Christian Chase is reflected in his school-issued laptop, which runs a school-issued app called e-Hallpass, in Leesburg, Va. (Jahi Chikwendiu/The Washington Post)
When Christian Chase wants to take a bathroom break at his high school, he can’t just raise his hand.
Instead, the 17-year-old senior makes a special request on his school-issued Chromebook computer. A teacher approves it pending any red flags in the system, such as another student he should avoid out in the hall at the same time, then logs him back in on his return. If he were out of class for more than a set amount of time, the application would summon an administrator to check on him.
Heritage High School in Loudoun County, Va., introduced the software, called e-Hallpass, in September as a way to track trips to the bathroom, the nurse’s office, the principal or other places on campus. It collects the data for each student’s comings and goings so approved administrators can see pass histories or look for patterns.
“I just think it’s a violation of our privacy, and I don’t think it’s something that needs to be in place. I would understand if it was something for specific people or even underclassmen,” said Chase, who started an online petition on Change.org to remove the technology he calls invasive.
As technology becomes more pervasive in schools, parents and students are getting a lesson in data privacy. Every year, they face the overwhelming task of sorting through the benefits, drawbacks and privacy implications of each piece of educational software. Families have to decide if they are comfortable with how information is being collected and used and whether they want to — or even can — opt their kids out.
[Legislators ask firms to explain how they use the ‘vast amount of data’ they collect on students]
Hundreds of applications, big and small, are being used at schools across the country to do everything from track homework to modify behavior. They can collect data about intelligence, disciplinary issues, personalities and schedules.
It is common for families to take precautions outside of school, enforcing screen time rules at home and limiting what photos they post of their children on social media. But controlling what happens at school is harder, in part because districts are not required to inform parents of every type of software students use. And the apps, as well as the schools deploying them, have different rules for how they use, share and store data.
There are classroom management tools like Google’s G Suite for Education that tracks school work and helps teachers, parents and students communicate via messaging and email. Smaller apps such as ClassDojo, which claims to be in use at 90 percent of K-8 schools in the United States, tackle specific subjects or problems. That app lets teachers communicate with parents and grant students virtual points for positive behaviors like teamwork or subtract them for negative actions like being out of their chair. Newer “personalized learning” programs attempt to develop custom education plans for students based on data they collect about their interests and skills.
Google, ClassDojo and E-Hallpass say in their privacy policies that student data is not shared with third-party companies for marketing or advertising, and parents can request deletion. E-Hallpass says schools are entirely in charge of the data the program collects and can delete it as often as they like.
Advocates for using these types of software say they can revolutionize education, helping students gain valuable skills to prepare them for college and then the workplace. Research on the technology is still in the early stages.
Still, privacy advocates say parents face a conundrum. Though there have been some improvements, the education technology industry as a whole is still lagging in privacy protections, with many apps still selling easily de-anonymized data and tracking users, said Girard Kelly, counsel and director of privacy review at Common Sense Media, a nonprofit organization that reviews technology and media targeting young people.
School districts increasingly have their own data privacy agreements for third-parties, but with anywhere from 200 to 600 applications being used across all schools and grades in a single district, by Kelly’s estimate, screening every classroom tool can be difficult.
As a result, families are often left on their own trying to navigate a confusing maze of privacy agreements, school policies and federal privacy regulations.
“Everyone feels overwhelmed, everyone feels like they don’t know what they’re doing, and that’s because the technology is not transparent and does not allow for easy understanding of what your kid is using,” said Monica Bulger, a research affiliate at the independent, nonprofit Data and Society Research Institute.
It is reflective of a broader distrust in big tech. According to a Pew Research Center survey last year, only a quarter of Americans think tech companies “do enough to protect the personal data of their users."
Some parents do manage to comb through privacy policies, opt-out of classroom programs and ask to have students’ data wiped from company servers — even when it puts them at odds with their kids’ own schools.
Kristin Phatak was recently notified her 11th-grader was using a program called Thrively, which asks students to take a personality assessment and then uses the answers to determine their “strengths," recommending careers or skills they should learn.
Her son had already used it once, so Phatak asked her school at the Sweetwater Union High School District in Chula Vista, Calif., to opt him out, to see a copy of the data the company collected about him and for the company to delete any information about him. First, the principal suggested she speak with Thrively’s CEO so he could directly address her concerns.
“As a parent, why am I having to go through this? Why is the principal of our school on a first-name basis with the CEO of a company who is collecting data about our kids?” said Phatak. She eventually received a copy of the data and was told it was deleted, but then her child’s teacher accidentally had him use the tool again.
Sweetwater school officials did not reply to repeated requests for comment. Thrively’s CEO Girish Venkat said the incident was an anomaly, but that he does try to talk to parents who request that their kids’ data be deleted. Of the four parents who have asked, he says all but one decided to let their kid keep using Thrively. The tool is used by roughly 1 million kids, he added.
Thrively’s privacy policy says it does not sell or rent user data, but like many education apps, it can use depersonalized and aggregated information to market products to parents.
“Many parents are upset about the lack of privacy involved with the data going into private corporate hands and how their education is being outsourced to tech companies,” said Leonie Haimson, head of the Parent Coalition for Student Privacy, an advocacy group that gives parents guidance on navigating school data issues.
She recommends making an appointment with a teacher or school principal to ask questions, including what programs are in use, who has access to the data, if the companies are barred from using the information for marketing and if the programs are in compliance with state and federal privacy laws.
Federal laws put some limits on how software is used by schools. The Family Educational Rights and Privacy Act of 1974 limits how schools can share educational records and gives parents the right to review them. The Children’s Online Privacy Protection Act has rules that apply to companies collecting data about kids under 13. However, under the law, schools can consent on behalf of parents for educational products. The Federal Trade Commission is considering updating COPPA.
Parents also have rights under the Protection of Pupil Rights Amendment, which requires schools to get parental permission for any federally funded student survey or sensitive topic evaluations, such as religion, political views or income. But for the most part, schools are not legally obligated to get permission from parents to use specific software in classrooms, or to let students opt out.
[Parkland school turns to experimental surveillance software that can flag students as threats]
Some schools, like those in the Montgomery County public school district in Rockville, Md., are more receptive to parents policing their children’s technology. Ellen Zavian, a lawyer and professor at George Washington University Law School, has cleared her middle-school aged son to use Google’s education software, but not ClassDojo.
“At the beginning of every school year I send the principal what my son’s allowed to be on and what he’s not allowed to be on, and thus far my local schools have been incredibly supportive and have been willing to learn from me as I have been willing to learn from them,” Zavian said. “My goal is to give my child the smallest footprint possible, to give him the largest opportunity possible.”
To help parents and educators make decisions, Common Sense Media examines education-technology privacy policies and looks at factors such as whether data is sold to third parties or if the apps include ads. An application might be dinged for not saying whether it tracks users or created ad profiles, and get points for storing data securely. (The project is funded by the Bill and Melinda Gates Foundation, which is invested in edTech, and Facebook CEO Mark Zuckerberg’s philanthropic organization, The Chan Zuckerberg Initiative, which makes the personalized learning program Summit Learning.)
Common Sense Media found both ClassDojo and the stand-alone Google Classroom tool to have sufficient privacy policies — enough to get a green check mark and a “Use responsibly” label — meaning they met the organization’s minimum privacy requirements. Points were subtracted from ClassDojo’s overall score for its system for obtaining parental consent, while Google Classroom was dinged for how much data it collected.
ClassDojo said its tool is designed to collect the bare minimum amount of information about students and to not create a digital footprint, and that it goes “above and beyond” for parental consent. Google said student information collected by G Suite for Education products like Google classroom is only used to provide the services themselves, and that schools are in control of how often it is deleted.
E-Hallpass does not have a rating by Common Sense Media yet, though the company that makes it, Eduspire Solutions, says it is used in hundreds of schools in the United States. Eduspire President Brian Tvenstrup says the system is meant to keep track of students in an emergency, decrease vaping, identify vandals and crack down on truancy. A feature that lets a school flag specific students or groups who should not be in the hallways at the same time can cut down on bullying or gang violence, Tvenstrup said.
Students can also choose to use e-Hallpass on their personal smartphones, and the mobile app does not use GPS tracking.
Both e-Hallpass and its competitor SmartPass Mobile say another selling point is that the physical objects many classes have typically used for hall passes are unsanitary. A computerized system cuts out the germs.
As for privacy concerns, Tvenstrup says the same information was already being collected by schools — just on paper. Schools have control over how long they store the data. Some delete it annually, a few delete more often than that.
“In our case we’re providing a service. It’s a database of sorts, but it’s analogous to the transition of other digital record keeping that schools keep,” Tvenstrup said. “Twenty-five years ago, grades were not digitized.”
Many students and parents see a digital hall-pass program differently. At Heritage High School, Chase says, other students are also unhappy about the new system. The Change.org petition he created has more than 400 signatures, though it is not clear how many of them attend the school, which has around 1,500 students.
[Hey, kid! Get on the computer to do your homework. Now, get off!]
The Loudoun County Public School district, where Heritage High School is located, allows parents to opt their kids out of the e-Hallpass system and use alternative passes instead, according to Wayde Byard, the school district’s public information officer. It deletes the data it collects once a year, and the more advanced features like cross-referencing students are not widely used in the district. The system is in use at 23 middle and high schools across the district, and each school makes its own decisions about which teachers and administrators can see the data for all kids.
Northwood High School, in Montgomery County, Md., plans to bring e-Hallpass to its campus at the end of October, though a number of parents planned to oppose the decision at a recent PTA meeting. The school will have a single school-issued computer in each class where students can request passes and will not use it on personal cellphones, according to Derek Turner, head of communication for Montgomery County Public Schools. The district does not have plans to test it at other schools, Turner said.
Both the Montgomery and Loudon County school districts have data privacy agreements tech companies must agree to as part of their contracts. When online educational tools are used without contracts, the schools say they vet and approve them.
Privacy attorney Brad Shear has two elementary-age kids in the Montgomery County schools. He has been vocal about parental privacy rights and successfully lobbied the district to adopt an annual “data deletion week.” Now, the school purges any unnecessary data about students from tools like Google’s education suite, keeping essential information such as grades.
However, if the district does decide to test e-Hallpass in more schools, Shear and other parents are ready to mobilize against it.
“I will not allow this app to be utilized in my kids’ schools, period. If the app ends up getting rolled out I will make sure that I get the PTA involved,” Shear said. “This is bathroom big brother.”