Illustration by Jarred Briggs
Millions of students in Canada and around the world had their personal information sent to advertisers and data brokers when governments made an abrupt switch to online learning during the pandemic, according to a new report that reveals safety gaps in educational technology.
The Globe and Mail collaborated with 12 other media organizations to access data and findings from Human Rights Watch (HRW), which alleges online education platforms in 49 countries actively or passively infringed upon children’s rights by collecting and sharing their personal information, such as their locations and web browsing histories. This investigative collaboration was co-ordinated by the Signals Network, a French-American non-profit organization that supports whistle-blowers.
The findings, which were provided to The Globe ahead of a public release in June, included data on nine virtual learning platforms used in Canada: CBC Kids, Math Kids, ABRACADABRA, LEARN, Active for Life, Mathies, Prof Multi, Storyline Online and Storyweaver. All of these platforms were promoted by the Quebec government through L’école ouverte, a web portal that contains recommendations for educational tools. One of them, Mathies, was directly developed by Ontario’s Ministry of Education.
Out of the nine products, HRW found one website (LEARN) and two apps (Math Kids and Prof Multi) had not been collecting or transmitting information about children for use in advertising or tracking. All six others had been engaged in collection and transmission of data. In some cases, the data collection may have been done passively, meaning the information was gathered by a third party, such as an outside video-streaming platform, rather than directly by the creator of the app or website.
CBC Kids, an educational website run by Canada’s public broadcaster, is used as a global case study in the HRW report, because of how particularly “egregious” the site was in its data-collection practices.
Altogether, HRW reviewed 164 prominent educational technology products that governments around the world had either mandated, procured or endorsed for school-aged children. Of those, HRW found that 146, or roughly 90 per cent, monitored children by harvesting their information. Often, the companies did not disclose in their privacy policies that they were doing so, and did not receive explicit consent from parents.
This type of data collection is common online. Many commercial websites send data to third-party advertisers and brokers, which use the information for a variety of purposes, including tailoring advertisements to match the interests of individual users.
HOW EDTECHS MIGHT COLLECT PERSONAL DATA
Here’s how a child using an educational technology app or website to attend school online might find their personal information and data collected, then transmitted to other entities.
A child opens the EdTech app or website that their school uses for online learning and logs in for class.
Student
Instantly, the app begins to collect personal data about the child. This could include information about where the child is located, what they did in their classroom, who their family members and friends are, and what kinds of devices they use.
This data is then sent to advertising companies, either directly by the EdTech company or through tracking technology embedded in the product.
Advertising company
In the process, advertising companies assign an ID number to the child, to help piece together the data and build a profile.
#0001
Some advertising companies will also follow the child across the internet as they access other sites and applications over time.
Some companies may gather even more intimate data from public and private sources. This could include details such as app and website usage behaviour, keywords from conversations and search history. The data could also tap into the child’s sleeping patterns.
Then, a sophisticated set of algorithms analyze the trove of data received from an EdTech app or website.
A wider digital picture of the child’s personal characteristics and interests is created, with the ability to predict their future behaviour (for example, whether a child is female and whether they are likely to buy a toy).
Real-time bidding technology is employed, where algorithms engage in a high-frequency auction amongst advertisers to sell off the chance to show an ad to a user. This automated process can take place tens of billions of times each day.
$$$
#0001
These insights can then also be sold as information to actors beyond advertising companies, such as data brokers, law enforcement and governments, or anyone who wishes to target a defined group of people with similar characteristics online – in this case, children.
THE GLOBE AND MAIL
HOW EDTECHS MIGHT COLLECT PERSONAL DATA
Here’s how a child using an educational technology app or website to attend school online might find their personal information and data collected, then transmitted to other entities.
A child opens the EdTech app or website that their school uses for online learning and logs in for class.
Student
A child opens the EdTech app or website that their school uses for online learning and logs in for class. But behind this scene, the work had already begun, when the app or website first decided to sell ads in order to make money.
Instantly, the app begins to collect personal data about the child. This could include information about where the child is located, what they did in their classroom, who their family members and friends are, and what kinds of devices they use.
This data is then sent to advertising companies, either directly by the EdTech company or through tracking technology embedded in the product.
Advertising company
In the process, advertising companies assign an ID number to the child, to help piece together the data and build a profile.
#0001
Some advertising companies will also follow the child across the internet as they access other sites and applications over time.
Some companies may gather even more intimate data from public and private sources. This could include details such as app and website usage behaviour, keywords from conversations and search history. The data could also tap into the child’s sleeping patterns.
Then, a sophisticated set of algorithms analyze the trove of data received from an EdTech app or website.
A wider digital picture of the child’s personal characteristics and interests is created, with the ability to predict their future behaviour (for example, whether a child is female and whether they are likely to buy a toy).
Real-time bidding technology is employed, where algorithms engage in a high-frequency auction amongst advertisers to sell off the chance to show an ad to a user. This automated process can take place tens of billions of times each day.
$$$
#0001
These insights can then also be sold as information to actors beyond advertising companies, such as data brokers, law enforcement and governments, or anyone who wishes to target a defined group of people with similar characteristics online – in this case, children.
THE GLOBE AND MAIL
HOW EDTECHS MIGHT COLLECT PERSONAL DATA
Here’s how a child using an educational technology app or website to attend school online might find their personal information and data collected, then transmitted to other entities.
Student
A child opens the EdTech app or website that their school uses for online learning and logs in for class.
Instantly, the app begins to collect personal data about the child. This could include information about where the child is located, what they did in their classroom, who their family members and friends are, and what kinds of devices they use.
This data is then sent to advertising companies, either directly by the EdTech company or through tracking technology embedded in the product.
Advertising company
#0001
In the process, advertising companies assign an ID number to the child, to help piece together the data and build a profile.
Some advertising companies will also follow the child across the internet as they access other sites and applications over time.
Some companies may gather even more intimate data from public and private sources. This could include details such as app and website usage behaviour, keywords from conversations and search history. The data could also tap into the child’s sleeping patterns.
Then, a sophisticated set of algorithms analyze the trove of data received from an EdTech app or website.
A wider digital picture of the child’s personal characteristics and interests is created, with the ability to predict their future behaviour (for example, whether a child is female and whether they are likely to buy a toy).
Real-time bidding technology is employed, where algorithms engage in a high-frequency auction amongst advertisers to sell off the chance to show an ad to a user. This automated process can take place tens of billions of times each day.
$$$
#0001
These insights can then also be sold as information to actors beyond advertising companies, such as data brokers, law enforcement and governments, or anyone who wishes to target a defined group of people with similar characteristics online – in this case, children.
THE GLOBE AND MAIL
But educational technology apps and websites are different from other online services in two important respects: one, they are targeted specifically at users who are young and therefore especially susceptible to harm, and two, schools often require or strongly encourage children to use them, giving students and their parents little opportunity to opt out of data collection.
If children were shown targeted advertising based on data collected while they were attending school online, this could have manipulated their beliefs and distorted their view of the world at a time when they were particularly vulnerable, the HRW says in its report.
Coupled with more than a dozen interviews conducted by The Globe, the HRW report suggests privacy expectations that usually apply in physical classrooms have not been firmly established in the virtual space. Many observers worry that, as online learning further entrenches itself in the public education system, not enough will be done to keep children safe.
In the United States, parental concerns about privacy protection for children have led to legislation. The Children’s Online Privacy Protection Act (COPPA) requires parental consent for collecting personal information from children under 13. No such law exists in Canada.
The only applicable law in Canada is the United Nations Convention on the Rights of the Child, to which Canadian provinces are bound as signatories. But the language in the treaty is unclear, and there is only one reference to children’s privacy, in Article 16, which says: “No child shall be subjected to arbitrary or unlawful interference with his or her privacy, family, home or correspondence, nor to unlawful attacks on his or her honour and reputation.”
In an e-mailed statement, Quebec’s ministry of education said it offers resources that can be used in distanced learning, but that school districts are responsible for choosing online platforms and applications. It also said it provided guidance on making sure students’ personal information was secure.
Illustration by Jarred Briggs
Across the country, when COVID-19 swept onto Canadian shores in March, 2020, students were forced into online classrooms. Governments turned to educational apps and websites. This gave international corporations that produce this technology an opportunity to tap into the habits of a young captive audience for an extended period of time.
These companies began to collect personal data from children, according to HRW’s research and findings. This included information about who children were, where they were located, what they did in their classrooms, who their family members and friends were and what kinds of devices their caregivers could afford to buy them. If a student searched for something online, doodled on a virtual whiteboard or visited a non-school-related website, that data could be collected.
Most of this was done through tracking technology built into or included with educational apps and websites. With these techniques, which are commonly used by online marketers to build profiles of customers, some educational platforms were able to trail children outside of their virtual classrooms and across the internet, HRW found.
Other ways of collecting children’s data included invisibly tagging them, so that their digital trail was difficult to get rid of. This tracking technique, which is also often used on commercial websites, is particularly invasive when applied to students, HRW said. It works by drawing hidden shapes and text on a webpage that can be connected to a unique numeric identifier for a user’s device. Users cannot eliminate this type of tracking through any ad-blocking software, or by adjusting their web browser privacy settings.
The 146 educational technology products HRW studied around the world sent, provided or transferred data to 199 different advertising or marketing companies. Those ad companies used algorithms to analyze children’s data and predict what they might do next and how they might be influenced.
The insights developed and information maintained by advertising companies were put up for sale in the highly lucrative, global data-collection market. Anyone who wanted to target a defined group of people online would find this type of data valuable, experts say. That includes advertisers, marketers and information brokers.
For some children, online learning had unexpected benefits
Ontario’s election could decide the future of online education in the province
Major advertising sellers, such as Google, employ a process called real-time bidding, in which algorithms run auctions among advertisers for the chance to show ads to targeted groups of users. This process can take place tens of billions of times each day.
Data breaches are also a concern. In 2020, Oracle Corp.’s BlueKai Data Management Platform leaked information about billions of people – including their names, home addresses and other personally identifiable data – out onto the open web for anyone to find. Similar breaches happen with smaller data sets many times each year.
Research from HRW suggests CBC Kids had been transmitting data to BlueKai through trackers and cookies, both prior to and after Oracle’s reported data breach.
“When we start to finally understand how this massive level of information was collected, and how children’s privacy was put at risk, it becomes seemingly obvious that there was a lack of due diligence here,” said Sharon Bauer, a privacy consultant and lawyer who runs Toronto-based Bamboo Data Consulting, and who was not involved in creating the HRW report.
“The pandemic is frankly not an excuse for this, but it is easy to see how it pushed any concerns about data collection on the back burner, and perhaps made all of this more rampant.”
To conduct its research, HRW chose 164 educational technology products, first by determining whether they were mandated, procured or endorsed by governments of any level in any of 49 countries. In countries such as Canada, Germany, India and the U.S., where decision-making authority is exercised on a state or regional level, HRW identified the two most populous states or provinces, then analyzed products specific to those regions. After that, HRW investigated advertising companies and information brokers found to be receiving children’s data.
In Canada, HRW looked at Quebec and Ontario. Other provinces were not included in the research, but the apps and websites the organization studied are globally accessible. One platform that had been used in Ontario was removed from the final report because HRW said it “yielded an inconclusive assessment.”
“In all cases, this data surveillance took place in virtual classrooms and educational settings where children could not reasonably object to such surveillance,” said Hye Jung Han, lead researcher for HRW’s report and a specialist in the organization’s children’s rights division.
“Most EdTech companies did not allow their students to decline to be tracked. Most of this monitoring happened secretly, without the child’s knowledge or consent. In most instances, it was impossible for children to opt out of such surveillance and data collection without opting out of compulsory education and giving up on formal learning altogether during the pandemic.”
In Canada, HRC studied two educational technology products that were developed with government funding: CBC Kids and Mathies. Mathies was developed by Ontario’s Ministry of Education, then recommended for use by the Quebec government.
Ingrid Anderson, a spokesperson for Ontario’s Ministry of Education, said the provincial government provides school boards with a “secure platform” for online learning that meets the province’s information technology standards.
Over all, Ms. Han said, “one of the most egregious cases in Canada and really all around the world” across educational technology platforms was CBC Kids, which was recommended by the Quebec Education Ministry for preprimary and primary-school-aged children.
According to the findings, CBC Kids used 29 trackers to collect data and sent it to 20 advertising companies. CBC Kids also used 15 third-party cookies to send further data to nine advertising technology companies, HRW found. That’s more than five times the median number of cookies and more than four times the median number of trackers installed on the world’s most popular websites.
In its privacy policy, CBC Kids says, “The vast majority of the information you create doesn’t have any indicator of who you are, personally.” But HRW found that CBC Kids had been sending children’s data to companies that publicly say they connect people’s offline identity records to their online activities.
Six advertising companies to which CBC Kids sent data – Adobe, Facebook, Google, LiveRamp, Piano and The Trade Desk – offer services to match website visitors to personally identifiable information sourced from other online and offline records, including physical addresses, location data and credit scores, HRW found.
Seven of the companies to which CBC Kids provided data – comScore, LiveRamp, Lotame, Neustar, Oracle, The Nielsen Company and Throtle – have formally registered themselves with the California Data Broker Registry as data brokers, meaning their primary business is the packaging and selling of people’s personal data.
Lotame, for example, says on its website that it is the “World’s Largest 2nd and 3rd Party Data Marketplace” and that it “supplies real-time access to a firehose of raw behavioral data from billions of consumer profiles.” The company says it “can add demographic, behavioral, geographic, and other types of data to learn more about your customers and find new ways to monetize those audiences.”
When reached for comment by HRW, CBC said it “explicitly prohibits targeting on both our traditional and online platforms” and that the CBC Kids section is “ad free.” CBC told HRW that Lotame, Oracle, Facebook, and Neustar are “inactive” trackers and are primarily used for “product performance,” though it mentioned that it had discovered a Google cookie on the CBC Kids website, which the broadcaster added it plans to investigate.
In a statement to The Globe, CBC’s director of public affairs, Kerry Kelly, said the organization “complies with relevant Canadian laws and regulations with regard to online privacy, and follows industry practices in audience analytics and privacy protection.”
“We take special care to be transparent with respect to tracking on our digital properties, including with regard to audience and product analytics on properties designed for children,” Ms. Kelly said. “Moreover, we explicitly prohibit advertising targeting children on both our traditional and online platforms. The CBC.ca/kids section is ad free.”
The Globe also reached out to the eight other educational technology companies whose products are identified in HRW’s report as being used in Canada. Two of them – Mathies and Prof Multi – did not respond to requests for comment.
In an e-mailed statement, Anne Wade, a part-time professor and global manager at publicly funded Concordia University, which developed ABRACADABRA, said, “We do not collect individual user (parents, teachers, and student) data. We do, however, use Google Analytics to monitor the number of visits to the web site.”
In a statement to The Globe, Caroline O’Connor, communications director for the California-based SAG-AFTRA Foundation, which developed Storyline Online, said it does not collect any personal data, but “will be taking a hard look at our third-party video sharing platforms and their data tracking practices.”
According to Ms. Bauer, the privacy consultant, it is common for schools to unwittingly send student data to tech companies. “Even if, let’s say, a school board is attempting to perform due diligence by going through different privacy policies for these apps and whatnot, it may not be obvious that they’re tracking the kids and creating a profile,” she said. And there are loopholes that protect the tech companies, she added.
“The way that a lot of companies get away with this data collection is to say they do not know the identity of the child. That they’re not collecting their names. That they’re not, you know, doing any facial recognition work and that it’s completely anonymized information,” Ms. Bauer said. “And if it’s anonymous information, then it’s not personal information. And then, if it’s not personal information, privacy legislations do not apply.”
Some of the world’s most valuable internet companies and platforms – such as Google, Facebook, Apple, Alibaba, Amazon and Microsoft – own entire supply chains of advertising technology. These companies provide the platforms through which data is collected to profile and target people, and they also commercialize those insights for advertising, often on their own platforms.
According to recent estimates, the pandemic almost quadrupled the reach of Google’s educational technology product, Google Classroom, which went from 40 million users in 2019 to 150 million as of last year.
But HRW was unable to examine Google Classroom as part of its research, despite the virtual learning platform’s dominance among educational technology tools, especially across Canada. This is because users’ accounts are tied to their identities in schools or education ministries, meaning people outside of those organizations are unable to get access. The platform cannot be analyzed without an account, Ms. Han said.
And yet, there are some educational technology platforms – such as Math Kids, LEARN and Prof Multi – that are “demonstrating it is possible to build an app to provide education for children without sending their personal information” to advertising companies, Ms. Han said.
Vivek Dave, president of U.S.-based RV Appstudios, which operates Math Kids, told The Globe he has created 13 other educational apps that work without any ads or tracking. “We never wanted to track any data, since I wouldn’t want my kids to be tracked either. So I chose the less-travelled route of going by my gut instinct to create the apps,” Mr. Dave said.
Michael Canuel, the CEO of LEARN, a small non-profit that provides online classes and tutorials at no charge to the English-speaking community in Quebec, said his company has constantly updated and upgraded its systems since it began offering online learning in 1999, and as a result did not have to implement new security measures during the pandemic.
Students who are directed by educators to the platform have to use their school board e-mail addresses. LEARN does not let students turn on their cameras, both for privacy and to ensure equity for those who have bandwidth issues, Mr. Canuel said.
“I will never say we are invulnerable or that there is no risk, but the privacy and security of our students is of paramount importance to us,” Mr. Canuel added.
For Beyhan Farhadi, a mother of two and a postdoctoral researcher in equity and e-learning at York University in Toronto, the struggle against online privacy violations feels like a losing battle. Her two young children kept their cameras off during their online classes. She sat with her youngest through his online lessons.
“I know my child is definitely contributing to this surveillance digital economy that’s extracting his data. But at the same time, I want him to be able to move in his classroom and do the things his class is asking him to do without having to fight it all the time,” Ms. Farhadi said.
She said parents need to be cautious, especially as the Progressive Conservative government in Ontario creates a marketplace for online learning. She urged the government and school boards to enact stricter policies around digital learning spaces.
“I think there’s a sense of ‘Oh thank God these companies were here. Thank God we were able to have access to technology that keeps us connected,’ without asking what’s happening with the information,” she said.
Our Morning Update and Evening Update newsletters are written by Globe editors, giving you a concise summary of the day’s most important headlines. Sign up today.