concerns-questions.md

Data Collection: Protecting personal information

Evaluating data collection takes into consideration best practices of limiting the type and amount of personal information collected from a user to only the information needed to provide the application or service.

2.1.1: Collect PII (BASIC)

Do the policies clearly indicate whether or not the vendor collects personally identifiable information (PII)?

• Indicator
  • Discloses Personally Identifiable Information (PII) is collected.
  • Discloses how the product collects personal information.
• Citation
  • Children's Online Privacy Protection Act: (Personally Identifiable Information under COPPA includes first and last name, photos, videos, audio, geolocation information, persistent identifiers, IP address, cookies, and unique device identifiers) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2
  • California Online Privacy Protection Act: (The term "Personally Identifiable Information" under CalOPPA means individually identifiable information about a consumer collected online by the operator from that individual and maintained by the operator in an accessible form, including any of the following: (1) A first and last name; (2) A home or other physical address, including street name and name of a city or town; (3) An e-mail address; (4) A telephone number; (5) A social security number; or (6) Any other identifier that permits the physical or online contacting of a specific individual) See California Online Privacy Protection Act (CalOPPA), Cal. B.&P. Code §22577(a)(1)-(6)
  • Family Educational Rights and Privacy Act: ("Personal Information" under FERPA includes direct identifiers such as a student or family member's name, or indirect identifiers such as a date of birth, or mother's maiden name, or other information that is linkable to a specific student that would allow a reasonable person in the school community to identify the student with reasonable certainty) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.3
  • General Data Protection Regulation: (“personal data” means any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person) See General Data Protection Regulation (GDPR), Definitions, Art. 4(1)
• Background
  • FERPA defines the term personally identifiable information (PII) to include direct identifiers (such as a student's or other family member's name) and indirect identifiers (such as a student's date of birth, place of birth, or mother's maiden name). Indirect identifiers include metadata about a student's interaction with an application or service, and even aggregate information can be considered PII under FERPA if a reasonable person in the school community could identify individual students based on the indirect identifiers together with other reasonably available information, including other public information. See PTAC, Responsibilities of Third-Party Service Providers under FERPA, p. 2; See PTAC, Protecting Student Privacy While Using Online Educational Services: Model Terms of Service, p. 2.
  • Companies collect a wide range of personal information from users—from personal details and account profiles to a user’s activities and location. We expect companies to clearly disclose what user information they collect and how they do so. See Ranking Digital Rights, P3.
  • The term “user information” appears in many indicators throughout the Privacy category. An expansive interpretation of user information is defined as: “any data that is connected to an identifiable person, or may be connected to such a person by combining datasets or utilizing data-mining techniques.” As further explanation, user information is any data that documents a user’s characteristics and/or activities. This information may or may not be tied to a specific user account. This information includes, but is not limited to, personal correspondence, user-generated content, account preferences and settings, log and access data, data about a user’s activities or preferences collected from third parties either through behavioral tracking or purchasing of data, and all forms of metadata. See Ranking Digital Rights, P3.

2.1.2: PII Categories

Do the policies clearly indicate what categories of personally identifiable information are collected by the product?

• Indicator
  • Discloses what types of user information is collected.
  • Discloses how user information is collected.
• Citation
  • California Online Privacy Protection Act: (An operator is required to identify the categories of personally identifiable information that they collect about individual consumers who use or visit its website or online service) See California Online Privacy Protection Act (CalOPPA), Cal. B.&P. Code §22575(b)(1)
  • Children's Online Privacy Protection Act: (A parent or guardian can request the operator to provide a description of the specific types or categories of personal information collected from children by the application or service) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.6(a)(1)
  • General Data Protection Regulation: (Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information: ... (d) the categories of personal data concerned) See General Data Protection Regulation (GDPR), Information to be provided where personal data have not been obtained from the data subject, Art. 14(1)(d)
  • General Data Protection Regulation: (The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and where that is the case, access to the personal data and the following information: ... (b) the categories of personal data concerned) See General Data Protection Regulation (GDPR), Right of access by the data subject, Art. 15(1)(b)
• Background
  • If companies collect multiple types of information, we expect them to provide detail on how they handle each type of information. See Ranking Digital Rights, P3.

2.4.1: Collection Limitation (BASIC)

Do the policies clearly indicate whether or not the vendor limits the collection or use of information to only data that are specifically required for the product?

• Indicator
  • Discloses user information is only collected if it is directly relevant or necessary for the product to function.
• Citation
  • Children's Online Privacy Protection Act: (A vendor is prohibited from conditioning a child's participation in a game or prize on the child disclosing more info than necessary to participate in the activity) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.7
  • Family Educational Rights and Privacy Act: (An educational institution must use reasonable methods to ensure that school officials only use information for which they have a legitimate educational interest) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.31(a)(1)(ii)
  • General Data Protection Regulation: ([Data shall be] adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed) See General Data Protection Regulation (GDPR), Principles relating to processing of personal data, Art. 5(1)(c)
  • General Data Protection Regulation: (When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.) See General Data Protection Regulation (GDPR), Conditions for Consent, Art. 7(4)
  • General Data Protection Regulation: (Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects.) See General Data Protection Regulation (GDPR), Data protection by design and by default, Art. 25(1)
• Background
  • Privacy principles are intended to work together to shift the burden for protecting privacy away from consumers and to encourage companies to make strong privacy protections the default. Reasonable collection limits and data disposal policies work in tandem with streamlined notices and improved consumer choice mechanisms. Together, they function to provide substantive protections by placing reasonable limits on the collection, use, and retention of consumer data to more closely align with consumer expectations, while also raising consumer awareness about the nature and extent of data collection, use, and third-party sharing, and the choices available to them. See FTC, Protecting Consumer Privacy in an era of rapid change: recommendations for business and policy makers (2012), p. 24.
  • Companies should limit data collection to that which is consistent with the context of a particular transaction or the consumer's relationship with the business, or as required or specifically authorized by law. For any data collection that is inconsistent with these contexts, companies should make appropriate disclosures to consumers at a relevant time and in a prominent manner – outside of a privacy policy or other legal document. This clarification of the collection limitation principle is intended to help companies assess whether their data collection is consistent with what a consumer might expect, but if it is not, they should provide prominent notice and choice. See FTC, Protecting Consumer Privacy in an era of rapid change: recommendations for business and policy makers (2012), p. 27.
  • Data Minimization is a privacy principle best practice that requires companies to limit the data they collect and retain, and dispose of it once they no longer need it. This best practice is reinforced by the FTC which encourages companies to collect only the data they need to accomplish a specific business purpose, which is generally supported by several privacy frameworks and federal privacy statutes and regulations such as FERPA, COPPA, and the Health Insurance Portability and Accountability Act of 1996 (HIPAA). See The Organisation for Economic Co-operation and Development (OECD) Privacy Framework (2013); See Asia-Pacific Economic Cooperation (APEC) Privacy Framework; See also FTC, Internet of Things, Privacy and Security in a Connected World (2015), p. 24.
  • A vendor should practice data minimization and collect only the student information necessary to accomplish the school purposes their site or service is designed to achieve or as directed by the school or district. See Ready for School, Recommendations for the Ed Tech Industry to Protect the Privacy of Student Data (November 2016), CA. D.O.J., p. 12.
  • We expect companies to commit to the principle of data minimization and to demonstrate how this principle shapes their practices regarding user information. See Ranking Digital Rights, P3.

2.1.3: Geolocation Data

Do the policies clearly indicate whether or not precise geolocation data are collected?

• Indicator
  • Discloses location information is collected.
  • Discloses location information is derived from usage information.
• Citation
  • Children's Online Privacy Protection Act: (Personally Identifiable Information under COPPA includes first and last name, photos, videos, audio, geolocation information, persistent identifiers, IP address, cookies, and unique device identifiers) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2
  • Family Educational Rights and Privacy Act: ("Personal Information" under FERPA includes direct identifiers such as a student or family member's name, or indirect identifiers such as a date of birth, or mother's maiden name, or other information that is linkable to a specific student that would allow a reasonable person in the school community to identify the student with reasonable certainty) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.3
  • Student Online Personal Information Protection Act: ("Covered Information" under SOPIPA is personally identifiable information that includes descriptive information or identifies a student that was created or provided by a student, parent, teacher, district staff, or gathered by an operator through the operation of the site) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(i)(1)-(3)
  • California Online Privacy Protection Act: (The term "Personally Identifiable Information" under CalOPPA means individually identifiable information about a consumer collected online by the operator from that individual and maintained by the operator in an accessible form, including any of the following: (1) A first and last name; (2) A home or other physical address, including street name and name of a city or town; (3) An e-mail address; (4) A telephone number; (5) A social security number; or (6) Any other identifier that permits the physical or online contacting of a specific individual) See California Online Privacy Protection Act (CalOPPA), Cal. B.&P. Code §22577(a)(1)-(6)
  • General Data Protection Regulation: (“personal data” means any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person) See General Data Protection Regulation (GDPR), Definitions, Art. 4(1)
• Background
  • Location information collected in the mobile context is considered a persistent identifier that can be used to recognize a user over time and across different websites or online services. Geolocation data includes information sufficient to identify the latitude and longitude coordinates of a user that can correspond to a specific street, address, name of a city or town. If location data is collected and shared with third-parties, companies should work to provide consumers with more prominent notice and choices about its geolocation data collection, transfer, use, and disposal practices. See FTC, Protecting Consumer Privacy in an era of rapid change: recommendations for business and policy makers (2012), p. 33; See also U.S. v. Jones, 132 S. Ct. 945, 955 (2012)("GPS monitoring generates a precise, comprehensive record of a person's public movements that reflects a wealth of detail about her familial, political, professional, religious, and sexual associations").
  • For mobile ecosystems, we expect companies to clearly disclose what options users have to control the collection of their location information. A user’s location changes frequently and many users carry their mobile devices nearly everywhere, making the collection of this type of information particularly sensitive. In addition, the location settings on mobile ecosystems can influence how other products and services access their location information. For instance, mobile apps may enable users to control location information. However, if the device on which those mobile apps run collects geolocation data by default and does not give users a way to turn this off, users may not be able to limit that mobile app's collection of their location information. For these reasons, we expect companies to disclose that users can control how their device interacts with their location information. See Ranking Digital Rights, P7.

2.1.4: Health Data

Do the policies clearly indicate whether or not any health or biometric data are collected?

• Indicator
  • Discloses health or biometric related information is collected.
• Citation
  • Family Educational Rights and Privacy Act: (A biometric record, as used in the definition of personally identifiable information, means a record of one or more measurable biological or behavioral characteristics that can be used for automated recognition of an individual. Examples include fingerprints; retina and iris patterns; voiceprints; DNA sequence; facial characteristics; and handwriting) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.3
  • Children's Online Privacy Protection Act: (Personally Identifiable Information under COPPA includes first and last name, photos, videos, audio, geolocation information, persistent identifiers, IP address, cookies, and unique device identifiers) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2
  • Student Online Personal Information Protection Act: ("Covered Information" under SOPIPA is personally identifiable information that includes descriptive information or identifies a student that was created or provided by a student, parent, teacher, district staff, or gathered by an operator through the operation of the site) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(i)(1)-(3)
  • General Data Protection Regulation: (“personal data” means any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person) See General Data Protection Regulation (GDPR), Definitions, Art. 4(1)
  • General Data Protection Regulation: ("genetic data" means personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that natural person and which result, in particular, from an analysis of a biological sample from the natural person in question) See General Data Protection Regulation (GDPR), Definitions, Art. 4(13)
  • General Data Protection Regulation: ("biometric data" means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data) See General Data Protection Regulation (GDPR), Definitions, Art. 4(14)
  • General Data Protection Regulation: ("data concerning health" means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status) See General Data Protection Regulation (GDPR), Definitions, Art. 4(15)
• Background
  • Biometric data are physical or behavioral characteristics which can be used to identify unique individuals. Biometric technologies measure these unique characteristics electronically and match them against existing records to create a highly accurate identity management system. Fingerprints, retnia scans, or voice and facial recognition are examples of physcial identification technologies. It uses the layout of facial features and their distance from one another for identification against a "gallery" of faces with similar characteristics. See Privacy Best Practice Recommendations For Commercial Biometric Use, NTIA Discussion Draft (July 22, 2015), p. 1.
  • The ability of facial recognition technology to identify consumers based solely on a photograph, create linkages between the offline and online world, and compile highly detailed dossiers of information, makes it especially important for companies using this technology to implement privacy by design concepts with robust choice and transparency policies. Such practices should include reducing the amount of time consumer information is retained, adopting reasonable security measures, and disclosing to consumers that the facial data collected may be used to link them to information from third-parties or publicly available sources. See FTC, Protecting Consumer Privacy in an era of rapid change: recommendations for business and policy makers (2012), p. 46.

2.1.5: Behavioral Data

Do the policies clearly indicate whether or not any behavioral data are collected?

• Indicator
  • Discloses behavioral or usage information is collected.
• Citation
  • Children's Online Privacy Protection Act: (An operator is prohibited from including behavioral advertisements or amassing a profile of a child under the age of 13 child without parental consent) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2
  • Family Educational Rights and Privacy Act: (A biometric record, as used in the definition of personally identifiable information, means a record of one or more measurable biological or behavioral characteristics that can be used for automated recognition of an individual. Examples include fingerprints; retina and iris patterns; voiceprints; DNA sequence; facial characteristics; and handwriting) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.3
  • General Data Protection Regulation: ("biometric data" means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data) See General Data Protection Regulation (GDPR), Definitions, Art. 4(14)

2.1.6: Sensitive Data

Do the policies clearly indicate whether or not sensitive personal information is collected?

• Indicator
  • Discloses collection of sensitive information such as ethnic, racial, national origin, cultural, religious, or social personal information.
• Citation
  • General Data Protection Regulation: (Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited unless: (a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition ... may not be lifted by the data subject) See General Data Protection Regulation (GDPR), Processing of special categories of personal data, Art. 9(1)-(2)(a)

2.1.7: Usage Data

Do the policies clearly indicate whether or not the product automatically collects any information?

• Indicator
  • Discloses non-personal usage information is collected.
• Citation
  • Children's Online Privacy Protection Act: (Personally Identifiable Information under COPPA includes first and last name, photos, videos, audio, geolocation information, persistent identifiers, IP address, cookies, and unique device identifiers) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2
  • Family Educational Rights and Privacy Act: ("Personal Information" under FERPA includes direct identifiers such as a student or family member's name, or indirect identifiers such as a date of birth, or mother's maiden name, or other information that is linkable to a specific student that would allow a reasonable person in the school community to identify the student with reasonable certainty) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.3
  • Student Online Personal Information Protection Act: ("Covered Information" under SOPIPA is personally identifiable information that includes descriptive information or identifies a student that was created or provided by a student, parent, teacher, district staff, or gathered by an operator through the operation of the site) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(i)(1)-(3)
  • California Online Privacy Protection Act: (The term "Personally Identifiable Information" under CalOPPA means individually identifiable information about a consumer collected online by the operator from that individual and maintained by the operator in an accessible form, including any of the following: (1) A first and last name; (2) A home or other physical address, including street name and name of a city or town; (3) An e-mail address; (4) A telephone number; (5) A social security number; or (6) Any other identifier that permits the physical or online contacting of a specific individual) See California Online Privacy Protection Act (CalOPPA), Cal. B.&P. Code §22577(a)(1)-(6)
  • General Data Protection Regulation: (“personal data” means any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person) See General Data Protection Regulation (GDPR), Definitions, Art. 4(1)
• Background
  • The Children's Online Privacy Protection Act (COPPA) defines "personal information" to include identifiers, such as a customer number held in a cookie, an IP address, a processor or device serial number, or a unique device identifier that can be used to recognize a user over time and across different websites or online services, even where such an identifier is not paired with other items of personal information. Companies should disclose in their privacy policy, and in their direct notice to parents, their collection, use or disclosure practices of persistent identifiers unless: (1) the company collects no other "personal information," and (2) persistent identifiers are collected on or through a company's site or service solely for the purpose of providing "support for the internal operations" of the site or service. See FTC, Complying with COPPA: Frequently Asked Questions, q. 6.
  • Persistent identifiers collected for the sole purpose of providing support for the internal operations of the website or online service do not require parental consent, so long as no other personal information is collected and the persistent identifiers are not used or disclosed to contact a specific individual, including through behavioral advertising; to amass a profile on a specific individual; or for any other purpose. See FTC, Complying with COPPA: Frequently Asked Questions, q. 5.
  • The data on students collected and maintained by Ed Tech can be extremely sensitive, including medical histories, social and emotional assessments, progress reports, and test results. Online services also collect new types of data, which were not contemplated by and may not be protected by federal privacy laws. New data types collected by Ed Tech include "metadata," such as a student’s location, how many attempts a student made to answer a question, and whether a student is using a desktop or a mobile device. Metadata can be put to good use to personalize learning and to improve educational products. It can also be used to influence or market to students or to their parents. See Ready for School, Recommendations for the Ed Tech Industry to Protect the Privacy of Student Data (November 2016), CA. D.O.J., p. 3.
  • A vendor should describe the types or categories of student information that they acquire from schools, school districts, teachers, parents, or students. Data types may include behavioral data reflecting how a student used the site or service or what content the student has accessed or created through it, and transactional data, such as persistent unique identifiers, collected through the use of your site or service. While unique identifiers are evolving with technology, currently such identifiers include, but are not limited to, cookies, device IDs, IP addresses, and other data elements if used to identify devices or users. See Ready for School, Recommendations for the Ed Tech Industry to Protect the Privacy of Student Data (November 2016), CA. D.O.J., p. 11.

5.2.1: Collection Consent

Do the policies clearly indicate whether or not the vendor requests opt-in consent from a user at the time information is collected?

• Indicator
  • Discloses users must provide opt-in consent for the collection of their information.
• Citation
  • Children's Online Privacy Protection Act: (A notice or privacy policy on an operator's website needs a section relating to the collection of information for children under 13 years of age, and notice is required at each area of the site where information is collected from children) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.4(d)
  • General Data Protection Regulation: ("consent" of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her) See General Data Protection Regulation (GDPR), Definitions, Art. 4(11)
  • General Data Protection Regulation: (Processing shall be lawful only if and to the extent ... the data subject has given consent to the processing of his or her personal data for one or more specific purposes) See General Data Protection Regulation (GDPR), Lawfulness of Processing, Art. 6(1)(a)
  • General Data Protection Regulation: (Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data.) See General Data Protection Regulation (GDPR), Conditions for Consent, Art. 7(1)
  • General Data Protection Regulation: (If the data subject's consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding.) See General Data Protection Regulation (GDPR), Conditions for Consent, Art. 7(2)
• Background
  • Establishing consumer choice as a baseline requirement for companies that collect and use consumer data, while also identifying certain practices where choice is unnecessary, is an appropriately balanced model. It increases consumers' control over the collection and use of their data, preserves the ability of companies to innovate new products and services, and sets clear expectations for consumers and industry alike. See FTC, Protecting Consumer Privacy in an era of rapid change: recommendations for business and policy makers (2012), p. 36.
  • There are five categories of data practices that companies can engage in without offering consumer choice, because they involve data collection and use that is either obvious from the context of the transaction or sufficiently accepted or necessary for public policy reasons. The categories include: (1) product and service fulfillment; (2) internal operations; (3) fraud prevention; (4) legal compliance and public purpose; and (5) first-party marketing. See FTC, Protecting Consumer Privacy in an era of rapid change: recommendations for business and policy makers (2012), p. 36.
  • Companies should recognize the sensitivity of data and take special care to delete data as soon as possible and implement reasonable restrictions on the retention of data and dispose of it once the data has outlived the legitimate purpose for which it was collected. See FTC, Protecting Consumer Privacy in an era of rapid change: recommendations for business and policy makers (2012), pp. 28-29.
  • The Administration encourages companies engaged in online advertising to refrain from collecting, using, or disclosing personal data that may be used to make decisions regarding employment, credit, and insurance eligibility or similar matters that may have significant adverse consequences to consumers. Collecting data for such sensitive uses is at odds with the contextually well-defined purposes of generating revenue and providing consumers with ads that they are more likely to find relevant. See Exec. Office of the President, Consumer Data Privacy in a Networked World: A Framework for Protecting Privacy and Promoting Innovation in the Global Digital Economy (2012), p. 18.

3.8.1: Third-Party Collection

Do the policies clearly indicate whether or not a user's personal information is collected by a third party?

• Indicator
  • Discloses a third party may collect user information.
• Citation
  • California Online Privacy Protection Act: (An operator is required to disclose whether other third parties may collect personally identifiable information about a consumer's online activities over time and across different Web sites) See California Online Privacy Protection Act (CalOPPA), Cal. B.&P. Code §22575(b)(6)
• Background
  • Stored data can reside on a vendor or third-party server, on a client (in an app or a browser), or on both, and can include authentication data (e.g., password), user data (e.g., personal information), session data, or log entries. See Center for Internet Security, Critical Security Controls for Effective Cyber Defense;

Data Sharing: Protecting data from third parties

Evaluating data sharing takes into consideration best practices that protect the disclosure of a user's personal information to third parties.

3.1.1: Data Shared (BASIC)

Do the policies clearly indicate if collected information (this includes data collected via automated tracking or usage analytics) is shared with third parties?

• Indicator
  • Discloses user information is shared with third parties.
  • Discloses the type of user information shared with third parties.
• Citation
  • Children's Online Privacy Protection Act: (Release of personal information means the sharing, selling, renting, or transfer of personal information to any third party) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2
  • Children's Online Privacy Protection Act: (An operator may share data with third parties who provide support for the "internal operations" of the service and who do not use or disclose the information for any other purpose) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2
  • Children's Online Privacy Protection Act: (An operator must take reasonable steps to release a child's personal information only to service providers and third parties who are capable of maintaining the confidentiality, security, and integrity of the information, and provide assurances that they contractually maintain the information in the same manner) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.8
  • Children's Online Privacy Protection Act: (An operator can not condition a child's participation in the service with sharing any collected information with third parties. A parent is required to have the ability to consent to the collection and use of their child's personal information without also consenting to the disclosure of the information to third parties) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.5(a)(2)
  • Family Educational Rights and Privacy Act: (A school is prohibited from disclosing a student's "education record" or data to third parties without parental consent) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.30
  • Student Online Personal Information Protection Act: (An operator is prohibited from sharing student information to third parties except in limited circumstances to other schools, or for research purposes) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(b)(4)
  • General Data Protection Regulation: (“recipient” means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not.) See General Data Protection Regulation (GDPR), Definitions, Art. 4(9)
  • General Data Protection Regulation: ("third party" means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data) See General Data Protection Regulation (GDPR), Definitions, Art. 4(10)
• Background
  • Online educational services increasingly collect a large amount of contextual or transactional data as part of their operations, often referred to as "metadata." Metadata refer to information that provides meaning and context to other data being collected; for example, information about how long a particular student took to perform an online task has more meaning if the user knows the date and time when the student completed the activity, how many attempts the student made, and how long the student's mouse hovered over an item (potentially indicating indecision). See PTAC, Protecting Student Privacy While Using Online Educational Services: Requirements and Best Practices, pp. 2-3.
  • Metadata that have been stripped of all direct and indirect identifiers are not considered protected information under FERPA, because the data are not PII. A provider that has been granted access to PII from education records under the "school official" exception may use any metadata that are not linked to FERPA-protected information for other purposes, unless otherwise prohibited by the terms of their agreement with the school or district. See PTAC, Protecting Student Privacy While Using Online Educational Services: Requirements and Best Practices, pp. 2-3.
  • Companies collect a wide range of personal information from users—from personal details and account profiles to a user’s activities and location. Companies also often share this information with third parties, such as advertisers, governments, and legal authorities. We expect companies to clearly disclose what user information they share and with whom. Company disclosure should specify if it shares user information with governments and with commercial entities. See Ranking Digital Rights, P4.

3.1.2: Data Categories (BASIC)

Do the policies clearly indicate what categories of information are shared with third parties?

• Indicator
  • Discloses the categories of information shared with third parties.
• Citation
  • Children's Online Privacy Protection Act: (A parent or guardian can request the operator to provide a description of the specific types or categories of personal information collected from children by the application or service) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.6(a)(1)
• Background
  • Consumers deserve more transparency about how their data is shared beyond the entities with which they do business directly, including "third-party" data collectors. This means ensuring that consumers are meaningfully aware of the spectrum of information collection and reuse as the number of firms that are involved in mediating their consumer experience or collecting information from them multiplies. The data services industry should follow the lead of the online advertising and credit industries and build a common website or online portal that lists companies, describes their data practices, and provides methods for consumers to better control how their information is collected and used or to opt-out of certain marketing uses. See Exec. Office of the President, Big Data: Seizing Opportunities, Preserving Values (2014), p. 62.
  • What is the "School Official" Exception? In some cases, providers need PII from a students's education records in order to deliver the agreed-upon services. FERPA's school official exception to consent is most likely to apply to the schools' and districts' relationships with service providers. When schools and districts outsource institutional services or functions, FERPA permits the disclosure of PII from education records to contractors, consultants, volunteers, or other third-parties provided that the outside party meets specified requirements. See 34 C.F.R. § 99.31(a)(1)(i); See also PTAC, Responsibilities of Third-Party Service Providers under FERPA, P. 2; See also PTAC, Protecting Student Privacy While Using Online Educational Services: Requirements and Best Practices, p. 3-5.

3.2.1: Sharing Purpose

Do the policies clearly indicate the vendor's intention or purpose for sharing a user's personal information with third parties?

• Indicator
  • Discloses the purpose for collecting information.
  • Discloses the purpose for sharing information.
• Citation
  • Children's Online Privacy Protection Act: (An operator may share data with third parties who provide support for the "internal operations" of the service and who do not use or disclose the information for any other purpose) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2
  • Student Online Personal Information Protection Act: (An operator is prohibited from sharing student information to third parties except in limited circumstances to other schools, or for research purposes) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(b)(4)
  • Student Online Personal Information Protection Act: (An operator may share student data with third parties for legitimate research purposes if not used for advertising or to amass a profile on a student for purposes other than K–12 school purposes) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(e)(2)
  • Student Online Personal Information Protection Act: (An operator may disclose student information to a third party service provider, but the third party is prohibited from using the information for or any purpose other than providing the service) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(b)(4)(E)(i)
  • General Data Protection Regulation: (Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information: ... (d) where the processing is based on [consent] ... the legitimate interests pursued by the controller or by a third party) See General Data Protection Regulation (GDPR), Information to be provided where personal data are collected from the data subject, Art. 13(1)(d)
  • General Data Protection Regulation: (The controller shall provide the data subject with the following information necessary to ensure fair and transparent processing in respect of the data subject: ... (b) where the processing is based on [consent] ... the legitimate interests pursued by the controller or by a third party) See General Data Protection Regulation (GDPR), Information to be provided where personal data have not been obtained from the data subject, Art. 14(2)(b)
• Background
  • Companies that have first-party relationships with consumers should disclose specifically the purposes for which they provide personal data to third-parties, in order to help consumers understand the nature of those third-parties' activities, and whether those third-parties are bound to limit their use of the data to achieving those purposes. This gives consumers a more tractable task of assessing whether to engage with a single entity, rather than trying to understand what personal data third-parties (potentially dozens, or even hundreds of entities) receive and how they use it. See Exec. Office of the President, Consumer Data Privacy in a Networked World: A Framework for Protecting Privacy and Promoting Innovation in the Global Digital Economy (2012), p. 15.
  • We expect companies to clearly disclose the purpose for collecting ands haring user information for each type of user information it collects and shares. In addition, many companies own or operate a variety of products and services, and we expect companies to clearly disclose how user information can be shared or combined across services. See Ranking Digital Rights, P5.

3.11.1: Third-Party Categories

Do the policies clearly indicate the categories of related third parties, such as subsidiaries or affiliates with whom the vendor shares data?

• Indicator
  • Discloses the types of third parties with which user information is shared.
  • Discloses the names of third parties with which user information is shared.
• Citation
  • California Online Privacy Protection Act: (An operator is required to identify the categories of third parties with whom the operator may share personally identifiable information) See California Online Privacy Protection Act (CalOPPA), Cal. B.&P. Code §22575(b)(1)
  • General Data Protection Regulation: (Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information: ... (e) the recipients or categories of recipients of the personal data, if any) See General Data Protection Regulation (GDPR), Information to be provided where personal data are collected from the data subject, Art. 13(1)(e)
  • General Data Protection Regulation: (Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information: ... (e) the recipients or categories of recipients of the personal data, where applicable) See General Data Protection Regulation (GDPR), Information to be provided where personal data have not been obtained from the data subject, Art. 14(1)(e)
  • General Data Protection Regulation: (The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and where that is the case, access to the personal data and the following information: ... (c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations) See General Data Protection Regulation (GDPR), Right of access by the data subject, Art. 15(1)
• Background
  • Companies that have first-party relationships with consumers should disclose specifically the purposes for which they provide personal data to third-parties, in order to help consumers understand the nature of those third-parties' activities, and whether those third-parties are bound to limit their use of the data to achieving those purposes. This gives consumers a more tractable task of assessing whether to engage with a single entity, rather than trying to understand what personal data third-parties (potentially dozens, or even hundreds of entities) receive and how they use it. See Exec. Office of the President, Consumer Data Privacy in a Networked World: A Framework for Protecting Privacy and Promoting Innovation in the Global Digital Economy (2012), p. 15.
  • A vendor should describe the types of third parties to which they disclose covered information acquired through the site or service and the purposes for such disclosures. Be specific. For example, describe the types of entities (such as educational agencies, researchers, service providers, other companies) to which a vendor discloses covered information for any of the purposes discussed below. See Ready for School, Recommendations for the Ed Tech Industry to Protect the Privacy of Student Data (November 2016), CA. D.O.J., p. 13.

3.2.2: Third-Party Analytics

Do the policies clearly indicate whether or not collected information is shared with third parties for analytics and tracking purposes?

• Indicator
  • Discloses information is shared with third parties for analytics and tracking purposes.
• Citation
  • Children's Online Privacy Protection Act: (Release of personal information means the sharing, selling, renting, or transfer of personal information to any third party) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2
  • Student Online Personal Information Protection Act: (An operator is prohibited from tracking a student across websites with targeted advertising) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(b)(1)(A)
  • Student Online Personal Information Protection Act: (An operator is prohibited from amassing a profile of a student) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(b)(2)
  • General Data Protection Regulation: (Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited unless: ... (j) processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes ... which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.) See General Data Protection Regulation (GDPR), Processing of special categories of personal data, Art. 9(1)-(2)(j)
• Background
  • Data while not traditionally considered personally identifiable, can be linkable to a consumer or device. Studies have demonstrated that consumers object to being tracked, regardless of whether the tracker explicitly learns a consumer name. There also exists the potential for harm, such as discriminatory pricing based on online browsing history, even without the use of PII. See FTC, Protecting Consumer Privacy in an era of rapid change: recommendations for business and policy makers (2012), p. 18.

3.2.3: Third-Party Research

Do the policies clearly indicate whether or not collected information is shared with third parties for research or product improvement purposes?

• Indicator
  • Discloses information is shared with third parties for research or product improvement purposes.
• Citation
  • Children's Online Privacy Protection Act: (Release of personal information means the sharing, selling, renting, or transfer of personal information to any third party) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2
  • Family Educational Rights and Privacy Act: (An exception for disclosing personally identifiable information without obtaining parental consent exists for sharing data with third parties conducting legitimate research and studies) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.31(a)(6); 34 C.F.R. Part 99.31(b)(2)
  • Student Online Personal Information Protection Act: (An operator may share student data with third parties for legitimate research purposes if not used for advertising or to amass a profile on a student for purposes other than K–12 school purposes) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(e)(2)
  • Student Online Personal Information Protection Act: (An operator is prohibited from sharing student information to third parties except in limited circumstances to other schools, or for research purposes) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(b)(4)
  • Protection of Pupil Rights Act: (All instructional materials including teacher's manuals, films, tapes, or other supplementary instructional material which is used in connection with any research must be made available for inspection by the parents or guardians of the children) See Protection of Pupil Rights Act (PPRA), 34 C.F.R. §98.3
  • California Privacy of Pupil Records: (A school district may provide, in its discretion, statistical data from which no pupil may be identified to any public agency, entity, private nonprofit college, university, or educational research and development organization when disclosure would be in the best educational interests of pupils) See California Privacy of Pupil Records, Cal. Ed. Code § 49074
• Background
  • If a vendor uses student information acquired through the site or service to develop or improve theor educational products or to demonstrate their effectiveness, aggregate or de-identify the data first. See the guidance on data aggregation and de-identification from the U.S. Department of Education and the National Center for Education Statistics and a white paper on de-identification and student data from the Future of Privacy Forum. See Ready for School, Recommendations for the Ed Tech Industry to Protect the Privacy of Student Data (November 2016), CA. D.O.J., p. 13.
  • A vendor should only disclose covered information for research purposes if required by state or federal law and subject to the restrictions of such laws, or if disclosure for research purposes is allowed by state or federal law and is under the direction of a school, district or state education department. In neither case should covered information be used for advertising or for profiling a student other than for school purposes. See Ready for School, Recommendations for the Ed Tech Industry to Protect the Privacy of Student Data (November 2016), CA. D.O.J., p. 13.

3.10.1: Third-Party Providers

Do the policies clearly indicate whether or not third-party services are used to support the internal operations of the vendor's product?

• Indicator
  • Discloses third-party service providers may be used to support the product.
• Citation
  • Children's Online Privacy Protection Act: (Release of personal information means the sharing, selling, renting, or transfer of personal information to any third party) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2
  • Children's Online Privacy Protection Act: (An operator may share data with third parties who provide support for the "internal operations" of the service and who do not use or disclose the information for any other purpose) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2
  • Student Online Personal Information Protection Act: (An operator may disclose student information to a third party service provider, but the third party is prohibited from using the information for or any purpose other than providing the service) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(b)(4)(E)(i)
• Background
  • Disclosure of personal information for the "internal operations" of the website or online service, means activities necessary for the site or service to maintain or analyze its functioning; perform network communications; authenticate users or personalize content; serve contextual advertising or cap the frequency of advertising; protect the security or integrity of the user, website, or online service; ensure legal or regulatory compliance; or fulfill a request of a child. See 16 C.F.R. 312.2; See also FTC, Complying with COPPA: Frequently Asked Questions, q. 5.

3.10.2: Third-Party Roles

Do the policies clearly indicate the role of third-party service providers?

• Indicator
  • Discloses the role of any third-party service providers.
  • Discloses the purpose of any third-party service providers.
• Citation
  • Children's Online Privacy Protection Act: (An operator may share data with third parties who provide support for the "internal operations" of the service and who do not use or disclose the information for any other purpose) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2
  • Student Online Personal Information Protection Act: (An operator may disclose student information to a third party service provider, but the third party is prohibited from using the information for or any purpose other than providing the service) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(b)(4)(E)(i)

3.14.1: Social Login (BASIC)

Do the policies clearly indicate whether or not social or federated login is supported to use the product?

• Indicator
  • Discloses social login is supported to authenticate with the product.
• Citation
  • California Privacy of Pupil Records: (Prohibits schools, school districts, county offices of education, and charter schools from collecting or maintaining information about pupils from social media for any purpose other than school or pupil safety, without notifying each parent or guardian and providing the pupil with access and an opportunity to correct or delete such information) See California Privacy of Pupil Records, Cal. Ed. Code § 49073.6(c)

3.16.1: Third-Party Limits (BASIC)

Do the policies clearly indicate whether or not the vendor imposes contractual limits on how third parties can use personal information that the vendor shares or sells to them?

• Indicator
  • Discloses contractual obligations or restrictions are placed on third parties who receive user information.
• Citation
  • Children's Online Privacy Protection Act: (An operator must take reasonable steps to release a child's personal information only to service providers and third parties who are capable of maintaining the confidentiality, security, and integrity of the information, and provide assurances that they contractually maintain the information in the same manner) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.8
  • Family Educational Rights and Privacy Act: (An exception for disclosing personally identifiable information without obtaining parental consent exists for sharing data with a third party who is considered a "school official" with a legitimate educational interest, and under direct control of the school for the use and maintenance of education records) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.31(a)(1)(i)(B)
  • Student Online Personal Information Protection Act: (An operator may disclose student information to a third party service provider, but the third party is prohibited from using the information for or any purpose other than providing the service) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(b)(4)(E)(i)
  • Student Online Personal Information Protection Act: (A third party service provider may not disclose student information to any subsequent third party) See Student Online Personal Information Protection Act (SOPIPA),Cal. B.&P. Code § 22584(b)(4)(E)(ii)
  • General Data Protection Regulation: (The processor shall not engage another processor without prior specific or general written authorisation of the controller. In the case of general written authorisation, the processor shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes.) See General Data Protection Regulation (GDPR), Processor, Art. 28(2)
  • General Data Protection Regulation: (Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller.) See General Data Protection Regulation (GDPR), Processor, Art. 28(3)
  • General Data Protection Regulation: (Where a processor engages another processor for carrying out specific processing activities on behalf of the controller, the same data protection obligations as set out in the contract or other legal act between the controller and the processor ... shall be imposed on that other processor by way of a contract or other legal act under Union or Member State law, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of this Regulation. Where that other processor fails to fulfil its data protection obligations, the initial processor shall remain fully liable to the controller for the performance of that other processor's obligations.) See General Data Protection Regulation (GDPR), Processor, Art. 28(4)
  • General Data Protection Regulation: (The processor and any person acting under the authority of the controller or of the processor, who has access to personal data, shall not process those data except on instructions from the controller) See General Data Protection Regulation (GDPR), Processing under the authority of the controller or processor, Art. 29
• Background
  • A company that transfers data from one company to another should not place emphasis on the disclosures themselves, but on whether a disclosure leads to a use of personal data that is inconsistent within the context of its collection or a consumer's expressed desire to control the data. Thus, if a company transfers personal data to a third party, it remains accountable and thus should hold the recipient accountable—through contracts or other legally enforceable instruments. See Exec. Office of the President, Consumer Data Privacy in a Networked World: A Framework for Protecting Privacy and Promoting Innovation in the Global Digital Economy (2012), p. 22.
  • A company's data would not be "reasonably linkable" to a particular consumer or device to the extent that the company implements three significant protections for that data: (1) a given data set is not reasonably identifiable, (2) the company publicly commits not to re-identify it, and (3) the company requires any downstream users of the data to keep it in de-identified form. See FTC, Protecting Consumer Privacy in an era of rapid change: recommendations for business and policy makers (2012), p. 21.
  • The ability to re-identify "anonymous" data supports the FTC's framework application to data that can be reasonably linked to a consumer or device, because consumers' privacy interest in data goes beyond what is strictly labeled PII. There exists a legitimate interest for consumers in having control over how companies collect and use aggregated or de-identified data, browser fingerprints, and other types of non-PII. See FTC, Protecting Consumer Privacy in an era of rapid change: recommendations for business and policy makers (2012), pp. 18-19.
  • Properly de-identified data can reduce the risk of a person's sensitive personal information being disclosed, but data de-identification must be done carefully. Simple removal of direct identifiers from the data to be released does not constitute adequate de-identification. Properly performed de-identification involves removing or obscuring all identifiable information until all data that can lead to individual identification have been expunged or masked. Further, when making a determination as to whether the data have been sufficiently de-identified, it is necessary to take into consideration cumulative re-identification risk from all previous data releases and other reasonably available information. See PTC, Data De-identification: An Overview of Basic Terms, p. 3.
  • A vendor should contractually require their service providers who receive covered information acquired through the site or service to use the information only to provide the contracted service, not to further disclose the information, to implement and maintain reasonable security procedures and practices as required by law, and to return or delete covered information at the completion of the contract. Include a requirement that any service providers notify the vendor immediately of any unauthorized disclosure of the student information in their custody, and then act promptly to provide proper notice as required by law. Make clear to service providers that they may separately face liability for the mishandling of student data. See Ready for School, Recommendations for the Ed Tech Industry to Protect the Privacy of Student Data (November 2016), CA. D.O.J., p. 13.

Data Security: Protecting against unauthorized access

Evaluating data security takes into consideration best practices that protect the integrity and confidentiality of a user's data.

8.1.1: Verify Identity

Do the policies clearly indicate whether or not the vendor or vendor-authorized third party verifies a user's identity with personal information?

• Indicator
  • Discloses users are required to verify their identity with a government issued identification or with other forms of identification that could be connected to their offline identity.
  • Discloses users are required to verify their identity with personal information for parental consent purposes.
• Citation
  • Family Educational Rights and Privacy Act: (An educational institution is required to use reasonable methods to verify the identity of a parent of a child with whom they disclose information) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.31(c)
  • Children's Online Privacy Protection Act: (An operator must make reasonable efforts to obtain verifiable parental consent, taking into consideration available technology and existing methods available to a parent to prove their identity) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.5(b)(i)-(iv); See also 15 U.S.C. §6501(9)
  • General Data Protection Regulation: (The controller shall make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over the child, taking into consideration available technology.) See General Data Protection Regulation (GDPR), Conditions Applicable to Child's Consent in Relation to Information Society Services, Art. 8(2)
  • General Data Protection Regulation: (Where the controller has reasonable doubts concerning the identity of the natural person making the request ... the controller may request the provision of additional information necessary to confirm the identity of the data subject.) See General Data Protection Regulation (GDPR), Transparent information, communication and modalities for the exercise of the rights of the data subject, Art. 12(6)
• Background
  • The ability to communicate anonymously is essential to freedom of expression both on and offline. The use of a real name online, or requiring users to provide a company with identifying information, provides a link between online activities and a specific person. This presents human rights risks to those who, for example, voice opinions that don't align with a government's views or who engage in activism that a government does not permit. It also presents risks for people who are persecuted for religious beliefs or sexual orientation. We therefore expect companies to disclose whether they might ask users to verify their identities using government-issued ID or other forms of identification that could be connected to their offline identity. We acknowledge that users may have to provide information that could be connected to their offline identity in order to access paid features of various products and services. However, users should be able to access features that don't require payment without needing to provide information that can be tied to their offline identity. See Ranking Digital Rights, F11.

8.2.1: Account Required (BASIC)

Do the policies indicate whether or not the vendor requires a user to create an account with a username and password in order to use the product?

• Indicator
  • Discloses users are required to create an account to use the product.

8.2.2: Managed Account (BASIC)

Do the policies clearly indicate whether or not the vendor provides user managed accounts for a parent, teacher, school or district?

• Indicator
  • Discloses managed accounts are provided for parents, teachers, schools, or district staff.
  • Discloses accounts are created for students by parents, teachers, schools, or district staff.

8.2.3: Two-Factor Protection

Do the policies clearly indicate whether or not the security of a user's account is protected by two-factor authentication?

• Indicator
  • Discloses user accounts can be protected with two-factor authentication.
  • Discloses managed accounts can be protected with two-factor authentication.

8.3.1: Security Agreement

Do the policies clearly indicate whether or not a third party with access to a user's information is contractually required to provide the same level of security protections as the vendor?

• Indicator
  • Discloses contractual obligations are imposed on third parties to provide security protections for users' information.
• Citation
  • Children's Online Privacy Protection Act: (An operator must take reasonable steps to release a child's personal information only to service providers and third parties who are capable of maintaining the confidentiality, security, and integrity of the information, and provide assurances that they contractually maintain the information in the same manner) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.8
  • Family Educational Rights and Privacy Act: (An educational institution must maintain physical, technical, and administrative safeguards to protect student information) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.31(a)(1)(ii)
  • Student Online Personal Information Protection Act: (A third party service provider must maintain reasonable security procedures and practices) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(b)(4)(E)(iii)
  • California AB 1584 - Privacy of Pupil Records: (A local educational agency that enters into a contract with a third party must ensure the contract contains a description of the actions the third party will take, including the designation and training of responsible individuals, to ensure the security and confidentiality of pupil records) See California AB 1584 - Privacy of Pupil Records, Cal. Ed. Code § 49073.1(b)(5)
  • General Data Protection Regulation: (Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject.) See General Data Protection Regulation (GDPR), Processor, Art. 28(1)
  • General Data Protection Regulation: (The controller and processor shall take steps to ensure that any natural person acting under the authority of the controller or the processor who has access to personal data does not process them except on instructions from the controller) See General Data Protection Regulation (GDPR), Security of processing, Art. 32(4)
• Background
  • A vendor should only disclose covered information acquired through the site or service when doing so furthers the specific school purposes of the site or service. Ensure that any such recipient does not further disclose the information except in furtherance of those purposes and is obligated to meet legal requirements to secure the information. See Ready for School, Recommendations for the Ed Tech Industry to Protect the Privacy of Student Data (November 2016), CA. D.O.J., p. 13.

8.4.1: Reasonable Security (BASIC)

Do the policies clearly indicate whether or not reasonable security standards are used to protect the confidentiality of a user's personal information?

• Indicator
  • Discloses security protections in place for users' information are based on industry standards and best practices.
  • Discloses complex passwords and failed login lockouts protect user information.
  • Discloses advanced authentication methods are provided by the company to prevent fraudulent access.
  • Discloses users can view their recent account activity and login information.
  • Discloses users are notified about unusual account activity and possible unauthorized access to their accounts.
• Citation
  • Children's Online Privacy Protection Act: (An operator must maintain the confidentiality, security, and integrity of personal information collected from children) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.3(e); See also 16 C.F.R. Part 312.8
  • California Data Breach Notification Requirements: (A person or business that owns, licenses, or maintains personal information about a California resident is required to implement and maintain reasonable security procedures and practices appropriate to the nature of the information, and to protect the personal information from unauthorized access, destruction, use, modification, or disclosure) See California Data Breach Notification Requirements, Cal. Civ. Code § 1798.81.5
  • Children's Online Privacy Protection Act: (An operator must take reasonable steps to release a child's personal information only to service providers and third parties who are capable of maintaining the confidentiality, security, and integrity of the information, and provide assurances that they contractually maintain the information in the same manner) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.8
  • Student Online Personal Information Protection Act: (An operator is required to implement reasonable security procedures, practices, and protect student data from unauthorized access, destruction, use, modification, or disclosure) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(d)(1)
  • Family Educational Rights and Privacy Act: (An educational institution must maintain physical, technical, and administrative safeguards to protect student information) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.31(a)(1)(ii)
  • California AB 1584 - Privacy of Pupil Records: (A local educational agency that enters into a contract with a third party must ensure the contract contains a description of the actions the third party will take, including the designation and training of responsible individuals, to ensure the security and confidentiality of pupil records) See California AB 1584 - Privacy of Pupil Records, Cal. Ed. Code § 49073.1(b)(5)
  • General Data Protection Regulation: ([Data shall be] processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures) See General Data Protection Regulation (GDPR), Principles relating to processing of personal data, Art. 5(1)(f)
  • General Data Protection Regulation: (Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate: ...(b) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services) See General Data Protection Regulation (GDPR), Security of processing, Art. 32(1)(b)
  • General Data Protection Regulation: (In assessing the appropriate level of security account shall be taken in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed.) See General Data Protection Regulation (GDPR), Security of processing, Art. 32(2)
• Background
  • A vendor should provide a general description of the technical, administrative and physical safeguards you use to protect student information from unauthorized access, destruction, use, modification, or disclosure. See Ready for School, Recommendations for the Ed Tech Industry to Protect the Privacy of Student Data (November 2016), CA. D.O.J., p. 14.
  • A vendor should implement and maintain reasonable security measures appropriate to the nature of the student information, including covered information, acquired through your site or service. Designate and train someone responsible and use a risk management process: identify your data assets, assess threats and vulnerabilities, apply appropriate controls, monitor their effectiveness, and repeat the process. As discussed in the California Data Breach Report, the Center for Internet Security’s Critical Security Controls is a good starting point for high-priority security controls. The Federal Trade Commission’s Start with Security also offers helpful guidance. See Ready for School, Recommendations for the Ed Tech Industry to Protect the Privacy of Student Data (November 2016), CA. D.O.J., p. 15.
  • This indicator is applicable to internet and mobile ecosystem companies. Companies hold significant amounts of user information, making them targets for malicious actors. We expect companies to help users protect themselves against such threats. Companies should clearly disclose that they use advanced authentication techniques to prevent unauthorized access to user accounts and information. We also expect companies to provide users with tools that enable them to secure their accounts and to know when their accounts maybe compromised. See Ranking Digital Rights, P17.

8.4.2: Employee Access

Do the policies clearly indicate whether or not the vendor implements physical access controls or limits employee access to user information?

• Indicator
  • Discloses security processes are used that limit or monitor employee access to users' information.
  • Discloses physical access controls are used to limit employee access to users' information.
• Citation
  • California AB 1584 - Privacy of Pupil Records: (A local educational agency that enters into a contract with a third party must ensure the contract contains a description of the actions the third party will take, including the designation and training of responsible individuals, to ensure the security and confidentiality of pupil records) See California AB 1584 - Privacy of Pupil Records, Cal. Ed. Code § 49073.1(b)(5)
• Background
  • A vendor should implement an employee privacy and security training program to ensure that employees understand the policies and procedures and also understand their individual obligations regarding the handling of student data and other personal information. Include data breach reporting procedures. See Ready for School, Recommendations for the Ed Tech Industry to Protect the Privacy of Student Data (November 2016), CA. D.O.J., p. 15.

8.5.1: Transit Encryption (BASIC)

Do the policies clearly indicate whether or not all data in transit is encrypted?

• Indicator
  • Discloses the transmission of user communications are encrypted using Secure Socket Layer (SSL).
  • Discloses the transmission of user communications are encrypted using unique keys.
  • Discloses users can secure information with their own user supplied encryption keys.
  • Discloses user communications are encrypted by default.
• Citation
  • California Data Breach Notification Requirements: (A person or business that owns, licenses, or maintains personal information about a California resident is required to implement and maintain reasonable security procedures and practices appropriate to the nature of the information, and to protect the personal information from unauthorized access, destruction, use, modification, or disclosure) See California Data Breach Notification Requirements, Cal. Civ. Code § 1798.81.5
  • General Data Protection Regulation: (Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate: (a) the pseudonymisation and encryption of personal data) See General Data Protection Regulation (GDPR), Security of processing, Art. 32(1)(a)
• Background
  • Encryption is an important tool for protecting freedom of expression and privacy. The UN Special Rapporteur on Freedom of Expression has stated unequivocally that encryption and anonymity are essential for the exercise and protection of human rights. We expect companies to clearly disclose that user communications are encrypted by default, that transmissions are protected by “perfect forward secrecy,” that users have an option users have to turn on end-to-end encryption, and if the company offers end-to-end encryption by default. For mobile ecosystems, we expect companies to clearly disclose that they enable full-disk encryption. See Ranking Digital Rights, P16.

8.6.1: Storage Encryption (BASIC)

Do the policies clearly indicate whether or not all data at rest is encrypted?

• Indicator
  • Discloses user information is encrypted or inaccessible while in storage.
  • Discloses user information on mobile devices is encrypted with full disk encryption.
  • Discloses user information is encrypted if stored with third parties.
  • Discloses user information is encrypted while archived.
• Citation
  • California Data Breach Notification Requirements: (A person or business that owns, licenses, or maintains personal information about a California resident is required to implement and maintain reasonable security procedures and practices appropriate to the nature of the information, and to protect the personal information from unauthorized access, destruction, use, modification, or disclosure) See California Data Breach Notification Requirements, Cal. Civ. Code § 1798.81.5
  • General Data Protection Regulation: (Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate: (a) the pseudonymisation and encryption of personal data) See General Data Protection Regulation (GDPR), Security of processing, Art. 32(1)(a)

8.7.1: Breach Notice (BASIC)

Do the policies clearly indicate whether or not the vendor provides notice in the event of a data breach to affected individuals?

• Indicator
  • Discloses processes for notification of users affected by a data breach.
  • Discloses notification is provided to relevant legal authorities without unreasonable delay when a data breach occurs.
  • Discloses steps taken by the company to remedy the impact of a data breach on users.
• Citation
  • California Data Breach Notification Requirements: (A business that collects personal information from California consumers is required to disclose a breach of the security of their system following discovery or notification of the breach in the security of a consumer's data whose unencrypted personal information was reasonably believed to have been acquired by an unauthorized person) See California Data Breach Notification Requirements, Cal. Civ. Code § 1798.29; § 1798.29(h)(4); § 1798.82;
  • California AB 1584 - Privacy of Pupil Records: (A local educational agency that enters into a contract with a third party must ensure the contract contains a description of the procedures for notifying the affected parent, legal guardian, or eligible pupil in the event of an unauthorized disclosure of the pupil’s records) See California AB 1584 - Privacy of Pupil Records, Cal. Ed. Code § 49073.1(b)(6)
  • General Data Protection Regulation: (“personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed) See General Data Protection Regulation (GDPR), Definitions, Art. 4(12)
  • General Data Protection Regulation: (In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.) See General Data Protection Regulation (GDPR), Notification of a personal data breach to the supervisory authority, Art. 33(1)
  • General Data Protection Regulation: (The processor shall notify the controller without undue delay after becoming aware of a personal data breach.) See General Data Protection Regulation (GDPR), Notification of a personal data breach to the supervisory authority, Art. 33(2)
  • General Data Protection Regulation: (The notification ... shall at least: (a) describe the nature of the personal data breach including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned; (b) communicate the name and contact details of the data protection officer or other contact point where more information can be obtained; (c) describe the likely consequences of the personal data breach; (d) describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.) See General Data Protection Regulation (GDPR), Notification of a personal data breach to the supervisory authority, Art. 33(3)(a)-(d)
  • General Data Protection Regulation: (Where, and in so far as, it is not possible to provide the information at the same time, the information may be provided in phases without undue further delay.) See General Data Protection Regulation (GDPR), Notification of a personal data breach to the supervisory authority, Art. 33(4)
  • General Data Protection Regulation: (The controller shall document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken. That documentation shall enable the supervisory authority to verify compliance with this Article.) See General Data Protection Regulation (GDPR), Notification of a personal data breach to the supervisory authority, Art. 33(5)
  • General Data Protection Regulation: (When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay.) See General Data Protection Regulation (GDPR), Communication of a personal data breach to the data subject, Art. 34(1)
  • General Data Protection Regulation: (The communication to the data subject referred to in paragraph 1 of this Article shall describe in clear and plain language the nature of the personal data breach and contain at least the information and the recommendations provided) See General Data Protection Regulation (GDPR), Communication of a personal data breach to the data subject, Art. 34(2)
  • General Data Protection Regulation: (The communication to the data subject ... shall not be required if any of the following conditions are met: (a) the controller has implemented appropriate technical and organisational protection measures, and that those measures were applied to the personal data affected by the personal data breach, in particular those that render the personal data unintelligible to any person who is not authorised to access it, such as encryption; (b) the controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects ... is no longer likely to materialise; (c) it would involve disproportionate effort. In such a case, there shall instead be a public communication or similar measure whereby the data subjects are informed in an equally effective manner.) See General Data Protection Regulation (GDPR), Communication of a personal data breach to the data subject, Art. 34(3)(a)-(c)
• Background
  • The breach notification laws in California and the 46 other states are similar in many ways, because most are modeled on the original California law. All of them require notifying individuals when their personal information has been breached, prefer written notification but allow using the "substitute method" in certain situations, allow for a law enforcement delay, and provide an exemption from the requirement to notify when data is encrypted and the keys required to de-crypt the data are still secure. However, there are some differences, primarily in three areas: (1) the notification trigger, (2) the timing for notification, and (3) the definition of covered information. See CA DOJ, California Data Breach Report (2016).
  • A vendor should develop and describe the process for notifying schools or school districts, parents, legal guardians, or eligible students, as well as any appropriate government agencies, of any unauthorized disclosure of student information. Determine whether the incident and the types of data involved also require notification under California's breach notification law, and if so, take appropriate action. See Ready for School, Recommendations for the Ed Tech Industry to Protect the Privacy of Student Data (November 2016), CA. D.O.J., p. 15.
  • When the security of users' data has been compromised due to a data breach, companies should have clearly disclosed processes in place for addressing the security threat and for notifying affected users. Given that data breaches can result in significant threats to an individual's financial or personal security, in addition to exposing private information, companies should make these security processes publicly available. Individuals can then make informed decisions and consider the potential risks before signing up for a service or giving a company their information. Company press releases or blog posts addressing a data breach after it has occurred do not qualify as sufficient disclosure for this indicator. We expect companies to have formal policies in place regarding their handling of data breaches if and when they occur, and companies to make this information about these policies and commitments public. See Ranking Digital Rights, P15.

Data Rights: Controlling rights to data

Evaluating data rights takes into consideration best practices of providing users with the ability to review, access, modify, delete, and export their personal information and content.

5.1.1: User Submission (BASIC)

Do the policies clearly indicate whether or not a user can create or upload content to the product?

• Indicator
  • Discloses user content may be created or uploaded to the product.

5.6.1: Data Ownership

Do the policies clearly indicate whether or not a student, educator, parent, or the school retains ownership to the Intellectual Property rights of the data collected or uploaded to the product?

• Indicator
  • Discloses copyright ownership of content remains with the user who created or uploaded the content to the product
  • Discloses the company does not retain any control or ownership over the operation, use, inputs, or outputs of the product after it has been purchased by the consumer.
• Citation
  • California AB 1584 - Privacy of Pupil Records: (A local educational agency that enters into a contract with a third party must ensure the contract contains a statement that pupil records continue to be the property of and under the control of the local educational agency) See California AB 1584 - Privacy of Pupil Records, Cal. Ed. Code § 49073.1(b)(1)
  • Copyright Act of 1976: (Copyright protection is extended to original works of authorship fixed in any tangible medium of expression) See Copyright Act of 1976, 17 U.S.C. § 102
• Background
  • Maintaining ownership of data to which the provider may have access allows schools or districts to retain control over the use and maintenance of FERPA protected student information and protect against a provider selling information. See PTAC, Protecting Student Privacy While Using Online Educational Services: Model Terms of Service, p. 7.

6.1.1: Access Data (BASIC)

Do the policies clearly indicate whether or not the vendor provides authorized individuals a method to access a user's personal information?

• Indicator
  • Discloses processes for access and review of users' information.
• Citation
  • Children's Online Privacy Protection Act: (An operator is required to provide a parent or guardian access to review, modify, or delete their children's information or prevent further collection of information) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.3(c); See also 16 C.F.R. Part 312.4(d)(3); 16 C.F.R. Part 312.6)
  • California Online Privacy Protection Act: (If the operator maintains a process for a consumer to review and request changes to any of their personally identifiable information they must provide a description of that process) See California Online Privacy Protection Act (CalOPPA), Cal. B.&P. Code §22575(b)(2)
  • General Data Protection Regulation: (The controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing: ... (b) the existence of the right to request from the controller access to ... personal data ... concerning the data subject) See General Data Protection Regulation (GDPR), Information to be provided where personal data are collected from the data subject, Art. 13(2)(b)
  • General Data Protection Regulation: (The controller shall provide the data subject with the following information necessary to ensure fair and transparent processing in respect of the data subject: ... (c) the existence of the right to request from the controller access to ... personal data ... concerning the data subject) See General Data Protection Regulation (GDPR), Information to be provided where personal data have not been obtained from the data subject, Art. 14(2)(c)
  • General Data Protection Regulation: (The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and where that is the case, access to the personal data) See General Data Protection Regulation (GDPR), Right of access by the data subject, Art. 15(1)

6.3.1: Data Modification (BASIC)

Do the policies clearly indicate whether or not the vendor provides authorized individuals with the ability to modify a user's inaccurate data?

• Indicator
  • Discloses processes for the correction or modification of users' information.
• Citation
  • California Online Privacy Protection Act: (If the operator maintains a process for a consumer to review and request changes to any of their personally identifiable information they must provide a description of that process) See California Online Privacy Protection Act (CalOPPA), Cal. B.&P. Code §22575(b)(2)
  • General Data Protection Regulation: (The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.) See General Data Protection Regulation (GDPR), Right to rectification, Art. 16

6.4.1: Retention Policy

Do the policies clearly indicate the vendor's data retention policy, including any data sunsets or any time-period after which a user's data will be automatically deleted if they are inactive on the product?

• Indicator
  • Discloses a timeframe in which the company may retain user information.
  • Discloses users' information is automatically deleted after a specified timeframe.
  • Discloses users' information is retained for different timeframes based on the type of data collected.
• Citation
  • General Data Protection Regulation: (The controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing: (a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period) See General Data Protection Regulation (GDPR), Information to be provided where personal data are collected from the data subject, Art. 13(2)(a)
  • General Data Protection Regulation: (The controller shall provide the data subject with the following information necessary to ensure fair and transparent processing in respect of the data subject: (a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period) See General Data Protection Regulation (GDPR), Information to be provided where personal data have not been obtained from the data subject, Art. 14(2)(a)
  • General Data Protection Regulation: (The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and where that is the case, access to the personal data and the following information: ... (d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period) See General Data Protection Regulation (GDPR), Right of access by the data subject, Art. 15(1)(d)
• Background
  • A vendor should retain student information acquired through the site or service only as long as allowed or required by the school or district. A vendor should also describe their data retention policy, including how long they retain student information and why. A vendor's default retention period for covered information should not be indefinite. See Ready for School, Recommendations for the Ed Tech Industry to Protect the Privacy of Student Data (November 2016), CA. D.O.J., p. 12.
  • Companies collect a wide range of personal information from users in exchange for the use of and access to the company's products and services. This information can range from personal details, profiles, and account activities to information about a user's activities and location. We expect companies to clearly disclose how long they retain user information and the extent to which they remove identifiers from user information they retain. Users should also be able to understand what happens when they delete their accounts. Companies that choose to retain user information for extended periods of time should take steps to ensure that data is not tied to a specific user. Acknowledging the ongoing debates about the efficacy of de-identification processes, and the growing sophistication around re-identification practices, we still consider de-identification a positive step that companies can take to protect the privacy of their users. If companies collect multiple types of information, we expect them to provide detail on how they handle each type of information. See Ranking Digital Rights, P6.

6.5.4: Deletion Process (BASIC)

Do the policies clearly indicate whether or not the vendor provides a process for the school, parent, or eligible student to delete a student's personal information?

• Indicator
  • Discloses processes for the school, parents, or students to delete users' information.
• Citation
  • Children's Online Privacy Protection Act: (An operator is required to provide a parent or guardian access to review, modify, or delete their children's information or prevent further collection of information) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.3(c); See also 16 C.F.R. Part 312.4(d)(3); 16 C.F.R. Part 312.6)
  • Family Educational Rights and Privacy Act: (A parent or guardian can request the educational agency to access, modify, or delete their student's education records) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.10; 34 C.F.R. Part 99.20
  • Family Educational Rights and Privacy Act: (Any rights to access, modify, or delete student records may transfer to an "eligible" student who is over 18 years of age) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.5(a)(1)
  • Student Online Personal Information Protection Act: (An operator is required to delete personal information at the request of a parent or the school) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(d)(2)
  • California Privacy of Pupil Records: (Prohibits schools, school districts, county offices of education, and charter schools from collecting or maintaining information about pupils from social media for any purpose other than school or pupil safety, without notifying each parent or guardian and providing the pupil with access and an opportunity to correct or delete such information) See California Privacy of Pupil Records, Cal. Ed. Code § 49073.6(c)
  • General Data Protection Regulation: (The controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing: ... (b) the existence of the right to request from the controller ... erasure of personal data ... concerning the data subject) See General Data Protection Regulation (GDPR), Information to be provided where personal data are collected from the data subject, Art. 13(2)(b)
  • General Data Protection Regulation: (The controller shall provide the data subject with the following information necessary to ensure fair and transparent processing in respect of the data subject: ... (c) the existence of the right to request from the controller ... erasure of personal data ... concerning the data subject) See General Data Protection Regulation (GDPR), Information to be provided where personal data have not been obtained from the data subject, Art. 14(2)(c)
  • General Data Protection Regulation: (The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and where that is the case, access to the personal data and the following information: ... (e) the existence of the right to request from the controller ... erasure of personal data ... concerning the data subject) See General Data Protection Regulation (GDPR), Right of access by the data subject, Art. 15(1)(e)
  • General Data Protection Regulation: (The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: ... (b) the data subject withdraws consent on which the processing is based ... and where there is no other legal ground for the processing) See General Data Protection Regulation (GDPR), Right to erasure, Art. 17(1)(b)
  • General Data Protection Regulation: (The controller shall communicate any ... erasure of personal data ... to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it.) See General Data Protection Regulation (GDPR), Notification obligation regarding rectification or erasure of personal data or restriction of processing, Art. 19
• Background
  • A vendor should build into their system the ability to destroy personally identified or identifiable information acquired through the site or service. A vendor should also be prepared to delete the information if directed by the school or district. See Ready for School, Recommendations for the Ed Tech Industry to Protect the Privacy of Student Data (November 2016), CA. D.O.J., p. 12.
  • The FTC recommends that as a best practice a vendor should delete personal information they know to have come from a child-directed site. In addition, COPPA requires that parents be able to direct the deletion of personal data. See FTC, Complying with COPPA: Frequently Asked Questions, question K.2; 16 C.F.R. § 312.6(a)(2).

6.5.2: Account Deletion

Do the policies clearly indicate whether or not a user's data are deleted upon account cancellation or termination?

• Indicator
  • Discloses users' information is deleted after they cancel their account or remove the product from a device.
• Citation
  • Children's Online Privacy Protection Act: (An operator may retain information collected from a child only as long as necessarily to fulfill the purpose for which it was collected and must delete the information using reasonable measures to prevent unauthorized use) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.10
  • Family Educational Rights and Privacy Act: (A parent or guardian can request the educational agency to access, modify, or delete their student's education records) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.10; 34 C.F.R. Part 99.20
  • Family Educational Rights and Privacy Act: (Any rights to access, modify, or delete student records may transfer to an "eligible" student who is over 18 years of age) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.5(a)(1)
  • Student Online Personal Information Protection Act: (An operator is required to delete personal information at the request of a parent or the school) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(d)(2)

6.5.1: Deletion Purpose

Do the policies clearly indicate whether or not the vendor will delete a user's personal information when the data are no longer necessary to fulfill its intended purpose?

• Indicator
  • Discloses users' information will be deleted when no longer neccessary for the purpose in which it was collected.
• Citation
  • Children's Online Privacy Protection Act: (An operator may retain information collected from a child only as long as necessarily to fulfill the purpose for which it was collected and must delete the information using reasonable measures to prevent unauthorized use) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.10
  • California AB 1584 - Privacy of Pupil Records: (A local educational agency that enters into a contract with a third party must ensure the contract contains a certification that a pupil's records shall not be retained or available to the third party upon completion of the terms of the contract and a description of how that certification will be enforced) See California AB 1584 - Privacy of Pupil Records, Cal. Ed. Code § 49073.1(b)(7)
  • General Data Protection Regulation: (The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: (a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed) See General Data Protection Regulation (GDPR), Right to erasure, Art. 17(1)(a)

6.1.2: Restrict Access

Do the policies clearly indicate whether or not the vendor provides mechanisms (permissions, roles, or access controls, etc.) to restrict what data are accessible to specific users?

• Indicator
  • Discloses processes for restricting access to users' information for unauthorized individuals.
  • Discloses mechanisms are used (permissions, roles, or access controls, etc.) to restrict what data is accessible to specific users.
• Citation
  • Children's Online Privacy Protection Act: (An operator is required to provide a parent or guardian access to review, modify, or delete their children's information or prevent further collection of information) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.3(c); See also 16 C.F.R. Part 312.4(d)(3); 16 C.F.R. Part 312.6)
  • Family Educational Rights and Privacy Act: (A parent or guardian can request the educational agency to access, modify, or delete their student's education records) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.10; 34 C.F.R. Part 99.20
  • General Data Protection Regulation: (The controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing: ... (b) the existence of the right to request from the controller ... restriction of processing concerning the data subject) See General Data Protection Regulation (GDPR), Information to be provided where personal data are collected from the data subject, Art. 13(2)(b)
  • General Data Protection Regulation: (The controller shall provide the data subject with the following information necessary to ensure fair and transparent processing in respect of the data subject: ... (c) the existence of the right to request from the controller ... restriction of processing concerning the data subject) See General Data Protection Regulation (GDPR), Information to be provided where personal data have not been obtained from the data subject, Art. 14(2)(c)
  • General Data Protection Regulation: (The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and where that is the case, access to the personal data and the following information: ... (e) the existence of the right to request from the controller ... restriction of processing concerning the data subject) See General Data Protection Regulation (GDPR), Right of access by the data subject, Art. 15(1)(e)
• Background
  • A consumers' privacy interests in personal data persist throughout their relationships with a company. Accordingly, this includes a right to withdraw consent to use personal data that the company controls. Companies should provide means of withdrawing consent that are on equal footing with ways they obtain consent. For example, if consumers grant consent through a single action on their computers, they should be able to withdraw consent in a similar fashion. See Exec. Office of the President, Consumer Data Privacy in a Networked World: A Framework for Protecting Privacy and Promoting Innovation in the Global Digital Economy (2012), pp. 13-14.

6.6.1: User Export

Do the policies clearly indicate whether or not a user can export or download their data, including any user created content on the product?

• Indicator
  • Discloses users can download or export their information in a structured data format.
• Citation
  • Student Online Personal Information Protection Act: (An operator is required to allow a student or parent to export, save, or maintain their own student created data or content) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(r)
  • California AB 1584 - Privacy of Pupil Records: (A local educational agency that enters into a contract with a third party must ensure the contract contains a description of the means by which pupils may retain possession and control of their own pupil-generated content, including options by which a pupil may transfer pupil-generated content to a personal account) See California AB 1584 - Privacy of Pupil Records, Cal. Ed. Code § 49073.1(b)(2)
  • General Data Protection Regulation: (The controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing: ... (b) the existence of the right to ... data portability) See General Data Protection Regulation (GDPR), Information to be provided where personal data are collected from the data subject, Art. 13(2)(b)
  • General Data Protection Regulation: (The controller shall provide the data subject with the following information necessary to ensure fair and transparent processing in respect of the data subject: ... (c) the existence of the right to ... data portability) See General Data Protection Regulation (GDPR), Information to be provided where personal data have not been obtained from the data subject, Art. 14(2)(c)
  • General Data Protection Regulation: (The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided) See General Data Protection Regulation (GDPR), Right to data portability, Art. 20(1)
  • General Data Protection Regulation: (In exercising his or her right to data portability ... the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.) See General Data Protection Regulation (GDPR), Right to data portability, Art. 20(2)
• Background
  • A vendor should implement policies and procedures to allow students to download, transfer, export, or delete their own student-created content. Use the Privacy Policy as one place to provide information on how a student can do this. See Ready for School, Recommendations for the Ed Tech Industry to Protect the Privacy of Student Data (November 2016), CA. D.O.J., p. 14.

Individual Control: Controlling data use

Responsible data use practices limit how personal information is used to only what's necessary to provide the application or service and user controls allow data practices to change.

5.4.1: User Control

Do the policies clearly indicate whether or not a user can control the vendor or third party's use of their information through privacy settings?

• Indicator
  • Discloses how users can control the collection, use, or disclosure of their information.
• Background
  • While notice and consent remains fundamental in many contexts, it is important to examine whether a greater focus on how data is used and reused would be a more productive basis for managing privacy rights in a big data environment. It may be that creating mechanisms for individuals to participate in the use and distribution of his or her information after it is collected is actually a better and more empowering way to allow people to access the benefits that derive from their information. Privacy protections must also evolve in a way that accommodates the social good that can come of big data use. See Exec. Office of the President, Big Data: Seizing Opportunities, Preserving Values (2014), p. 61.

4.1.1: Purpose Limitation

Do the policies clearly indicate whether or not the vendor limits the use of data collected by the product to the educational purpose for which it was collected?

• Indicator
  • Discloses use of information is limited to the purpose for which it was collected.
  • Discloses user information is only used if it is directly relevant or necessary for the product.
• Citation
  • Children's Online Privacy Protection Act: (An operator may retain information collected from a child only as long as necessarily to fulfill the purpose for which it was collected and must delete the information using reasonable measures to prevent unauthorized use) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.10
  • Children's Online Privacy Protection Act: (An operator is required to provide direct notice to parents describing what information is collected, how information is used, its disclosure practices and exceptions) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.4(b)
  • Student Online Personal Information Protection Act: (Student data may be used by the operator for adaptive learning or customized assessments) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(l)
  • California AB 1584 - Privacy of Pupil Records: (A local educational agency that enters into a contract with a third party must ensure the contract contains a prohibition against the third party using any information in the pupil record for any purpose other than those required or specifically permitted by the contract) See California AB 1584 - Privacy of Pupil Records, Cal. Ed. Code § 49073.1(b)(3)
  • General Data Protection Regulation: ([Data shall be] collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes) See General Data Protection Regulation (GDPR), Principles relating to processing of personal data, Art. 5(1)(b)
  • General Data Protection Regulation: (The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. In particular, such measures shall ensure that by default personal data are not made accessible without the individual's intervention to an indefinite number of natural persons.) See General Data Protection Regulation (GDPR), Data protection by design and by default, Art. 25(2)
• Background
  • Any PII from a students's education record that the provider receives under FERPA's "school official" exception may only be used for the specific purpose for which it was disclosed (i.e., to perform the outsourced institutional service or function, and the school or district must have direct control over the use and maintenance of the PII by the provider receiving the PII). Further, under FERPA's school official exception, the provider may not share or sell FERPA-protected information, or re-use it for any other purposes, except as directed by the school or district and as permitted by FERPA. See PTAC, Protecting Student Privacy While Using Online Educational Services: Requirements and Best Practices, p. 5.
  • Companies should publicly commit to the principle of use limitation, which is part of the OECD privacy guidelines, among other frameworks. See Ranking Digital Rights, P5.

4.1.2: Data Purpose

Do the policies clearly indicate the context or purpose for which data are collected?

• Indicator
  • Discloses why user information is collected for the product.
  • Discloses the context in which user information is collected for the product.
• Citation
  • General Data Protection Regulation: (Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information: ... (c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing) See General Data Protection Regulation (GDPR), Information to be provided where personal data are collected from the data subject, Art. 13(1)(c)
  • General Data Protection Regulation: (Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information: (c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing) See General Data Protection Regulation (GDPR), Information to be provided where personal data have not been obtained from the data subject, Art. 14(1)(c)
  • General Data Protection Regulation: (The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and where that is the case, access to the personal data and the following information: ... (a) the purposes of the processing) See General Data Protection Regulation (GDPR), Right of access by the data subject, Art. 15(1)(a)
• Background
  • The Federal Trade Commission ("FTC") encourages companies that collect personal information that is inconsistent with the context of a particular transaction, or the consumer's relationship with the business, to make appropriate disclosures to consumers regarding the company's data collection practices at a relevant time and in a prominent manner – outside of a privacy policy or other legal document. See FTC, Protecting Consumer Privacy in an era of rapid change: recommendations for business and policy makers (2012), p. 27.
  • There may be practices that are inconsistent with the context of the interaction standard and thus warrant consumer choice. For instance, there may be contexts in which the "repurposing" of data to improve existing products or services would exceed the internal operations concept. Thus, where a product improvement involves additional sharing of consumer data with third-parties, it would no longer be an "internal operation" consistent with the context of the consumer's interaction with a company. See FTC, Protecting Consumer Privacy in an era of rapid change: recommendations for business and policy makers (2012), p. 39.

3.13.1: Vendor Combination

Do the policies clearly indicate whether or not data collected or maintained by the vendor can be augmented, extended, or combined with data from third-party sources?

• Indicator
  • Discloses user information is combined with information from third parties by the vendor.
• Citation
  • Children's Online Privacy Protection Act: (Non-personal information collected from a child that is later combined with personally identifiable information of that child, obtained from either the vendor or third party becomes PII) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2

4.2.1: Combination Type

Do the policies clearly indicate whether or not the vendor would treat personally identifiable information (PII) combined with non-personally identifiable information as PII?

• Indicator
  • Discloses any collected information combined with personal information is treated as Personally Identifiable Information (PII).
• Citation
  • Children's Online Privacy Protection Act: (Non-personal information collected from a child that is later combined with personally identifiable information of that child, obtained from either the vendor or third party becomes PII) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2
• Background
  • When data are collected in one context and combined with data from other sources or different contexts, it increases the potential for an individual's privacy to be compromised. Combining data from multiple sources is part of the process of creating a digital profile of a student. Combining data from multiple sources can also be used to re-identify data sets that have been de-identified, or to identify individuals within data sets that have been shared as anonymous aggregated data. A privacy policy that prohibits third-parties from re-identifying anonymous aggregated data provides an additional level of privacy protection for users. See PTC, Data De-identification: An Overview of Basic Terms.

4.3.1: Context Notice

Do the policies clearly indicate whether or not notice is provided to a user if the vendor changes the context in which data are collected?

• Indicator
  • Discloses notification is provided to users if the context in which data are collected or used changes.
• Citation
  • General Data Protection Regulation: (Where the controller intends to further process the personal data for a purpose other than that for which the personal data were collected, the controller shall provide the data subject prior to that further processing with information on that other purpose) See General Data Protection Regulation (GDPR), Information to be provided where personal data are collected from the data subject, Art. 13(3)
  • General Data Protection Regulation: (Where the controller intends to further process the personal data for a purpose other than that for which the personal data were obtained, the controller shall provide the data subject prior to that further processing with information on that other purpose) See General Data Protection Regulation (GDPR), Information to be provided where personal data have not been obtained from the data subject, GDPR Art. 14(4)

4.4.1: Context Consent

Do the policies clearly indicate whether or not the vendor will obtain consent if the practices in which data are collected change or are inconsistent with contractual requirements?

• Indicator
  • Discloses consent will be obtained if the context in which data are collected or used changes.
• Citation
  • General Data Protection Regulation: (Where the processing for a purpose other than that for which the personal data have been collected is not based on the data subject's consent or on a Union or Member State law which constitutes a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller shall, in order to ascertain whether processing for another purpose is compatible with the purpose for which the personal data are initially collected, take into account, several factors.) See General Data Protection Regulation (GDPR), Lawfulness of Processing, Art. 6(4)(a)-(d)

5.3.1: Complaint Notice

Do the policies clearly indicate whether or not the vendor has a grievance or remedy mechanism for users to file a complaint after the vendor restricts or removes a user's content or account?

• Indicator
  • Discloses notification is provided to users if their account or content is restricted.
  • Discloses notification is provided to users who attempt to access content that has been restricted.
  • Discloses users can file a complaint if their account or content is restricted.
  • Discloses the reasons why a user's account or content may be restricted.
  • Discloses an appeal process for users to request their account or content be restored.
  • Discloses data about the number of accounts it restricts or closes on its own initiative.
  • Discloses data about the number of accounts it restricts or closes as a result of a government request.
  • Discloses data about the number of accounts it restricts or closes as a result of a request from private third-parties.
• Citation
  • The Communications Decency Act of 1996: (No provider or user of an interactive computer service shall be held liable on account of any action voluntarily taken in good faith to restrict access to or availability of material that the provider or user considers to be obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable, whether or not such material is constitutionally protected; or any action taken to enable or make available to information content providers or others the technical means to restrict access to material) See The Communications Decency Act of 1996 (CDA), 47 U.S.C. 230(c)
  • Digital Millennium Copyright Act: (The provider of a service or application that has removed or disabled access to material or activity claimed to be infringing must take reasonable steps to promptly notify the subscriber that it has removed or disabled access to their material) See Digital Millennium Copyright Act (DMCA), 17 U.S.C. § 512(g)(2)(A)
  • General Data Protection Regulation: ("restriction of processing" means the marking of stored personal data with the aim of limiting their processing in the future) See General Data Protection Regulation (GDPR), Definitions, Art. 4(3)
  • General Data Protection Regulation: (The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies: ... (b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead) See General Data Protection Regulation (GDPR), Right to restriction of processing, Art. 18(1)(b)
  • General Data Protection Regulation: (The controller shall communicate any ... restriction of processing... to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it.) See General Data Protection Regulation (GDPR), Notification obligation regarding rectification or erasure of personal data or restriction of processing, Art. 19
  • General Data Protection Regulation: (The controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing: ... (d) the right to lodge a complaint with a supervisory authority) See General Data Protection Regulation (GDPR), Information to be provided where personal data are collected from the data subject, Art. 13(2)(d)
  • General Data Protection Regulation: (The controller shall provide the data subject with the following information necessary to ensure fair and transparent processing in respect of the data subject: (e) the right to lodge a complaint with a supervisory authority) See General Data Protection Regulation (GDPR), Information to be provided where personal data have not been obtained from the data subject, Art. 14(2)(e)
  • General Data Protection Regulation: (The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and where that is the case, access to the personal data and the following information: ... (f) the right to lodge a complaint with a supervisory authority) See General Data Protection Regulation (GDPR), Right of access by the data subject, Art. 15(1)(f)
  • General Data Protection Regulation: (Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation.) See General Data Protection Regulation (GDPR), Right to an effective judicial remedy against a controller or processor, Art. 79(1)
  • General Data Protection Regulation: (Proceedings against a controller or a processor shall be brought before the courts of the Member State where the controller or processor has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where the data subject has his or her habitual residence, unless the controller or processor is a public authority of a Member State acting in the exercise of its public powers.) See General Data Protection Regulation (GDPR), Right to an effective judicial remedy against a controller or processor, Art. 79(2)
• Background
  • Companies often set boundaries for what content users can post on a service as well as what activities users can engage in on the service. Companies can also restrict a user’s account, meaning that the user is unable to access the service, for violating these rules. For mobile ecosystems, this can include restricting access to an end-user’s account or a developer’s account. See Ranking Digital Rights, F3.
  • We also expect companies to clearly disclose whether they have a policy of granting priority or expedited consideration to any government authorities and/or members of private organizations or other entities that identify their organizational affiliation when they report content or users for allegedly violating the company’s rules. See Ranking Digital Rights, F3.
  • This indicator focuses on whether companies clearly disclose that they notify users when they take these types of actions (whether due to terms of service enforcement or third-party restriction requests). A company's decision to restrict or remove access to content or accounts can have a significant impact on users' freedom of expression and access to information rights. We therefore expect companies to disclose that they notify users when they have removed content, restricted a user's account, or otherwise restricted users' abilities to access a service. If a company removes content that a user has posted, we expect the company to inform that user about its decision. If a different user attempts to access content that the company has restricted, we expect the company to notify that user about the content restriction. We also expect companies to specify reasons for their decisions. This disclosure should be part of companies' explanations of their content and access restriction practices. See Ranking Digital Rights, F8.

5.5.2: Disclosure Request

Do the policies clearly indicate whether or not a user can request the vendor to provide all the personal information the vendor has shared with third parties?

• Indicator
  • Discloses what types or categories of information users can obtain from a request.
  • Discloses users can obtain a copy of all their information collected by the product.
  • Discloses users can obtain a copy of all their information shared with third parties.
  • Discloses users can obtain their information in a structured data format.
• Citation
  • California "Shine the Light": (California's "Shine the Light" law refers to information sharing disclose requirements for companies that do business with California residents to allow customers to opt-out of information sharing, or make a detailed disclosure of how personal information was shared for direct marketing purposes) See Information Sharing Disclosure, Cal. Civ. Code §§1798.83-1798.84
  • Family Educational Rights and Privacy Act: (A parent or guardian may request to receive a copy of their student's records that have been disclosed by the vendor) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.30(c)(1)
  • General Data Protection Regulation: (The controller shall take appropriate measures to provide any information ... relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means.) See General Data Protection Regulation (GDPR), Transparent information, communication and modalities for the exercise of the rights of the data subject, Art. 12(1)
  • General Data Protection Regulation: (The controller shall provide information on action taken on a request ... to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.) See General Data Protection Regulation (GDPR), Transparent information, communication and modalities for the exercise of the rights of the data subject, Art. 12(3)
  • General Data Protection Regulation: (If the controller does not take action on the request of the data subject, the controller shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.) See General Data Protection Regulation (GDPR), Transparent information, communication and modalities for the exercise of the rights of the data subject, Art. 12(4)
  • General Data Protection Regulation: (Information provided ... and any communication and any actions taken ... shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either: (a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or (b) refuse to act on the request. The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.) See General Data Protection Regulation (GDPR), Transparent information, communication and modalities for the exercise of the rights of the data subject, Art. 12(5)
  • General Data Protection Regulation: (The information to be provided to data subjects pursuant to Articles 13 and 14 may be provided in combination with standardised icons in order to give in an easily visible, intelligible and clearly legible manner a meaningful overview of the intended processing. Where the icons are presented electronically they shall be machine-readable.) See General Data Protection Regulation (GDPR), Transparent information, communication and modalities for the exercise of the rights of the data subject, Art. 12(7)
  • General Data Protection Regulation: (The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.) See General Data Protection Regulation (GDPR), Right of access by the data subject, Art. 15(3)
  • General Data Protection Regulation: (The controller shall provide the information ... (a) within a reasonable period after obtaining the personal data, but at the latest within one month, having regard to the specific circumstances in which the personal data are processed; (b) if the personal data are to be used for communication with the data subject, at the latest at the time of the first communication to that data subject; or (c) if a disclosure to another recipient is envisaged, at the latest when the personal data are first disclosed.) See General Data Protection Regulation (GDPR), Information to be provided where personal data have not been obtained from the data subject, Art. 14(3)(a)-(c)
  • General Data Protection Regulation: ([Notice] shall not apply where and insofar as: ... (b) the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available) See General Data Protection Regulation (GDPR), Information to be provided where personal data have not been obtained from the data subject, Art. 14(5)(b)
• Background
  • Users should be able to obtain all information that companies hold about them. We expect companies to clearly disclose what options users have to obtain this information, what data this record contains, and what formats users can obtain it in. See Ranking Digital Rights, P8.

5.5.3: Disclosure Notice

Do the policies clearly indicate whether or not the vendor will provide the affected user, school, parent, or student with notice in the event the vendor receives a government or legal request for their information?

• Indicator
  • Discloses users are notified when government entities (including courts or other judicial bodies) request their user information.
  • Discloses notification is provided to an affected individual(s) of a government or private request for information.
  • Discloses the number of legal requests for information received.
  • Discloses situations when the company might not notify users, including a description of the types of government requests it is prohibited by law from disclosing to users.
  • Discloses the number of legal requests the company is prohibited by law from disclosing.
  • Discloses commitment to carry out due diligence on requests before deciding how to respond and to deny unlawful requests.
  • Discloses guidance or examples of its process of providing notice.
• Citation
  • Family Educational Rights and Privacy Act: (An educational agency or institution may disclose information for lawful reasons if they make a reasonable effort to notify the parent or eligible student of the order or subpoena in advance of compliance, so that the parent or eligible student may seek protective action) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.31(a)(9)(ii)
  • California Electronic Communications Privacy Act: (Prohibits a government entity from compelling the production of or access to electronic communication information or electronic device information, without a search warrant, wiretap order, order for electronic reader records, or subpoena issued pursuant under specified conditions, except for emergency situations) See California Electronic Communications Privacy Act, Cal. Pen. Code § 1546-1546.4)
  • General Data Protection Regulation: (The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: ... (d) the personal data have been unlawfully processed) See General Data Protection Regulation (GDPR), Right to erasure, Art. 17(1)(d)
  • General Data Protection Regulation: (The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies: ... (d) the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.) See General Data Protection Regulation (GDPR), Right to restriction of processing, Art. 18(1)(d)
• Background
  • We expect companies to clearly disclose a commitment to notifying users when governments and private parties request data about users. We acknowledge that this notice may not be possible in legitimate cases of an ongoing investigation; however, we expect companies to specify what types of government requests they are prohibited by law from disclosing. See Ranking Digital Rights, P12.

Data Sold: Preventing sale of data

Evaluating data selling takes into consideration best practices of not sharing, renting, or selling a user’s personal information to third parties for financial gain.

3.4.1: Sell Data (BASIC)

Do the policies clearly indicate whether or not a user's personal information is sold or rented to third parties?

• Indicator
  • Discloses user information is sold or rented to third parties.
  • Discloses vendor may sell user information to third parties.
• Citation
  • Children's Online Privacy Protection Act: (Release of personal information means the sharing, selling, renting, or transfer of personal information to any third party) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2
  • Student Online Personal Information Protection Act: (An operator is prohibited from selling or renting student information) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(b)(3)
• Background
  • Companies that have first-party relationships with consumers should disclose specifically the purposes for which they provide personal data to third-parties, in order to help consumers understand the nature of those third-parties' activities, and whether those third-parties are bound to limit their use of the data to achieving those purposes. This gives consumers a more tractable task of assessing whether to engage with a single entity, rather than trying to understand what personal data third-parties (potentially dozens, or even hundreds of entities) receive and how they use it. See Exec. Office of the President, Consumer Data Privacy in a Networked World: A Framework for Protecting Privacy and Promoting Innovation in the Global Digital Economy (2012), p. 15.

5.5.1: Opt-Out Consent

Do the policies clearly indicate whether or not a user can opt out from the disclosure or sale of their data to a third party?

• Indicator
  • Discloses users may provide opt-out consent from the disclosure of their data to third parties.
  • Discloses users may provide opt-out consent from the sale of their data to third parties.
• Citation
  • California "Shine the Light": (California's "Shine the Light" law refers to information sharing disclose requirements for companies that do business with California residents to allow customers to opt-out of information sharing, or make a detailed disclosure of how personal information was shared for direct marketing purposes) See Information Sharing Disclosure, Cal. Civ. Code §§1798.83-1798.84
  • General Data Protection Regulation: (The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw consent as to give it.) See General Data Protection Regulation (GDPR), Conditions for Consent, Art. 7(3)
  • General Data Protection Regulation: (The controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing: ... (b) the existence of the right to ... object to processing) See General Data Protection Regulation (GDPR), Information to be provided where personal data are collected from the data subject, Art. 13(2)(b)
  • General Data Protection Regulation: (The controller shall provide the data subject with the following information necessary to ensure fair and transparent processing in respect of the data subject: ... (c) the existence of the right to ... object to processing) See General Data Protection Regulation (GDPR), Information to be provided where personal data have not been obtained from the data subject, Art. 14(2)(c)
  • General Data Protection Regulation: (The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and where that is the case, access to the personal data and the following information: ... (e) the existence of the right to... object to processing) See General Data Protection Regulation (GDPR), Right of access by the data subject, Art. 15(1)(e)
  • General Data Protection Regulation: (The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: ... (c) the data subject objects to the processing ... and there are no overriding legitimate grounds for the processing) See General Data Protection Regulation (GDPR), Right to erasure, Art. 17(1)(c)
  • General Data Protection Regulation: (The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her ... including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims.) See General Data Protection Regulation (GDPR), Right to object, Art. 21(1)
  • General Data Protection Regulation: (At the latest at the time of the first communication with the data subject, the right [to object] ... shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information.) See General Data Protection Regulation (GDPR), Right to object, Art. 21(4)
• Background
  • The California "shine the light" law, requires a company to respond to a customer request for an Information-Sharing Disclosure by providing the user with a cost-free opportunity to prevent the user's information to be shared with third-parties for marketing purposes. The company must adopt and disclose this policy to the public, which would include publishing it in its privacy statement. See California Civil Code § 1798.83(c); See also CA DOJ, California Office of Privacy Protection, Recommended Practices on Information-Sharing Disclosures and Privacy Policy Statements, pp. 16-27.

7.1.1: Transfer Data (BASIC)

Do the policies clearly indicate whether or not the vendor can transfer a user's data in the event of the vendor's merger, acquisition, or bankruptcy?

• Indicator
  • Discloses user information may be transferred to a third party as an asset.
• Citation
  • Children's Online Privacy Protection Act: (Release of personal information means the sharing, selling, renting, or transfer of personal information to any third party) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2
  • Student Online Personal Information Protection Act: (An operator may transfer a student's personal information to a third party in the event of a merger, acquisition, or bankruptcy, but the successor entity is subject to the same onward data privacy and security obligations) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(b)(3)

7.1.3: Transfer Notice

Do the policies clearly indicate whether or not the vendor will notify users of a data transfer to a third-party successor, in the event of a vendor's bankruptcy, merger, or acquisition?

• Indicator
  • Discloses notification is provided and consent is obtained from users before data is transferred to a third party.

7.2.1: Delete Transfer

Do the policies clearly indicate whether or not a user can request to delete their data prior to its transfer to a third-party successor in the event of a vendor bankruptcy, merger, or acquisition?

• Indicator
  • Discloses users' may request deletion of their information before data is transferred to a third party.

7.3.1: Contractual Limits

Do the policies clearly indicate whether or not the third-party successor of a data transfer is contractually required to provide the same privacy compliance required of the vendor?

• Indicator
  • Discloses contractual obligations are imposed on third-party data transfer successors of the same privacy protections provided by the company.
• Citation
  • Children's Online Privacy Protection Act: (An operator must take reasonable steps to release a child's personal information only to service providers and third parties who are capable of maintaining the confidentiality, security, and integrity of the information, and provide assurances that they contractually maintain the information in the same manner) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.8
  • Student Online Personal Information Protection Act: (An operator may transfer a student's personal information to a third party in the event of a merger, acquisition, or bankruptcy, but the successor entity is subject to the same onward data privacy and security obligations) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(b)(3)
  • General Data Protection Regulation: (Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation. All provisions in this Chapter shall be applied in order to ensure that the level of protection of natural persons guaranteed by this Regulation is not undermined.) See General Data Protection Regulation (GDPR), General principle for transfers, Art. 44
• Background
  • A vendor should not sell any student information acquired through the site or service, except as part of a merger or acquisition. In such cases, ensure that any successor entity is contractually obligated to comply with the terms of your privacy policy under which the student information was collected, and with all legal requirements for the use, disclosure, and security of the student information previously acquired through your site or service. See Ready for School, Recommendations for the Ed Tech Industry to Protect the Privacy of Student Data (November 2016), CA. D.O.J., p. 14.

3.15.1: Data Deidentified

Do the policies clearly indicate whether or not a user's information that is shared or sold to a third-party is only done so in an anonymous or deidentified format?

• Indicator
  • Discloses user information is shared in an anonymized or de-identified format.
  • Discloses user information is sold in an anonymized or de-identified format.
• Citation
  • Children's Online Privacy Protection Act: (An operator may disclose personal information collected from children to third parties if the data is not in an identifiable form such as de-identified, aggregated, or anonymous information) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2
  • Family Educational Rights and Privacy Act: (An exception for disclosing personally identifiable information without obtaining parental consent exists for sharing "de-identified" student records where the educational institution has made a reasonable determination that a student's identity is not personally identifiable) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.31(b)(1)
  • Student Online Personal Information Protection Act: (An operator may share student information with a third party if in an aggregated or de-identified format) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(f)-(g)
  • California Privacy of Pupil Records: (A school district may provide, in its discretion, statistical data from which no pupil may be identified to any public agency, entity, private nonprofit college, university, or educational research and development organization when disclosure would be in the best educational interests of pupils) See California Privacy of Pupil Records, Cal. Ed. Code § 49074
  • General Data Protection Regulation: (If the purposes for which a controller processes personal data do not or do no longer require the identification of a data subject by the controller, the controller shall not be obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with this Regulation.) See General Data Protection Regulation (GDPR), Processing which does not require identification, Art. 11(1)
• Background
  • There is nothing wrong with a provider using de-identified data for other purposes, because privacy statutes, govern PII, not de-identified data. But because it can be difficult to fully de-identify data, as a best practice, an agreement between a company and third-party should prohibit re-identification and any future data transfers unless the third-party also agrees not to attempt re-identification. It is also a best practice to be specific about the de-identification process. De-identification typically requires more than just removing any obvious individual identifiers, as other demographic or contextual information can often be used to re-identify specific individuals. Retaining location and school information can also greatly increase the risk of re-identification. See PTAC, Protecting Student Privacy While Using Online Educational Services: Model Terms of Service, P. 3.
  • Properly de-identified data can reduce the risk of a person's sensitive personal information being disclosed, but data de-identification must be done carefully. Simple removal of direct identifiers from the data to be released does not constitute adequate de-identification. Properly performed de-identification involves removing or obscuring all identifiable information until all data that can lead to individual identification have been expunged or masked. Further, when making a determination as to whether the data have been sufficiently de-identified, it is necessary to take into consideration cumulative re-identification risk from all previous data releases and other reasonably available information. See PTC, Data De-identification: An Overview of Basic Terms, p. 3.
  • FERPA allows properly de-identified data to be used for other purposes, though providers planning to use de-identified student data should be clear about their methodologies for de-identification. If de-identified data will be transferred to another party, it is a best practice to contractually prohibit the third-party from attempting to re-identify any student data. Providers should also acknowledge whether anonymized metadata—a type of deidentified or partially de-identified data—will be used, and for what purposes. See PTAC, Responsibilities of Third-Party Service Providers under FERPA, P. 3.
  • If a vendor shares covered information for the development and improvement of educational sites or services, they should de-identify and aggregate the information first. See Ready for School, Recommendations for the Ed Tech Industry to Protect the Privacy of Student Data (November 2016), CA. D.O.J., p. 14.

3.15.2: Deidentified Process

Do the policies clearly indicate whether or not the deidentification process is done with a reasonable level of justified confidence, or whether the vendor provides links to any information that describes their deidentification process?

• Indicator
  • Discloses the process or method in which user information is anonymized or de-identified.
• Citation
  • Children's Online Privacy Protection Act: (An operator may disclose personal information collected from children to third parties if the data is not in an identifiable form such as de-identified, aggregated, or anonymous information) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2
  • Family Educational Rights and Privacy Act: (An exception for disclosing personally identifiable information without obtaining parental consent exists for sharing "de-identified" student records where the educational institution has made a reasonable determination that a student's identity is not personally identifiable) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.31(b)(1)
  • Student Online Personal Information Protection Act: (An operator may share student information with a third party if in an aggregated or de-identified format) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(f)-(g)
  • General Data Protection Regulation: ("pseudonymisation" means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person) See General Data Protection Regulation (GDPR), Definitions, Art. 4(5)
• Background
  • While data shared in the aggregate can reduce the risk of re-identifying anonymous individuals, it does not completely eliminate the risk, and sharing of aggregate data should be carefully reviewed. The aggregation of student-level data into school-level (or higher) reports removes much of the risk of disclosure, since no direct identifiers (such as a name, Social Security Number, or student ID) are present in the aggregated tables. Some risk of disclosure does remain, however, in circumstances where one or more students possess a unique or uncommon characteristic (or a combination of characteristics) that would allow them to be identified in the data table (this commonly occurs with small ethnic subgroup populations), or where some easily observable characteristic corresponds to an unrelated category in the data table (e.g., if a school reports that 100% of males in grade 11 scored at "Below Proficient" on an assessment). In these cases, some level of disclosure avoidance is necessary to prevent disclosure in the aggregate data table. See PTAC, Frequently Asked Questions—Disclosure Avoidance (Oct 2012), p. 2.
  • FERPA allows properly de-identified data to be used for other purposes, though providers planning to use de-identified student data should be clear about their methodologies for de-identification. If de-identified data will be transferred to another party, it is a best practice to contractually prohibit the third-party from attempting to re-identify any student data. Providers should also acknowledge whether anonymized metadata—a type of deidentified or partially de-identified data—will be used, and for what purposes. See PTAC, Responsibilities of Third-Party Service Providers under FERPA, P. 3.
  • A company must take reasonable measures to ensure that the data is de-identified. This means that the company must achieve a reasonable level of justified confidence that the data cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer, computer, or other device. See FTC, Protecting Consumer Privacy in an era of rapid change: recommendations for business and policy makers (2012), p. 21.
  • Anonymous data is 'data that is in no way connected to another piece of information that could enable a user to be identified.' This expansive view is necessary to reflect several facts. First, skilled analysts can de-anonymize large data sets. This renders nearly all promises of anonymization unattainable. In essence, any data tied to an 'anonymous identifier' is not anonymous; rather, this is often pseudonymous data that may be tied back to the user’s offline identity. Second, metadata maybe as or more revealing of a user's associations and interests than content data, thus this data is of vital interest. Third, entities that have access to many sources of data, such as data brokers and governments, may be able to pair two or more data sources to reveal information about users. Thus, sophisticated actors can use data that seems anonymous to construct a larger picture of a user. See Ranking Digital Rights, P3.

3.2.3: Third-Party Research

Do the policies clearly indicate whether or not collected information is shared with third parties for research or product improvement purposes?

• Indicator
  • Discloses information is shared with third parties for research or product improvement purposes.
• Citation
  • Children's Online Privacy Protection Act: (Release of personal information means the sharing, selling, renting, or transfer of personal information to any third party) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2
  • Family Educational Rights and Privacy Act: (An exception for disclosing personally identifiable information without obtaining parental consent exists for sharing data with third parties conducting legitimate research and studies) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.31(a)(6); 34 C.F.R. Part 99.31(b)(2)
  • Student Online Personal Information Protection Act: (An operator may share student data with third parties for legitimate research purposes if not used for advertising or to amass a profile on a student for purposes other than K–12 school purposes) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(e)(2)
  • Student Online Personal Information Protection Act: (An operator is prohibited from sharing student information to third parties except in limited circumstances to other schools, or for research purposes) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(b)(4)
  • Protection of Pupil Rights Act: (All instructional materials including teacher's manuals, films, tapes, or other supplementary instructional material which is used in connection with any research must be made available for inspection by the parents or guardians of the children) See Protection of Pupil Rights Act (PPRA), 34 C.F.R. §98.3
  • California Privacy of Pupil Records: (A school district may provide, in its discretion, statistical data from which no pupil may be identified to any public agency, entity, private nonprofit college, university, or educational research and development organization when disclosure would be in the best educational interests of pupils) See California Privacy of Pupil Records, Cal. Ed. Code § 49074
• Background
  • If a vendor uses student information acquired through the site or service to develop or improve theor educational products or to demonstrate their effectiveness, aggregate or de-identify the data first. See the guidance on data aggregation and de-identification from the U.S. Department of Education and the National Center for Education Statistics and a white paper on de-identification and student data from the Future of Privacy Forum. See Ready for School, Recommendations for the Ed Tech Industry to Protect the Privacy of Student Data (November 2016), CA. D.O.J., p. 13.
  • A vendor should only disclose covered information for research purposes if required by state or federal law and subject to the restrictions of such laws, or if disclosure for research purposes is allowed by state or federal law and is under the direction of a school, district or state education department. In neither case should covered information be used for advertising or for profiling a student other than for school purposes. See Ready for School, Recommendations for the Ed Tech Industry to Protect the Privacy of Student Data (November 2016), CA. D.O.J., p. 13.

3.16.2: Combination Limits

Do the policies clearly indicate whether or not the vendor imposes contractual limits that prohibit third parties from reidentifying or combining data with other data sources that the vendor shares or sells to them?

• Indicator
  • Discloses contractual obligations are placed on third parties from re-identification of anonymized or de-identified data.
• Citation
  • Children's Online Privacy Protection Act: (An operator must take reasonable steps to release a child's personal information only to service providers and third parties who are capable of maintaining the confidentiality, security, and integrity of the information, and provide assurances that they contractually maintain the information in the same manner) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.8
• Background
  • When data are collected in one context and combined with data from other sources or different contexts, it increases the potential for an individual's privacy to be compromised. Combining data from multiple sources is part of the process of creating a digital profile of a student. Combining data from multiple sources can also be used to re-identify data sets that have been de-identified, or to identify individuals within data sets that have been shared as anonymous aggregated data. A privacy policy that prohibits third-parties from re-identifying anonymous aggregated data provides an additional level of privacy protection for users. See PTC, Data De-identification: An Overview of Basic Terms.
  • The FTC recommends that third-party data brokers take reasonable precautions to ensure that downstream users of their data do not use it for eligibility determinations or for unlawful discriminatory purposes. Of course, the use of race, color, religion, and certain other categories to make credit, insurance, and employment decisions is already against the law, but data brokers should help ensure that the information does not unintentionally go to unscrupulous entities that would be likely to use it for unlawful discriminatory purposes. Similarly, data brokers should conduct due diligence to ensure that data that they intend for marketing or risk mitigation purposes is not used to deny consumers credit, insurance, employment, or the like. See FTC, Data Brokers: A Call For Transparency and Accountability (May 2014), pp. 55-56.
  • A company that transfers data from one company to another should not place emphasis on the disclosures themselves, but on whether a disclosure leads to a use of personal data that is inconsistent within the context of its collection or a consumer's expressed desire to control the data. Thus, if a company transfers personal data to a third party, it remains accountable and thus should hold the recipient accountable—through contracts or other legally enforceable instruments. See Exec. Office of the President, Consumer Data Privacy in a Networked World: A Framework for Protecting Privacy and Promoting Innovation in the Global Digital Economy (2012), p. 22.
  • The FTC's framework application applies to data that, while not yet linked to a particular consumer, computer, or device, may reasonably become so. There is significant evidence demonstrating that technological advances and the ability to combine disparate pieces of data can lead to identification of a consumer, computer, or device even if the individual pieces of data do not constitute PII. See FTC, Protecting Consumer Privacy in an era of rapid change: recommendations for business and policy makers (2012), p. 20.

Data Safety: Promoting responsible use

Evaluating safety takes into consideration best practices that protect a user's physical and emotional health.

9.1.1: Safe Interactions (BASIC)

Do the policies clearly indicate whether or not a user can interact with trusted users?

• Indicator
  • Discloses users can have social interactions with trusted or other known users.
  • Discloses users can have social interactions with students in the same classroom or school.
• Citation
  • Children's Online Privacy Protection Act: (An operator is required to disclose whether the service enables a child to make personal information publicly available) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.4(d)(2)
  • Children's Online Privacy Protection Act: (An operator is prohibited from making personal information from a child publicly available in identifiable form by any means, including a public posting through the Internet, or through a personal home page or screen posted on a Web site or online service, a pen pal service, an electronic mail service, a message board, or a chat room) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2

9.1.2: Unsafe Interactions

Do the policies clearly indicate whether or not a user can interact with untrusted users?

• Indicator
  • Discloses users can have social interactions with unknown users in the product.
  • Discloses users can have social interactions with unknown individuals outside the product across the Internet.
• Citation
  • Children's Online Privacy Protection Act: (An operator is required to disclose whether the service enables a child to make personal information publicly available) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.4(d)(2)
  • Children's Online Privacy Protection Act: (An operator is prohibited from making personal information from a child publicly available in identifiable form by any means, including a public posting through the Internet, or through a personal home page or screen posted on a Web site or online service, a pen pal service, an electronic mail service, a message board, or a chat room) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2

9.1.3: Share Profile

Do the policies clearly indicate whether or not information must be shared or revealed by a user in order to participate in social interactions?

• Indicator
  • Discloses what type of user profile information can be shared for social interactions.
  • Discloses user profile information must be shared to use the product.
• Citation
  • Children's Online Privacy Protection Act: (An operator is required to disclose whether the service enables a child to make personal information publicly available) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.4(d)(2)

9.2.1: Visible Data (BASIC)

Do the policies clearly indicate whether or not a user's personal information can be displayed publicly in any way?

• Indicator
  • Discloses users' personal information can be made publicly visible.
• Citation
  • Children's Online Privacy Protection Act: (An operator is required to disclose whether the service enables a child to make personal information publicly available) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.4(d)(2)
  • Children's Online Privacy Protection Act: (An operator is prohibited from making personal information from a child publicly available in identifiable form by any means, including a public posting through the Internet, or through a personal home page or screen posted on a Web site or online service, a pen pal service, an electronic mail service, a message board, or a chat room) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2

9.2.2: Control Visibility

Do the policies clearly indicate whether or not a user has control over how their personal information is displayed to others?

• Indicator
  • Discloses users can control how their personal information is displayed to others.

9.3.1: Monitor Content

Do the policies clearly indicate whether or not the vendor reviews, screens, or monitors user-created content?

• Indicator
  • Discloses processes to review, screen, or monitor user-created content.

9.3.2: Filter Content (BASIC)

Do the policies clearly indicate whether or not the vendor takes reasonable measures to delete all personal information from a user's postings before they are made publicly visible?

• Indicator
  • Discloses processes to filter and delete users' personal information before it is made publicly visible.
• Citation
  • Children's Online Privacy Protection Act: (An operator may prevent collection of personal information if it takes reasonable measures to delete all or virtually all personal information from a child's postings before they are made public and also to delete the information from its records) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2
• Background
  • Companies may employ staff to review content and/or user activity or they may rely on community flagging mechanisms that allow users to flag other users’ content and/or activity for company review. See Ranking Digital Rights, F3.

9.3.3: Moderating Interactions (BASIC)

Do the policies clearly indicate whether or not social interactions between users of the product are moderated?

• Indicator
  • Discloses social interactions between users are moderated.
• Citation
  • Children's Online Privacy Protection Act: (An operator may prevent collection of personal information if it takes reasonable measures to delete all or virtually all personal information from a child's postings before they are made public and also to delete the information from its records) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2
• Background
  • A vendor should control the information disclosed through the site or service by monitoring for the presence of unauthorized third parties or third parties with unauthorized information collection practices. Take action to remove any unauthorized parties. See Ready for School, Recommendations for the Ed Tech Industry to Protect the Privacy of Student Data (November 2016), CA. D.O.J., p. 14.

9.3.4: Log Interactions

Do the policies clearly indicate whether or not social interactions are logged by the vendor and are available for review or audit?

• Indicator
  • Discloses social interactions between users are logged by the company.

9.4.2: Report Abuse

Do the policies clearly indicate whether or not a user can report abusive behavior, or cyberbullying?

• Indicator
  • Discloses processes for users to report abusive or cyber-bullying conduct.

Ads & Tracking: Prohibiting the exploitation of users' decision making process

Evaluating ads and tracking takes into consideration best practices of not using a user’s personal information for any third-party marketing, behavioral advertising, tracking, or profile generation purposes.

3.2.4: Third-Party Marketing (BASIC)

Do the policies clearly indicate whether or not personal information is shared with third parties for advertising or marketing purposes?

• Indicator
  • Discloses information is shared with third parties for advertising or marketing purposes.
• Citation
  • Children's Online Privacy Protection Act: (Release of personal information means the sharing, selling, renting, or transfer of personal information to any third party) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2
  • Children's Online Privacy Protection Act: (An operator may display contextual advertisements to a child under the age of 13 without verifiable parental consent, under the "internal operations" exception) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2
  • Student Online Personal Information Protection Act: (An operator is prohibited from using student data for targeted, behavioral, or contextual advertising) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(b)(1)(A)
  • California Privacy Rights for Minors in the Digital World: (Prohibits an operator from marketing or advertising non age-appropriate types of products or services to a minor under 18 years of age and from knowingly using, disclosing, compiling, or allowing a third party to use, disclose, or compile, the personal information of a minor for the purpose of marketing or advertising non age-appropriate types of products or services. Also, a minor is permitted to request to "erase" or remove and obtain removal of content or information posted on the operator's site) See California Privacy Rights for Minors in the Digital World, Cal. B.&P. Code §§ 22580-22582
• Background
  • The FTC agrees that the defintion of first-party marketing should include the practice of contacting consumers across different channels. Regardless of the particular means of contact, receipt of a message from a company with which a consumer has interacted directly is likely to be consistent with the consumer's relationship with that company. If an offline or online retailer tracks a customer's activities on a third-party website, this is unlikely to be consistent with the customer's relationship with the retailer; thus, choice should be required. See FTC, Protecting Consumer Privacy in an era of rapid change: recommendations for business and policy makers (2012), p. 42; See also FTC Staff Report, Self-Regulatory Principles For Online Behavioral Advertising, pp. 26-28.

10.2.1: Traditional Ads (BASIC)

Do the policies clearly indicate whether or not traditional advertisements are displayed to a user based on a webpage's content, and not that user's data?

• Indicator
  • Discloses traditional advertisements are displayed to users on the product.
  • Discloses advertisements are displayed to users without using of any collected personal information.
• Citation
  • Children's Online Privacy Protection Act: (An operator may display contextual advertisements to a child under the age of 13 without verifiable parental consent, under the "internal operations" exception) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2

10.3.1: Behavioral Ads (BASIC)

Do the policies clearly indicate whether or not behavioral advertising based on a user's personal information are displayed?

• Indicator
  • Discloses behavorial advertisements are displayed to users on the product.
  • Discloses advertisements are displayed to users based on thier personal or non-personal information.
• Citation
  • Children's Online Privacy Protection Act: (An operator may display contextual advertisements to a child under the age of 13 without verifiable parental consent, under the "internal operations" exception) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2
  • Children's Online Privacy Protection Act: (An operator is prohibited from including behavioral advertisements or amassing a profile of a child under the age of 13 child without parental consent) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2
  • Student Online Personal Information Protection Act: (An operator is prohibited from using student data for targeted, behavioral, or contextual advertising) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(b)(1)(A)
• Background
  • Online behavioral or targeted advertising is the practice of collecting information about consumers' online interests in order to deliver targeted advertising to them. This system of advertising revolves around ad networks that can track individual consumers—or at least their devices—across different websites. When organized according to unique identifiers, this data can provide a potentially wide-ranging view of individual use of the Internet. These individual behavioral profiles allow advertisers to target ads based on inferences about individual interests, as revealed by Internet use. Targeted ads are generally more valuable and efficient than purely contextual ads and provide revenue that supports an array of free online content and services. See Exec. Office of the President, Consumer Data Privacy in a Networked World: A Framework for Protecting Privacy and Promoting Innovation in the Global Digital Economy (2012), pp. 11-12.
  • The FTC recommends that affirmative express consent is appropriate when a company uses sensitive data for any marketing, whether first or third-party. When health or children's information is involved, for example, the likelihood that data misuse could lead to embarrassment, discrimination, or other harms is increased. This risk exists regardless of whether the entity collecting and using the data is a first-party or a third-party that is unknown to the consumer. In light of the heightened privacy risks associated with sensitive data, first parties should provide a consumer choice mechanism at the time of data collection. See FTC, Protecting Consumer Privacy in an era of rapid change: recommendations for business and policy makers (2012), p. 47.
  • The FTC believes affirmative express consent for first-party marketing using sensitive data should be limited. Certainly, where a company's business model is designed to target consumers based on sensitive data – including data about children, financial and health information, Social Security numbers, and certain geolocation data – the company should seek affirmative express consent before collecting the data from those consumers. On the other hand, the risks to consumers may not justify the potential burdens on general audience businesses that incidentally collect and use sensitive information. See FTC, Protecting Consumer Privacy in an era of rapid change: recommendations for business and policy makers (2012), pp. 47-48.
  • If a vendor displays targeted advertising they should not use any information, including covered information and persistent unique identifiers, acquired through the site or service as a basis for targeting advertising to a specific student or other user. This includes both advertising delivered on the site or service that acquired the information and advertising delivered on any other site or service based on that information. See Ready for School, Recommendations for the Ed Tech Industry to Protect the Privacy of Student Data (November 2016), CA. D.O.J., p. 12.

10.4.1: Third-Party Tracking (BASIC)

Do the policies clearly indicate whether or not third-party advertising services or tracking technologies collect any information from a user of the product?

• Indicator
  • Discloses user information is collected by third-party advertising or tracking services on the product.
• Citation
  • Student Online Personal Information Protection Act: (An operator is prohibited from tracking a student across websites with targeted advertising) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(b)(1)(A)
  • Children's Online Privacy Protection Act: (An operator is prohibited from sharing a persistent identifier collected from children that can be used to recognize and track a user over time and across different websites or services without verifiable parental consent) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2
  • California Online Privacy Protection Act: (An operator may provide a hyperlink in their privacy policy to a location containing a description, including the effects, of any program or protocol that offers the consumer a choice not to be tracked) See California Online Privacy Protection Act (CalOPPA), Cal. B.&P. Code §22575(b)(7)

10.4.2: Track Users (BASIC)

Do the policies clearly indicate whether or not a user's information is used to track users and display target advertisements on other third-party websites or services?

• Indicator
  • Discloses user information is used to track and target advertisements on other third-party websites or services across the Internet.
• Citation
  • Children's Online Privacy Protection Act: (An operator is prohibited from sharing a persistent identifier collected from children that can be used to recognize and track a user over time and across different websites or services without verifiable parental consent) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2
  • Student Online Personal Information Protection Act: (An operator is prohibited from tracking a student across websites with targeted advertising) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(b)(1)(A)
  • California Online Privacy Protection Act: (An operator is required to disclose whether other third parties may collect personally identifiable information about a consumer's online activities over time and across different Web sites) See California Online Privacy Protection Act (CalOPPA), Cal. B.&P. Code §22575(b)(6)
  • Family Educational Rights and Privacy Act: ("Personal Information" under FERPA includes direct identifiers such as a student or family member's name, or indirect identifiers such as a date of birth, or mother's maiden name, or other information that is linkable to a specific student that would allow a reasonable person in the school community to identify the student with reasonable certainty) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.3
  • California Privacy Rights for Minors in the Digital World: (Prohibits an operator from marketing or advertising non age-appropriate types of products or services to a minor under 18 years of age and from knowingly using, disclosing, compiling, or allowing a third party to use, disclose, or compile, the personal information of a minor for the purpose of marketing or advertising non age-appropriate types of products or services. Also, a minor is permitted to request to "erase" or remove and obtain removal of content or information posted on the operator's site) See California Privacy Rights for Minors in the Digital World, Cal. B.&P. Code §§ 22580-22582
• Background
  • The FTC recommends that where a company that has a first-party relationship with a consumer for delivery of a specific service, but also tracks the consumer's activities across other parties' websites, such tracking is unlikely to be consistent with the context of the consumer's first-party relationship with the entity. See FTC, Protecting Consumer Privacy in an era of rapid change: recommendations for business and policy makers (2012), p. 41.
  • The FTC agrees that the defintion of first-party marketing should include the practice of contacting consumers across different channels. Regardless of the particular means of contact, receipt of a message from a company with which a consumer has interacted directly is likely to be consistent with the consumer's relationship with that company. If an offline or online retailer tracks a customer's activities on a third-party website, this is unlikely to be consistent with the customer's relationship with the retailer; thus, choice should be required. See FTC, Protecting Consumer Privacy in an era of rapid change: recommendations for business and policy makers (2012), p. 42; See also FTC Staff Report, Self-Regulatory Principles For Online Behavioral Advertising, pp. 26-28.

10.4.3: Data Profile (BASIC)

Do the policies clearly indicate whether or not the vendor allows third parties to use a student's data to create an automated profile, engage in data enhancement, conduct social advertising, or target advertising to students, parents, teachers, or the school?

• Indicator
  • Discloses user information is used to create a third-party advertising profile.
  • Discloses advertisements are targeted to users based on thier personal information or compiled profile.
  • Discloses user information is used for automated decision-making processes.
  • Discloses automated decision-making processes are used to generate user profiles.
• Citation
  • Children's Online Privacy Protection Act: (An operator is prohibited from including behavioral advertisements or amassing a profile of a child under the age of 13 child without parental consent) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2
  • Student Online Personal Information Protection Act: (An operator is prohibited from amassing a profile of a student) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(b)(2)
  • Student Online Personal Information Protection Act: (An operator may share student data with third parties for legitimate research purposes if not used for advertising or to amass a profile on a student for purposes other than K–12 school purposes) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(e)(2)
  • California Privacy Rights for Minors in the Digital World: (Prohibits an operator from marketing or advertising non age-appropriate types of products or services to a minor under 18 years of age and from knowingly using, disclosing, compiling, or allowing a third party to use, disclose, or compile, the personal information of a minor for the purpose of marketing or advertising non age-appropriate types of products or services. Also, a minor is permitted to request to "erase" or remove and obtain removal of content or information posted on the operator's site) See California Privacy Rights for Minors in the Digital World, Cal. B.&P. Code §§ 22580-22582
  • General Data Protection Regulation: (The controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing: ... (f) the existence of automated decision-making, including profiling ... and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.) See General Data Protection Regulation (GDPR), Information to be provided where personal data are collected from the data subject, Art. 13(2)(f)
  • General Data Protection Regulation: (The controller shall provide the data subject with the following information necessary to ensure fair and transparent processing in respect of the data subject: ... (g) the existence of automated decision-making, including profiling ... and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.) See General Data Protection Regulation (GDPR), Information to be provided where personal data have not been obtained from the data subject, Art. 14(2)(g)
  • General Data Protection Regulation: (The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and where that is the case, access to the personal data and the following information: ... (h) the existence of automated decision-making, including profiling ... and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.) See General Data Protection Regulation (GDPR), Right of access by the data subject, Art. 15(1)(h)
  • General Data Protection Regulation: (The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.) See General Data Protection Regulation (GDPR), Automated individual decision-making, including profiling, Art. 22(1)
  • General Data Protection Regulation: (automated processing, including profiling shall be permitted if ... “based on the data subject's explicit consent.”) See General Data Protection Regulation (GDPR), Automated individual decision-making, including profiling, Art. 22(2)(c)
  • General Data Protection Regulation: (the data controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.) See General Data Protection Regulation (GDPR), Automated individual decision-making, including profiling, Art. 22(3)
  • General Data Protection Regulation: (“profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements) See General Data Protection Regulation (GDPR), Definitions, Art. 4(4)
• Background
  • Companies should improve the transparency of their advertising practices by disclosing that they engage in data enhancement and educate consumers about the practice, identifying the third-party sources of the data, and providing a link or other contact information so the consumer can contact the third-party source directly. See FTC, Protecting Consumer Privacy in an era of rapid change: recommendations for business and policy makers (2012), p. 44.
  • The FTC recommends that to further protect consumer privacy, first-parties that obtain marketing data for enhancement should take steps to encourage their third-party data broker sources to increase their own transparency, including by participating in a centralized data broker website, where consumers could learn more information about data brokers and exercise choice. See FTC, Protecting Consumer Privacy in an era of rapid change: recommendations for business and policy makers (2012), p. 44.
  • Companies' privacy policies should be clear that collected data and/or metadata may not be used to create user profiles for the purposes of targeting students or their parents for advertising and marketing, which could violate several privacy laws. See PTAC, Protecting Student Privacy While Using Online Educational Services: Model Terms of Service, p. 4.
  • As students begin to share information with educational institutions or vendors, they expect that they are doing so in order to develop knowledge and skills, not to have their data used to build extensive profiles about their strengths and weaknesses that could be used to their disadvantage in later years. Educational institutions are also in a unique position to help prepare children, adolescents, and adults to grapple with the world of big data. See Exec. Office of the President, Big Data: Seizing Opportunities, Preserving Values (2014), p. 63.
  • A vendor should not use any information, including covered information and persistent unique identifiers, acquired through the site or service to create profiles of students, except profiles that are necessary for the school purposes furthered by the site or service. See Ready for School, Recommendations for the Ed Tech Industry to Protect the Privacy of Student Data (November 2016), CA. D.O.J., p. 13.

10.6.1: Marketing Messages

Do the policies clearly indicate whether or not the vendor may send marketing emails, text messages, or other related communications that may be of interest to a user?

• Indicator
  • Discloses the company may send its own first-party marketing messages to users of the product.
• Citation
  • Children's Online Privacy Protection Act: (An operator may display contextual advertisements to a child under the age of 13 without verifiable parental consent, under the "internal operations" exception) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2
  • Children's Online Privacy Protection Act: (A vendor is prohibited from conditioning a child's participation in a game or prize on the child disclosing more info than necessary to participate in the activity) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.7
  • California Privacy Rights for Minors in the Digital World: (Prohibits an operator from marketing or advertising non age-appropriate types of products or services to a minor under 18 years of age and from knowingly using, disclosing, compiling, or allowing a third party to use, disclose, or compile, the personal information of a minor for the purpose of marketing or advertising non age-appropriate types of products or services. Also, a minor is permitted to request to "erase" or remove and obtain removal of content or information posted on the operator's site) See California Privacy Rights for Minors in the Digital World, Cal. B.&P. Code §§ 22580-22582
  • Student Online Personal Information Protection Act: (An operator is prohibited from using student data for targeted, behavioral, or contextual advertising) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(b)(1)(A)

10.6.2: Third-Party Promotions

Do the policies clearly indicate whether or not the vendor may ask a user to participate in any sweepstakes, contests, surveys, or other similar promotions?

• Indicator
  • Discloses the company may send its own first-party promotional sweepstakes, contests, or surveys to users of the product.
  • Discloses the company may send third-party promotional sweepstakes, contests, or surveys to users of the product.
• Citation
  • Children's Online Privacy Protection Act: (A vendor is prohibited from conditioning a child's participation in a game or prize on the child disclosing more info than necessary to participate in the activity) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.7
  • Children's Online Privacy Protection Act: (A vendor may not request, prompt, entice, or encourage the submission of PII with the use of prizes or games) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.3(d)
  • Student Online Personal Information Protection Act: (An operator is prohibited from using student data for targeted, behavioral, or contextual advertising) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(b)(1)(A)
  • Protection of Pupil Rights Act: (All instructional materials including teacher's manuals, films, tapes, or other supplementary instructional material which is used in connection with any research must be made available for inspection by the parents or guardians of the children) See Protection of Pupil Rights Act (PPRA), 34 C.F.R. §98.3

10.7.1: Unsubscribe Ads

Do the policies clearly indicate whether or not a user can opt out of traditional, contextual, or behavioral advertising?

• Indicator
  • Discloses users can opt-out whether their information is used for advertising purposes.
  • Discloses users can contact third-party advertisers to control whether their information is used for advertising purposes.
• Citation
  • Children's Online Privacy Protection Act: (An operator can not condition a child's participation in the service with sharing any collected information with third parties. A parent is required to have the ability to consent to the collection and use of their child's personal information without also consenting to the disclosure of the information to third parties) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.5(a)(2)
  • California Online Privacy Protection Act: (An operator may provide a hyperlink in their privacy policy to a location containing a description, including the effects, of any program or protocol that offers the consumer a choice not to be tracked) See California Online Privacy Protection Act (CalOPPA), Cal. B.&P. Code §22575(b)(7)
• Background
  • We expect companies to enable users to control the use of their information for the purpose of targeted advertising. Targeted advertising requires extensive collection and retention of user information that is tantamount to tracking. Companies should therefore clearly disclose whether users have options to control how their information is being used for these purposes. See Ranking Digital Rights, P7.

10.7.2: Unsubscribe Marketing

Do the policies clearly indicate whether or not a user can opt out or unsubscribe from a vendor or third party marketing communication?

• Indicator
  • Discloses users can unsubscribe from the company sending them marketing messages.
  • Discloses users can unsubscribe or control whether a third-party sends them marketing messages.
• Citation
  • Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003: (The sender of a commerical electronic communication may not require that any recipient pay any fee, provide any information other than the recipient's electronic mail address and opt-out preferences, or take any other steps except sending a reply electronic mail message or visiting a single Internet Web page, in order to submit a request not to receive future commercial electronic mail messages from the sender) See Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (CAN-SPAM), 16 C.F.R. Part 316.5
  • General Data Protection Regulation: (Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.) See General Data Protection Regulation (GDPR), Automated individual decision-making, including profiling, Art. 21(2)
  • General Data Protection Regulation: (Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.) See General Data Protection Regulation (GDPR), Automated individual decision-making, including profiling, Art. 21(3)

Parental Consent: Protecting children’s personal information

Evaluating parental consent takes into consideration best practices of protecting children under 13 years of age by requiring a parent’s or guardian's verifiable consent before the collection, use, or disclosure of a child's personal information to an application or service.

1.8.1: Children Intended (BASIC)

Do the policies clearly indicate whether or not the product is intended to be used by children under the age of 13?

• Indicator
  • Discloses the product is intended to be used by children under the age of 13.
• Citation
  • Children's Online Privacy Protection Act: (A site directed to children is where the operator has actual knowledge the site is collecting information from children under the age of 13 and parental consent is required before any collection or use of information) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2
  • General Data Protection Regulation: (In relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child. Member States may provide by law for a lower age for those purposes provided that such lower age is not below 13 years.) See General Data Protection Regulation (GDPR), Conditions Applicable to Child's Consent in Relation to Information Society Services, Art. 8(1)

2.2.2: Child Data

Do the policies clearly indicate whether or not the vendor collects personal information online from children under 13 years of age?

• Indicator
  • Discloses personal information from children under 13 years of age is collected.
• Citation
  • Children's Online Privacy Protection Act: (A notice or privacy policy on an operator's website needs a section relating to the collection of information for children under 13 years of age, and notice is required at each area of the site where information is collected from children) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.4(d)
  • Children's Online Privacy Protection Act: (Personally Identifiable Information under COPPA includes first and last name, photos, videos, audio, geolocation information, persistent identifiers, IP address, cookies, and unique device identifiers) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2
• Background
  • The Children's Online Privacy Protection Act (COPPA) requires a privacy policy to list the kinds of personal information collected from children (for example, name, address, email address, hobbies, etc.), how the information is collected, and how the company uses the personal information. It also requires companies to indicate whether they disclose information collected from children to third-parties. If so, the company must also disclose the kinds of businesses in which the third-parties are engaged, the general purposes for which the information is used, and whether the third-parties have agreed to maintain the confidentiality and security of the information. See 15 U.S.C. § 6502; 16 C.F.R. Part 312.
  • If a company knows that a user of the online website or service is under the age of 13, the Children's Online Privacy Protection Act (COPPA) will impose more stringent requirements on the collection of information from those users. COPPA requires that operators seeking to collect, use, or disclose personal information from children under the age of 13, must first obtain verifiable parental consent. Even where a user is 13 or older, COPPA remains a source of best practices for companies that collect personal information from users, particularly when those users are still minors. See 15 U.S.C. §§ 6501-6506;16 C.F.R. Part 312.
  • COPPA permits the collection of limited personal information from children under 13 for the purposes of: (1) Obtaining verified parental consent; (2) providing parents with a right to opt-out of an operator's use of a child's email address for multiple contacts of the child; and (3) to protect a child's safety on a website or online service. See 15 U.S.C. 6502(b)(2); 16 C.F.R. 312.5(c)(1)–(5).

1.8.4: Parents Intended

Do the policies clearly indicate whether or not the product is intended to be used by parents or guardians?

• Indicator
  • Discloses the product is intended to be used by parents or guardians.
• Citation
  • Children's Online Privacy Protection Act: (An operator must make reasonable efforts to obtain verifiable parental consent, taking into consideration available technology and existing methods available to a parent to prove their identity) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.5(b)(i)-(iv); See also 15 U.S.C. §6501(9)

11.1.1: Actual Knowledge

Do the policies clearly indicate whether or not the vendor has actual knowledge that personal information from children under 13 years of age is collected by the product?

• Indicator
  • Discloses the company has actual knowledge users of the product are under the age of 13.
  • Discloses a user's age or birthday is collected upon account registration.
  • Discloses the product utilizes an age-gate or other mechanism to verify the age of a user.
  • Discloses the product is directed or would appeal to children under 13 years of age.
  • Discloses the product provides features intended for children under 13 years of age.
• Citation
  • Children's Online Privacy Protection Act: (A general audience site is where the operator has no actual knowledge that a child under the age of 13 has registered an account or is using the service, and no age gate or parental consent is required before collection of information) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2
  • Children's Online Privacy Protection Act: (A mixed audience site is where the site is directed to children, but does not target children as its "primary audience," but rather teens 13-to-18 years of age or adults. An operator of a mixed audience site is required to obtain age information from a user before collecting any information and if a user identifies themselves as a child under the age of 13, the operator must obtain parental consent before any information is collected) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2
  • Children's Online Privacy Protection Act: (A site directed to children is where the operator has actual knowledge the site is collecting information from children under the age of 13 and parental consent is required before any collection or use of information) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2
  • Children's Online Privacy Protection Act: (A vendor who may obtain actual knowledge that it is collecting information from a child must not encourage a child from disclosing more information than reasonably necessary through an age verification mechanism. An age gate should be: age-neutral; not encourage falsification; list day, month, and year; have no prior warning that under 13 children will be blocked; and prevent multiple attempts) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.3(d)
• Background
  • The Children's Online Privacy Protection Act (COPPA) requires an operator to post a link to a notice of its information practices on the homepage of its web site or online service and in each area of its web site where it collects "Personal Information" from children. An operator of a general audience web site with a separate children's area must also post a link to its privacy policy on the homepage of the children's area. See 15 U.S.C. §§ 6501-6506; 16 C.F.R. Part 312
  • COPPA applies anytime an operator of a website or online service has actual knowledge that it is collects, maintains, uses, or discloses personal information from a child under 13. In these situations an operator is generally required to obtain verified parental consent.
  • COPPA requires companies to establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from children. Companies should minimize what they collect in the first place and take reasonable steps to release personal information only to service providers and third-parties capable of maintaining its confidentiality, security, and integrity. Always obtain assurances that third-parties will live up to their contractual privacy responsibilities. Also, companies should hold on to personal information only as long as is reasonably necessary for the purpose for which it was collected. They should securely dispose of it once they no longer have a legitimate reason for retaining it. See FTC, Six-Step Compliance Plan for Your Business.

11.1.2: COPPA Notice

Do the policies clearly indicate whether or not the vendor describes: (1) what information is collected from children under 13 years of age, (2) how that information is used, and (3) its disclosure practices for that information?

• Indicator
  • Discloses COPPA or children's privacy is applicable to the product.
  • Discloses how the company collects, uses, and discloses information from children under 13 years of age.
• Citation
  • Children's Online Privacy Protection Act: (A vendor is required to provide a clear privacy policy about: (1) what information is collected, (2) how information is used, and (3) its disclosure practices of that information) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.3(a); See also 16 C.F.R. Part 312.4(d)(2)
  • Children's Online Privacy Protection Act: (A notice or privacy policy on an operator's website needs a section relating to the collection of information for children under 13 years of age, and notice is required at each area of the site where information is collected from children) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.4(d)

11.3.1: Parental Consent (BASIC)

Do the policies clearly indicate whether or not the vendor or third party obtains verifiable parental consent before they collect or disclose personal information?

• Indicator
  • Discloses verifiable parental consent is obtained before the collection or use of personal information from children under 13 years of age.
• Citation
  • Children's Online Privacy Protection Act: (An operator is required to obtain verifiable parental consent before any collection, use, or disclosure of personal information from children) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.5
  • Children's Online Privacy Protection Act: (An operator must make reasonable efforts to obtain verifiable parental consent, taking into consideration available technology and existing methods available to a parent to prove their identity) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.5(b)(i)-(iv); See also 15 U.S.C. §6501(9)
  • Family Educational Rights and Privacy Act: (A school is prohibited from disclosing a student's "education record" or data to third parties without parental consent) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.30
  • Family Educational Rights and Privacy Act: (A parent or eligible student is required to provide a signed and dated written consent before an educational institution discloses personally identifiable information from the student's records) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.30
  • California AB 1584 - Privacy of Pupil Records: (A local educational agency that enters into a contract with a third party must ensure the contract contains a prohibition against the third party using personally identifiable information in pupil records to engage in targeted advertising) See California AB 1584 - Privacy of Pupil Records, Cal. Ed. Code § 49073.1(b)(9)
  • General Data Protection Regulation: (In relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child. Member States may provide by law for a lower age for those purposes provided that such lower age is not below 13 years.) See General Data Protection Regulation (GDPR), Conditions Applicable to Child's Consent in Relation to Information Society Services, Art. 8(1)

11.3.2: Limit Consent

Do the policies clearly indicate whether or not a parent can consent to the collection and use of their child's personal information without also consenting to the disclosure of the information to third parties?

• Indicator
  • Discloses parental consent can be limited with respect to use with third parties.
  • Discloses parental consent can be given for the collection and use of information with the company seperate from use with third parties.
• Citation
  • Children's Online Privacy Protection Act: (An operator can not condition a child's participation in the service with sharing any collected information with third parties. A parent is required to have the ability to consent to the collection and use of their child's personal information without also consenting to the disclosure of the information to third parties) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.5(a)(2)

11.3.3: Withdraw Consent

Do the policies clearly indicate whether or not the vendor responds to a request from a parent or guardian to prevent further collection of their child's information?

• Indicator
  • Discloses the company will prevent further collection and use of a child's personal information if requested from a parent or guardian.
• Citation
  • Children's Online Privacy Protection Act: (An operator is required to provide a parent or guardian access to review, modify, or delete their children's information or prevent further collection of information) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.3(c); See also 16 C.F.R. Part 312.4(d)(3); 16 C.F.R. Part 312.6)
  • General Data Protection Regulation: (The controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing: ... (c) the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal) See General Data Protection Regulation (GDPR), Information to be provided where personal data are collected from the data subject, Art. 13(2)(c)
  • General Data Protection Regulation: (The controller shall provide the data subject with the following information necessary to ensure fair and transparent processing in respect of the data subject: (d) the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal) See General Data Protection Regulation (GDPR), Information to be provided where personal data have not been obtained from the data subject, Art. 14(2)(d)

11.3.4: Delete Child-PII

Do the policies clearly indicate whether or not the vendor deletes personal information from a student or child under 13 years of age if collected without parental consent?

• Indicator
  • Discloses the company will delete personal information from a student or child under 13 years of age if collected without parental consent.
• Citation
  • Children's Online Privacy Protection Act: (If the operator has not obtained parental consent after a reasonable time from the date of the information collection, or been given actual notice that information from a child under the age of 13 has been collected without parental consent, the operator must delete the information from its records) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.5(c)(1); See also 16 C.F.R. Part 312.6(c)
  • Family Educational Rights and Privacy Act: (A parent or eligible student is required to provide a signed and dated written consent before an educational institution discloses personally identifiable information from the student's records) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.30

11.3.5: Consent Method (BASIC)

Do the policies clearly indicate whether or not the vendor provides notice to parents or guardians of the methods to provide verifiable parental consent under COPPA?

• Indicator
  • Discloses the parental consent method(s) that are available for submission of consent by a parent or guardian.
• Citation
  • Children's Online Privacy Protection Act: (An operator is required to provide direct notice to parents describing what information is collected, how information is used, its disclosure practices and exceptions) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.4(b)
  • Children's Online Privacy Protection Act: (Existing methods to obtain verifiable parental consent include: (i) Providing a consent form to be signed by the parent and returned to the operator by postal mail, facsimile, or electronic scan; (ii) Requiring a parent, in connection with a monetary transaction, to use a credit card, debit card, or other online payment system that provides notification of each discrete transaction to the primary account holder; (iii) Having a parent call a toll-free telephone number staffed by trained personnel; (iv) Having a parent connect to trained personnel via video-conference; (v) Verifying a parent's identity by checking a form of government-issued identification against databases of such information, where the parent's identification is deleted by the operator from its records promptly after such verification is complete) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.5(b)(i)-(v)
  • Children's Online Privacy Protection Act: (If an operator does not “disclose” children's personal information, they may use an email coupled with additional steps to provide assurances that the person providing the consent is the parent. Such additional steps include: Sending a confirmatory email to the parent following receipt of consent, or obtaining a postal address or telephone number from the parent and confirming the parent's consent by letter or telephone call. An operator that uses this method must provide notice that the parent can revoke any consent given in response to the earlier email.) See Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.5(b)(vi)
• Background
  • Under most circumstances an operator is required to obtain verified parental consent before the collection, use, or disclosure, of personal information from children under the age of 13. The method used to obtain parental consent must be reasonably calculated (taking into account available technology) to ensure that the person providing consent is actually the child's parent.

School Purpose: Following student data privacy laws

Evaluating school purpose takes into consideration best practices of companies that collect personal information from students or teachers in K-12 and the legal obligations for the privacy and security of that information.

1.8.5: Students Intended (BASIC)

Do the policies clearly indicate whether or not the product is intended to be used by students in preschool or K-12?

• Indicator
  • Discloses the product is intended to be used by students in preschool or K-12.
• Citation
  • Student Online Personal Information Protection Act: (SOPIPA applies to operators of online services that are primarily used for K-12 school purposes and were designed and marketed for K-12 school purposes) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(a)
  • Early Learning Personal Information Protection Act: (ELPIPA applies to operators of online services that are primarily used for preschool or prekindergarten purposes and were designed and marketed for preschool or prekindergarten purposes) See Early Learning Personal Information Protection Act (ELPIPA), Cal. B.&P. Code § 22586(a)(1)
  • Student Online Personal Information Protection Act: (SOPIPA does not apply to general audience websites and services that are not primarily used by K-12 students) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(m)
  • Family Educational Rights and Privacy Act: ("Personal Information" under FERPA includes direct identifiers such as a student or family member's name, or indirect identifiers such as a date of birth, or mother's maiden name, or other information that is linkable to a specific student that would allow a reasonable person in the school community to identify the student with reasonable certainty) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.3
  • California Privacy of Pupil Records: (Prohibits schools, school districts, county offices of education, and charter schools from collecting or maintaining information about pupils from social media for any purpose other than school or pupil safety, without notifying each parent or guardian and providing the pupil with access and an opportunity to correct or delete such information) See California Privacy of Pupil Records, Cal. Ed. Code § 49073.6(c)

2.2.1: Student Data

Do the policies clearly indicate whether or not the vendor collects personal information or education records from preK-12 students?

• Indicator
  • Discloses education records from preK-12 students is collected.
• Citation
  • Family Educational Rights and Privacy Act: ("Education Records" are information that is directly related to a student and maintained by the educational institution, or by a third party acting as a School Official on behalf of the educational institution) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.3
  • Family Educational Rights and Privacy Act: ("Personal Information" under FERPA includes direct identifiers such as a student or family member's name, or indirect identifiers such as a date of birth, or mother's maiden name, or other information that is linkable to a specific student that would allow a reasonable person in the school community to identify the student with reasonable certainty) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.3
  • Student Online Personal Information Protection Act: (SOPIPA applies to operators of online services that are primarily used for K-12 school purposes and were designed and marketed for K-12 school purposes) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(a)
  • Early Learning Personal Information Protection Act: (ELPIPA applies to operators of online services that are primarily used for preschool or prekindergarten purposes and were designed and marketed for preschool or prekindergarten purposes) See Early Learning Personal Information Protection Act (ELPIPA), Cal. B.&P. Code § 22586(a)(1)
• Background
  • The Family Educational Rights and Privacy Act of 1974 (FERPA), provides parents of students the right to access their children's Student Data or education records, and Students 18 years of age and older the right to access their own education records. In addition, FERPA provides the right to have the records amended, and the right to have some control over the disclosure of personally identifiable information (PII) in the education records. Furthermore, strict storage guidelines surround Student Data which require organizations to maintain accurate, and up-to-date records. See 20 U.S.C. § 1232g; 34 C.F.R. Part 99.1.
  • What are Education Records? FERPA defines educational records as records that are: (1) directly related to a student; and (2) maintained by an educational agency or institution or by a party acting for the agency or institution. These records include, but are not limited to, transcripts, class lists, student course schedules, health records, student financial information, and student disciplinary records. It is important to note that any of these records maintained by a third-party acting on behalf of a school or district are also considered education records. 20 U.S.C. § 1232g (a)(4)(A); 34 CFR § 99.3; See PTAC, Responsibilities of Third-Party Service Providers under FERPA, p. 1; See also PTAC, Protecting Student Privacy While Using Online Educational Services: Requirements and Best Practices, p. 2.

1.8.6: Teachers Intended

Do the policies clearly indicate whether or not the product is intended to be used by teachers?

• Indicator
  • Discloses the product is intended to be used by teachers.
• Citation
  • Family Educational Rights and Privacy Act: (FERPA applies to all educational institutions that accept public funds under a program of the U.S. Department of Education) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.1
  • Student Online Personal Information Protection Act: (SOPIPA applies to operators of online services that are primarily used for K-12 school purposes and were designed and marketed for K-12 school purposes) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(a)
  • Early Learning Personal Information Protection Act: (ELPIPA applies to operators of online services that are primarily used for preschool or prekindergarten purposes and were designed and marketed for preschool or prekindergarten purposes) See Early Learning Personal Information Protection Act (ELPIPA), Cal. B.&P. Code § 22586(a)(1)
  • Protection of Pupil Rights Act: (All instructional materials including teacher's manuals, films, tapes, or other supplementary instructional material which is used in connection with any research must be made available for inspection by the parents or guardians of the children) See Protection of Pupil Rights Act (PPRA), 34 C.F.R. §98.3
  • California AB 1584 - Privacy of Pupil Records: (Authorizes a Local Educational Agency (LEA) to enter into a third party contract for the collection and use of pupil records that must include a statement that the pupil records continue to be the property of and under the control of the local educational agency, a description of the actions the third party will take to ensure the security and confidentiality of pupil records, and a description of how the local educational agency and the third party will jointly ensure compliance with FERPA) See California AB 1584 - Privacy of Pupil Records, Cal. Ed. Code §§ 49073.1

11.2.1: School Purpose (BASIC)

Do the policies clearly indicate whether or not the product is primarily used, designed, and marketed for preschool or K-12 school purposes?

• Indicator
  • Discloses the product is primarily used, designed, and marketed for preschool or K-12.
• Citation
  • Student Online Personal Information Protection Act: (SOPIPA applies to operators of online services that are primarily used for K-12 school purposes and were designed and marketed for K-12 school purposes) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(a)
  • Student Online Personal Information Protection Act: (SOPIPA does not apply to general audience websites and services that are not primarily used by K-12 students) See Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code § 22584(m)
  • Early Learning Personal Information Protection Act: (ELPIPA applies to operators of online services that are primarily used for preschool or prekindergarten purposes and were designed and marketed for preschool or prekindergarten purposes) See Early Learning Personal Information Protection Act (ELPIPA), Cal. B.&P. Code § 22586(a)(1)

11.2.2: Education Records

Do the policies clearly indicate the process by which education records are entered into the product? For example, are data entered by district staff, school employees, parents, teachers, students, or some other person?

• Indicator
  • Discloses processes by which student education records are entered into the product.
• Citation
  • Family Educational Rights and Privacy Act: (FERPA applies to all educational institutions that accept public funds under a program of the U.S. Department of Education) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.1
  • Family Educational Rights and Privacy Act: ("Education Records" are information that is directly related to a student and maintained by the educational institution, or by a third party acting as a School Official on behalf of the educational institution) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.3
• Background
  • A vendor should describe their data collection methods that include how they collect the various data types, such as through a student's use of the technology, from content provided by a student, or from content provided by a district, school, teacher, or other educator. See Ready for School, Recommendations for the Ed Tech Industry to Protect the Privacy of Student Data (November 2016), CA. D.O.J., p. 12.

11.2.3: School Contract

Do the policies clearly indicate whether or not the vendor provides a contract to a Local Educational Agency (LEA) or otherwise provides notice to users of additional rights?

• Indicator
  • Discloses a separate agreement or contract is provided to schools or districts of their rights.
  • Discloses notification is provided to schools or districts of their rights.
• Citation
  • Family Educational Rights and Privacy Act: (An educational institution must annually notify parents of their rights to inspect and review a student's education records, make corrections, delete, or consent to the disclosure of information) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.7(a)
  • Family Educational Rights and Privacy Act: (Any rights to access, modify, or delete student records may transfer to an "eligible" student who is over 18 years of age) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.5(a)(1)
  • General Data Protection Regulation: (The controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing: ... (e) whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data) See General Data Protection Regulation (GDPR), Information to be provided where personal data are collected from the data subject, Art. 13(2)(e)
  • California AB 1584 - Privacy of Pupil Records: (Authorizes a Local Educational Agency (LEA) to enter into a third party contract for the collection and use of pupil records that must include a statement that the pupil records continue to be the property of and under the control of the local educational agency, a description of the actions the third party will take to ensure the security and confidentiality of pupil records, and a description of how the local educational agency and the third party will jointly ensure compliance with FERPA) See California AB 1584 - Privacy of Pupil Records, Cal. Ed. Code §§ 49073.1
• Background
  • FERPA is a Federal law that protects personally identifiable information in students' education records from unauthorized disclosure. It affords parents the right to access their child's education records, the right to seek to have the records amended, and the right to have some control over the disclosure of personally identifiable information from the education records. When a student turns 18 or enters a postsecondary institution at any age, the rights under FERPA transfer from the parents to the student ("eligible student"). 20 U.S.C. § 1232g; 34 C.F.R. Part 99; See also PTAC, Responsibilities of Third-Party Service Providers under FERPA, pp. 1-3.
  • FERPA denies federal funding to educational agencies or institutions that have a practice or policy of permitting the release of student information without parental consent. There is an exception where such information is released to "school officials" who have been determined by the educational agency or institution to have a legitimate educational interest.
  • A vendor should describe the procedures for a parent, legal guardian, or eligible student to review and correct covered information. See Ready for School, Recommendations for the Ed Tech Industry to Protect the Privacy of Student Data (November 2016), CA. D.O.J., p. 14.

11.2.4: School Official

Do the policies clearly indicate whether or not the vendor is under the direct control of the educational institution and designates themselves a 'School Official' under FERPA?

• Indicator
  • Discloses the company is under the direct control of the educational institution and designated a school official.
• Citation
  • Family Educational Rights and Privacy Act: (An exception for disclosing personally identifiable information without obtaining parental consent exists for sharing data with a third party who is considered a "school official" with a legitimate educational interest, and under direct control of the school for the use and maintenance of education records) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.31(a)(1)(i)(B)
  • Family Educational Rights and Privacy Act: (An exception for disclosing personally identifiable information without obtaining parental consent exists for sharing with other school officials, including teachers within the same educational institution) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.31(a)(1)(i)(A)
  • Family Educational Rights and Privacy Act: (An educational institution must use reasonable methods to ensure that school officials only use information for which they have a legitimate educational interest) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.31(a)(1)(ii)
  • California AB 1584 - Privacy of Pupil Records: (A local educational agency that enters into a contract with a third party must ensure the contract contains a description of how the local educational agency and the third party will jointly ensure compliance with the federal Family Educational Rights and Privacy Act (FERPA)) See California AB 1584 - Privacy of Pupil Records, Cal. Ed. Code § 49073.1(b)(8)
• Background
  • What is the "School Official" Exception? In some cases, providers need PII from a students's education records in order to deliver the agreed-upon services. FERPA's school official exception to consent is most likely to apply to the schools' and districts' relationships with service providers. When schools and districts outsource institutional services or functions, FERPA permits the disclosure of PII from education records to contractors, consultants, volunteers, or other third-parties provided that the outside party meets specified requirements. See 34 C.F.R. § 99.31(a)(1)(i); See also PTAC, Responsibilities of Third-Party Service Providers under FERPA, P. 2; See also PTAC, Protecting Student Privacy While Using Online Educational Services: Requirements and Best Practices, p. 3-5.
  • Any PII from students' education records that the provider receives under FERPA's school official exception may only be used for the specific purpose for which it was disclosed (i.e., to perform the outsourced institutional service or function, and the school or district must have direct control over the use and maintenance of the PII by the provider receiving the PII). Further, under FERPA's school official exception, the provider may not share or sell FERPA-protected information, or re-use it for any other purposes, except as directed by the school or district and as permitted by FERPA. See PTAC, Protecting Student Privacy While Using Online Educational Services: Requirements and Best Practices, p. 5.

11.3.10: School Consent

Do the policies clearly indicate whether or not responsibility or liability for obtaining verified parental consent is transferred to the school or district?

• Indicator
  • Discloses the obligation to obtain verifiable parental consent from a parent of guardian are transferred to the school or district.
  • Discloses the school or district are required to provide verifiable parental consent records to the company upon request.
• Background
  • Where a school has contracted with an operator to collect personal information from students for the use and benefit of the school, and for no other commercial purpose, the operator is not required to obtain consent directly from parents, and can presume that the school’s authorization for the collection of students’ personal information is based upon the school having obtained the parents’ consent . . . As a best practice, the school should consider providing parents with a notice of the websites and online services whose collection it has consented to on behalf of the parent. Schools can identify, for example, sites and services that have been approved for use district-wide or for the particular school. See FTC, Complying with COPPA: Frequently Asked Questions, M. COPPA AND SCHOOLS, 2-4..

11.3.8: FERPA Exception

Do the policies clearly indicate whether or not the vendor may disclose personal information without verifiable parental consent under a FERPA exception?

• Indicator
  • Discloses personal information from students may be disclosed without parental consent.
  • Discloses which type of third parties may receive personal information from students under a FERPA exception.
• Citation
  • Family Educational Rights and Privacy Act: (An exception for disclosing personally identifiable information without obtaining parental consent exists for sharing with other school officials, including teachers within the same educational institution) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.31(a)(1)(i)(A)
  • Family Educational Rights and Privacy Act: (An exception for disclosing personally identifiable information without obtaining parental consent exists for sharing data with a third party who is considered a "school official" with a legitimate educational interest, and under direct control of the school for the use and maintenance of education records) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.31(a)(1)(i)(B)
  • Family Educational Rights and Privacy Act: (An exception for disclosing personally identifiable information without obtaining parental consent exists for sharing data with a Federal or State agency for legal or compliance reasons) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.31(a)(3)
  • Family Educational Rights and Privacy Act: (An exception for disclosing personally identifiable information without obtaining parental consent exists for sharing data with third parties conducting legitimate research and studies) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.31(a)(6); 34 C.F.R. Part 99.31(b)(2)
  • Family Educational Rights and Privacy Act: (An exception for disclosing personally identifiable information without obtaining parental consent exists for sharing "de-identified" student records where the educational institution has made a reasonable determination that a student's identity is not personally identifiable) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.31(b)(1)

11.3.9: Directory Information

Do the policies clearly indicate whether or not the vendor discloses student information as 'Directory Information' under a FERPA exception?

• Indicator
  • Discloses student information can be shared without parental consent as Directory Information.
  • Discloses what type of student information can be shared as Directory Information under a FERPA exception.
• Citation
  • Family Educational Rights and Privacy Act: (An operator may disclose a student's "Directory Information" if the operator provides notice to parents of the type of information that is designated as "directory," and gives notice of a parent's right to refuse disclosure and to opt-out) See Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. Part 99.3; 34 C.F.R. Part 99.37
• Background
  • What is the "Directory Information" Exception? An exception to parental consent that permits the disclosure of PII from education records under FERPA. Information designated by the school or district as directory information may be disclosed without consent and used without restriction in conformity with the policy, unless the parent, guardian, or eligible student opts out. Examples of directory information about students include name, address, telephone number, email address, date and place of birth, grade level, sports participation, and honors or awards received. Before a school or district can disclose directory information, it must first provide public notice to parents and eligible students of the types of information designated as directory information, the intended uses for the information, and the right of parents or eligible students to "opt out" of having their information shared. See PTAC, Responsibilities of Third-Party Service Providers under FERPA, p. 3; See also PTAC, Protecting Student Privacy While Using Online Educational Services: Requirements and Best Practices, pp. 3-4.