Welcome to the latest edition of FPF’s Youth & Education Privacy newsletter. I’m Alexa Urbanic, policy counsel on the Youth & Education team at FPF. Recently, my work has focused on verifiable parental consent and age verification.

Next, you’ll be hearing from Chloe Altieri! There is a lot happening in student and children’s privacy, and by rotating FPF experts, we will spotlight different perspectives on important issues in these areas.

Among other recent developments in child and student privacy, this newsletter highlights:

  • A laundry list of federal and state legislative updates 

  • News you can use - kids, technology and privacy edition 

  • Instagram experiments with new age-verification methods 

  • School safety and surveillance discussions return following the tragic shooting in Uvalde, Texas

  • A rise in teacher doxxing 

  • An eye-opening look at the high costs of cybersecurity incidents

As we continue to refine the content and format of this newsletter, we want to hear from you - what’s on your mind, and how can we help? Reach out to us anytime by replying to this email.

A Legislative Laundry List

It has been a busy few months for privacy legislation at both the state and federal levels. By now, you are likely familiar with H.R. 8152, The American Data Privacy and Protection Act (ADPPA), also known as “the biggest breakthrough for efforts to pass a federal law in years.” Most recently, the amended bill advanced out of the House Energy & Commerce Committee with overwhelming support. The bill would apply to many organizations and individuals; it includes specific provisions regarding children and teens, but excludes public institutions, including public K12 and postsecondary schools. 

FPF has long supported the passage of a practical, protective, and comprehensive federal consumer privacy law, which would provide businesses and consumers alike with the benefit of clear national standards and protections. FPF Senior Policy Counsel Bertram Lee testified during the first hearing about the bill; read more from Bertram in this op-ed. Many experts agree that the ADPPA text will require further revision to ensure requirements are clear and practical, but the bill remains the most likely vehicle for a comprehensive federal privacy law.

The Senate Commerce Committee recently advanced  - with significant amendments -  two bipartisan child privacy-specific bills, the Children and Teens’ Online Privacy Protection Act (COPPA 2.0) and the Kids Online Safety Act (KOSA). While the Committee’s approval represents a “major milestone” for child privacy advocates, the focus on kids’ privacy  - versus the House’s interest in a broader consumer privacy bill - means that a “fight is brewing.” 

At the state level, the California Senate Judiciary Committee amended and advanced the California Age-Appropriate Design Code Act, a bill modeled after the United Kingdom’s Age Appropriate Design Code (AADC) that aims to regulate the collection, processing, storage, and transfer of children’s data. My colleagues Chloe Altieri and Kewa Jiang analyze the bill in this blog post, and WIRED details how it and a number of other legislative proposals aim to mitigate the impact of social media on young people’s mental health. We expect additional developments soon - California lawmakers have mere weeks to move the bill forward before the end of this legislative session.

One example of why strong default privacy protections for kids are important: a new report by FairPlay, Global Platforms, Partial Protections, found “significant” differences between the default privacy settings in place for kids in different countries on “seemingly identical platforms.”

News You Can Use: Kids, Technology, and Privacy Edition

The Washington Post dove into a new study about the data practices of some of the most popular apps among kids. The conclusion? “Apps are spying on our kids at a scale that should shock you.” The report, authored by Pixalate, identifies the 1,000 most popular mobile apps that appear to be child-directed, and attempts to analyze how those apps handle sensitive data. The study alleges, among other things, that more than two-thirds of the apps shared location data with advertisers. Another big takeaway from the report: Pixalate has developed a methodology that attempts to infer when an app is child-directed, raising questions about the extent to which leading apps are, in fact, not directed to children. 

A few other updates that may be of particular interest to parents: Following the release of a Human Rights Watch report earlier this year on the alleged data collection practices of remote learning apps, The Washington Post breaks down how to evaluate the privacy practices and policies of these types of apps for yourself. And the Electronic Frontier Foundation is raising alarm about “dangerously insecure” daycare apps.

Last but not least: if you are concerned about the time your children are spending online, you are not alone, two new surveys show. PC Mag’s latest Tech Parenting survey found that 66% of parents are either somewhat or very concerned about the effects of technology on their child; a survey by Trusted Future found that more than 75% of parents were concerned about protecting their family’s digital privacy.

The Latest on the Parental Rights Movement

Gender transitions at school have become “the high-wire act of gender-inclusive practices,” as controversy grows over when - if at all - a parent should be notified. The school district in Manchester, New Hampshire recently argued in court it had no responsibility to inform parents about a child’s gender expression at school; a similar 2021 lawsuit filed in  Florida helped spur adoption of what opponents call the state’s “Don’t Say Gay” bill. A related bill that restricts what schools and workplaces can teach about race and identity also went into effect July 1 in Florida and quickly raised concerns about self-censorship at one Florida university

Nationally, LGBTQ students have been under attack,” as 10 new anti-LGBTQ+ laws went into effect on July 1, all targeting schools. Even the debate around these laws is harmful to students; Trevor Project polling found that 85% of trans and nonbinary youth said that the debate over laws targeting trans people negatively impacted their mental health. 

Anti-LGBTQ+ laws also “put LGBTQ-affirming educators on the defensive,” potentially forcing them to choose between their jobs and outing a child to their parents. This additional pressure has also led to a rise in online harassment of educators. While the Colorado legislature passed a bill earlier this year to protect teachers, some claim that a single social media account known as Libs of TikTok is “shaping public policy in a real way, and affecting teachers’ ability to feel safe in their classrooms.”
Addressing School Discipline Disparities

The Biden Administration announced new school discipline policies - praised as a “small step in the right direction” - to protect students with disabilities from overpunishent. Disparities are particularly persistent among students of color with disabilities. Black children with disabilities accounted for 17.2% of all students with disabilities, but 43% of the students with disabilities who were suspended or expelled from school for more than 10 days during the 2019-2020 school year, according to U.S. News & World Report.

As educators attempt to reduce disparities and promote equity, unprecedented, rapid changes in the way states collect, report, and share education data internally” have focused in part on better understanding the experiences of special education students and students of color. Data from the Education Commission on the States via reporting by Chalkbeat notes that special education status and race/ethnicity were two of the most cited additional data fields collected by states during the pandemic; if used responsibly, schools and districts hope to be able to better serve all students.
Age Verification Experimentation

You may have caught the news in our last update - or experienced for yourself - that Instagram recently required all users to enter their birthdate in order to verify their age. The platform has since taken things a step further, announcing it is testing three new age-verification methods for a targeted population of users: those who try to change their age from under 18 to older than 18. While some are worried the new system is “confusing” and “incomplete,” a user attempting to raise their age will now be asked to either upload an ID, record a video selfie that AI software will scan, or ask three mutual friends to vouch for their age. 

The post introducing the new options notes  Instagram’s preference for age verification to occur at the device or app-store level, “allowing teens to be placed in age-appropriate experiences across all the apps they use.” 

Learn more about COPPA’s age-verification requirement from this FPF resource, and stay tuned for more from FPF on this topic in the coming weeks.
Data Security 

Cybersecurity incidents create enormous financial and opportunity costs for schools and students. A New Jersey school district canceled its final exams in the wake of a ransomware attack; across the country a California community college’s website was down weeks after it experienced an attack. Three of the largest school districts in the country - New York City, Chicago, and Los Angeles - have been recently impacted by vendor-related data breaches. 

In 2021 alone, 67 separate ransomware attacks impacted 954 schools and colleges, costing schools an estimated $3.5 billion in downtime, according to a study by security firm Comparitech. “$1 million ransomware claims have become the norm,” Insurance Journal reports

What can schools and districts do to help minimize their risks? K-12 Dive has a good list of 3 ways to keep student data privacy top-of-mind in ed tech procurement. Parents interested to learn more about the edtech their child is using in school may find this list of questions to ask useful.
School Safety and Technology

Following the tragic school shooting in Uvalde, TX, conversations about school safety and the role of security technology are top of mind. We all want to keep students and schools safe, but there are valid concerns, including from a teacher in a school district that has experienced a similar tragedy, about whether installing surveillance technology to ‘harden’ schools does more harm than good.

A recent report on how Indiana schools have responded to school safety threats highlights research that has linked a police presence in schools to negative outcomes including lower graduation rates, higher discipline rates, and increases in arrest rates.  There are also questions about how effective surveillance technology is; the school district in Uvalde had implemented “state-of-the-art surveillance” in line with state recommendations. Security experts also caution against the use of cellphones in schools. And the National Education Association (NEA) - the largest teachers union in the country - recently adopted a policy statement that aims to “ensure safe, just, and equitable schools” in part by calling for an end to the “criminalization and policing of students."

Ultimately, “[w]ith school safety, there are no absolutes,” and “[w]hether outfitting America’s schools like miniature fortresses actually helps to stop shootings is anything but clear.” FPF has long advocated for a balanced approach to protecting both student safety and privacy.

63 percent: a strong majority of parents want Congress to pass additional privacy protections, either for children or all consumers, a new survey from Trusted Future found. 
10: Number of new ‘metaversities’ that will be created through a new virtual reality project funded by Meta. Read more on the potential student privacy implications here.
6,175: The number of students at Simpson University in Redding, California subject to a recent data breach of information including names, Social Security numbers, financial information, and protected health information.
9 million: Online proctoring company Honorlock administered 9 million exams in 2021, The New York Times reports in its story about a 17-year-old who was accused of cheating.
228,000: The estimated number of students in Chicago that could receive access to high-speed broadband by 2024 through the Chicago Connected program, which will extend to July 2024.
91 minutes: kids and teenagers around the world watched 91 minutes a day of TikTok in 2021 compared to 56 minutes of YouTube, TechCrunch reports.
During such a busy time in the privacy world, our team has been focused on developing timely resources to help policymakers, staffers, and other key stakeholders better understand and navigate the various proposals.
FPF Senior Policy Counsel Bertram Lee testified before the U.S. House Energy and Commerce Subcommittee on Consumer Protection and Commerce hearing, “Protecting America’s Consumers: Bipartisan Legislation to Strengthen Data Privacy and Security” regarding the ADPPA. Read his full testimony and more about the hearing in our blog post; and don’t miss his recent op-ed here.
FPF Youth & Education Policy Counsel Chloe Altieri and Kewa Jiang, a student contractor with the FPF Y&E team, analyzed California’s Age-Appropriate Design Code Act, a bill that takes a substantially different approach to youth privacy than the leading federal framework.
The Supreme Court’s profoundly disappointing decision to overturn Roe vs. Wade has led to new concerns that student monitoring software could be used to target students seeking reproductive care. Senators Markey and Warren recently wrote to the CEOs of the most popular monitoring companies requesting additional information about how the companies are protecting students’ privacy regarding reproductive health information. Read more from The Markup here, and more from FPF on student monitoring here and here.
Copyright © 2022 Future of Privacy Forum, All rights reserved.

Want to change how you receive these emails?
You can update your preferences or unsubscribe from this list.