu_electronica/tramits/reclama...
account42 6y ago
> (e.g. home address). Have you considered contacting the kid's parents about this?
- maest 6y ago
  I'm already feeling uncomfortable having access to this private information. I don't want to make use of it in any way, and there's no telling how the family would receive the news.

erikerikson 6y ago

Did anyone find the list of apps they tested or reviewed (if I understand their references to AppFigures properly)? They, for example, show a picture of an app for Sioux Falls but the text is not findable in the report. It seems irresponsible not to report what they reviewed clearly.