 All right, and we're live. Good morning from the Electronic Frontier Foundation's offices in San Francisco. My name is Jenny, and I'm a researcher here at EFF, and this is my colleague Amul. And this morning we are here to talk to you about student privacy. Just a few hours ago, EFF released this brand new report spying on students, school-issued devices and student privacy. And so this morning Amul and I are gonna talk about the report, talk about some of the main issues around student privacy, and also take your questions on it. So the report has three main sections. We've got a survey with over 1,000 responses about what people are experiencing with student privacy in their communities. I worked on that. We have a legal analysis of state and federal laws, as well as industry self-regulation. And we have recommendations for school stakeholders and for ed tech companies, which Amul worked on. So student privacy is an extremely important issue for EFF supporters and members. And no one is in a better position to talk about that than Amul. So Amul, I was wondering if you could tell us about your job as intake coordinator and what you've been hearing there from our supporters about student privacy. For sure. Thanks, Jenny, for the introduction. So my name is Amul and I'm the intake coordinator and analyst at EFF. So my job is basically being the front lines of all the inquiries that we get. And over the past two years we've been getting a lot of inquiries from parents, whether it's with students or assist admins, whether it's district employees who are rightfully worried about the use of technology in education. Technology, as we mentioned in the report, it's being rapidly deployed over a huge proportion of students are actually engaging with this technology as part of their regular education in the classroom. And so people, as with all new technology, it's great to have it, but we should definitely be worried about its implications. So we heard from parents who kind of worried about how data is being collected on their students, teachers who worry about what to do to make sure that their students' data is protected, and students themselves who are like, how does this technology impact me? So as this technology is being rapidly deployed, we're hearing from various stakeholders across the educational ecosystem who are worried about this. And I mean, the fortunate spot to be able to hear all of them and to see how we can help those people. And what role EFF as a digital rights organization can play to preserve privacy of those people. Excellent. So Jenny, I wanted to start off by asking you, you mentioned that you worked on the survey. So if you could tell us a little bit about what your work on the survey over the past year or so. Yeah, absolutely. That's another way we've been hearing from supporters and other concerned stakeholders about student privacy. So EFF a bit over a year ago launched an online survey to ask parents, teachers, students, administrators, other school staff, what they've been seeing happening with student privacy on the ground in their own communities and in their own schools. We heard back from over 1,000 people. We managed to reach out and interview quite a few of them. And we put those findings and interview quotes and survey numbers into our report. And we found eight main things, but it really boils down to a few key points. It's lack of transparency, it's lack of choice, and it's lack of training. So lack of transparency, we're seeing that parents and students aren't really finding out about what is going on with technology in the classroom until after it's been deployed. And even then it's hard for them to get answers to their questions. Lack of choice, we're finding that it's hard for parents and families to opt their children out of technology use if they want to. And finally with lack of training, teachers increasingly don't have the training and resources that they need to deploy technology in the classroom in a privacy conscious way. And students aren't getting the digital literacy education they need to really take control of their own privacy and their own online presence. Sure, and you've also done sort of individualized case studies of different people as well in the course of our research as well, right? Yeah, yeah, in the report we have four case studies each delving into one individual and their specific experience with one facet of student privacy. One really interesting case study, we talked to a school administrator, a technology director in an Amish community. And he was talking about how they provide opt-out to students and all the reasons there are to provide opt-out. Not only do parents sometimes decide they're just not comfortable with technology use or that they're concerned about privacy, there's also, as in an Amish community, really serious lifestyle and religious reasons for not using technology. This administrator also highlighted that there's other reasons for a laptop to not be in a kid's hands, like if they're engaging in bullying or other kind of behavior that's not allowed at the school or breaking school policies. So it was really highlighting how schools need to be prepared for opt-out, no matter what. And speaking of opt-out, Omul, you've heard a lot about that from supporters and from parents. What have you heard from people about that? Yeah, I mean, I would say that one of the largest categories of people in the school education ecosystem that we hear from our parents. And so parents, one of the things that we've kind of heard about in terms of what are their specific concerns are, they're kind of, when they receive, they're actually not really clear the privacy policies of the vendors or the ed tech providers that the schools and the school districts are using. So a lot of times they'll write to us saying, hey, I received this document from my school, what does this mean? It's telling me to go to all these different places to look at these policies, like what can I do specifically? So it sounds like they're getting like a document from the school that's a privacy policy referring to other privacy policies? Yeah, that's actually very common. And it's kind of ridiculous because, part of the reason that you get these documents is from the school district, right? School district says, like, gives it to the student, like here, have, you know, give this to your parents to sign. And a lot of times parents don't really have that much time to even consider those documents. So if it's saying, okay, sign this within five days, and here's the acceptably used policy, which is something that the school district would give. And here's the privacy policy for the vendors that we're using. So a lot of times parents don't really have time to be like, okay, this privacy policy is actually referring to third party's privacy policy that I need to go look at. So in those situations, it becomes kind of hard for parents to actually keep track of that. And the other thing that parents are worried about is a lot of the times their students are being signed up for services without their knowledge. I think specifically some parents wrote to us saying, like, you know, even after they had expressed discontent with this technology being used in the classroom, they wrote to us saying that school district was like totally ignoring their concerns and their kids had like a shiny new Chromebook account and things like that. Yeah, so these are sort of like the main concerns that parents in particular have, which rightfully makes sense because it is their kids who are being impacted by the use of this technology. Sure. And that lines up with some of the things we found in the survey as well. Like you said, sometimes when parents express their discontent, their child has nevertheless issued a Chromebook or signed up for services. We found that parents faced a lot of barriers to opting out, and that means, you know, choosing not to use technology for whatever reason or tailoring their child's technology experience. Most often, I mean, the parents and the students and even teachers we heard from in the survey opt out was possible in theory, but not in practice. And sometimes even if an opt out policy was on the books and writing, schools weren't prepared to offer educational alternatives or alternative assignments to students. Technology has already become so baked into classrooms across the country. Have you heard from parents about kind of specific barriers to opt out or stories you've heard? Yeah, I could talk a little bit about sort of like opt outs in general and sort of what parents can do to advocate for their kids in the classroom. So yeah, as Jenny mentioned that in the survey, we're hearing a lot about parents from when they want to opt out of this technology, meaning that they don't want this technology to be used, the particular technology that the school district wants to use for their kids to be taught, or they want to use some other technology, or they want to find other ways to make sure that the data of their kids is not being sent back to their service provider. So opt outs can take various different forms and we hope that school districts take that into account. So in terms of what specifically parents can do to advocate for their kids, so parents actually have a lot of power, which is something when a lot of times like parents fail to realize because they kind of think that oh no, I'm the only one who is worried about this thing that's happening with my students, but they'll actually be surprised to find out that, like no, there's actually other people in the community who are like kind of worried about the same thing. And so what the parents can do is they can sort of gather all of those allies and make sure everyone has like a base level understanding of what's happening and to be able to ready to take action. At the local level, you have a lot of power. You can set up a meeting with your school district administrator, your school district, people who get elected. They're your elected representatives so they're accountable to you. And you can really talk to them about like, hey, I don't actually like this thing that's happening and basically gather a few of your close friends, the other allies you've gathered, be like okay, my school district is using this particular device and I've learned from their privacy policy that this is problematic and I don't want them to use it. So that'd be one form, they should go to PTA meetings, which are school, local boards, like parent-teacher association meetings, where they can voice their concerns and this is another way to gather allies actually. So if you speak up during those meetings. Yeah, that sounds like a powerful way to organize. Like if you speak up during those meetings, then you'll find other people who are like, oh yeah, this person is totally saying like if you go to a PTA meeting, oh my God, Jenny is so right, I'm gonna follow up with her. So it'd be like a good way to kind of do that. And the other thing is like, parents need to like demand opt-outs. If you're uncomfortable with the technology, like you don't need to go along with it. Cause a lot of times they think like, oh no, like I have no choice, but as we argue in the report, like you actually absolutely have the right to demand opt-outs. And which we feel like you should. You have a lot of power as an individual and as a community that you can gather. So now let's talk a little bit specifically about what individuals can do within the system. So Jenny, I was wondering if you could tell me a little bit about what librarians can do in sort of to enhance student privacy in schools and school districts. Yeah, that is a great question. We found through our work in investigation, okay. We found at our work in investigation that there's a lot of school staff who can work on this. Often a lot of the focus is on administrators and teachers and they're absolutely the front lines. But other staff in the school, librarians, SIS admins have a lot of power and a lot of expertise when it comes to digital privacy. So school librarians are already in a position where they are privacy experts. They're often technologists or they use technology in the library and they're educators. So with all those roles, they can really be leaders in a school. They can lead the way with the library's privacy policy to set an example for school privacy policies. They can be available as expertise when staff or teachers are trying to choose a tech apps that aren't sure how to read those privacy policies or how to deploy them in the classroom. And they can lead the way in digital privacy education for students. Both within the library and in classrooms, they can make digital literacy a part of the curriculum. So I think those are the most powerful ways librarians can get involved. And it looks like we have some questions. Before we dive into those, for people just tuning in, we are here at the Electronic Frontier Foundation offices in San Francisco talking about student privacy. My name is Jenny, and this is my colleague Amul, and we both worked on a report that EFF launched just a couple hours ago called Spying on Students, School Issue Devices and Student Privacy. So it looks like we have some questions from people watching about student privacy. Amul, do you want to look at one? Yeah. So this question is from Sue. Sue says, and I'll post it to Jenny and I'll chime in if I have something to add. Privacy policies are only as good as they're enforced. What controls would you recommend to help ensure parents and students that their PII, Personally Identifiable Information, is ultimately protected? For example, many students use school-issued Chromebooks, so with logging out at the end of the day mean clearing the cache, because if opting out means a student doesn't have access to technology, therefore it's a disadvantage. Is that even better or worse for the child? And I'll leave this question right here so we can refer to it. Yeah, sure. That is a great question, Sue. When we talk about this a lot in the report, like you said, that privacy policies are only as good as their enforcement. And we found that a lot of parents in particular were unsatisfied with that kind of privacy by policy, particularly when we see that teachers often don't have the training or resources they need. You can only comply with those policies consistently if you are well-trained, if you have the resources and time to keep up with changing policies and changing technical requirements, and if you have support from system administrators and admin and other people on your staff. So as far as controls and safeguards, those can take a lot of forms. We see you mentioned Chromebooks. We've published guides online for Chromebook privacy settings and Google Student Account privacy settings. So we suggest checking those out if you go to our student privacy page on the EFF website. Those will have some guidance for how parents or students can take control of those devices and softwares. Do you have any other thoughts on that? Oh yeah, I think Jenny did an awesome job of telling that parents, especially when it comes to Chromebooks, we have two blog posts on it that are very detailed, as Jenny said, and you can go. The other thing I wanted to say was in terms of enforcing privacy policies, this is where you lobbying the school districts can go a long way. Yeah, absolutely. Because as I mentioned earlier, you have a lot of power. So if you tell the school district, like, hey, student privacy is a big concern for me as these technologies are being incorporated into the classroom. So I want to make sure that you use technologies that actually will preserve the privacy of my kid. One of the ways that you can do that is by making sure that school districts actually sign contracts that explicitly lay out the terms of how the student data can be used and how the data is being collected and all of that. So school districts rather than just accepting the default privacy policy that the vendor wants to push on them, they can actually mandate and say that, no, the contract should be customized to our particular needs. And those particular needs could be very privacy enhancing, which you as a parent suit can advocate for. There's also a second question here. If opting out means the student doesn't have access to technology and therefore is at a disadvantage, is that better or worse for the child? I think that question, when we think about opting out, it's often a necessary but not sufficient measure. I mean, in an ideal world or in an easy world, technology would be so educationally beneficial and so privacy enhancing even that parents wouldn't even wanna opt out. But the reality is that families are gonna have a lot of legitimate reasons for opting out regardless. And the schools need to be ready. And we shouldn't have this trade-off between using technology or having a bad educational experience. We shouldn't have this trade-off between not using technology or protecting your privacy. We should be able to do both. We should be able to use technology in the classroom in a way that protects students' privacy and even enhances it with digital literacy, education opportunities. And when, for whatever reason, inevitably students need to opt out, we should have educationally comparable alternatives for them. They should not have a worse classroom experience because of technology preferences. So I think it's a great question when that, I think that's the challenge of student privacy. How can we get past opt-out being a disadvantage? How can we make sure that all students are accommodated with the education and privacy that they need? So speaking of advocating for districts to change their practices, you mentioned that districts should demand a contract, not just accept terms of service. Can you tell us more about that for people who are familiar with the difference between those two or what those two entail? Yeah, for sure. So when a school district wants to incorporate technology, they have to sign some sort of an agreement with the service provider, whether it's getting services for free at a steeply discounted rate, which we mentioned happens a lot with Chromebooks and other ed tech providers because they want to get a foothold into the education space. So yeah, so what districts can do is like, and when you sign that contract, the ed tech provider, let's say to Google, would be like, okay, this is our policy. And so what we want the school districts to actually do is rather than just engaging into these standard contracts, we want them to actually say and explicitly talk about, okay, what specifically is the, like what data can you collect as a service vendor? How this data can be used and what kind of controls do we have on it as a school district? How is it uploaded? So the whole idea is that you want to make sure that whatever service you're incorporating into your classroom is actually customized to your own needs. And school districts have, I would say a very important role in making sure that kids actually have privacy because they're the ones who are choosing this technology to be incorporated into classrooms. So for that particular reasons, we hope that school districts would actually ask for particular terms of service and particular contract. And in terms of guidance, as we mentioned in the white paper, the US Department of Education has actually published some guidelines on what specifically school districts should look out for. And this is something that we've incorporated into the report when it comes to the recommendations for school districts and administrators. Okay, it looks like we're getting the 10 more minutes signed. So if you have any questions, please feel free to write those in the comment box and we'll be on the lookout for them. If you're just tuning in, we're here at the Electronic Frontier Foundation offices in San Francisco. And we're talking about student privacy. I am Jenny, a researcher here at the EFF and this is my colleague Amul, our intake coordinator. And we're talking about the new report that EFF just released spying on students, school-issued devices and student privacy. We're going over some of the main issues, some of the main findings in the report and responding to your questions as they come in. So another thing we wanted to cover as we're talking about how districts can improve, how do we wanna see anti-companies improve? What do we wanna see change there? What best practices do we wanna see implemented? Yeah. And so we at EFF, we love technology. We're like the organization that's been around since 1990 to make sure that technology elevates people's lives and simultaneously making sure that it doesn't have any detrimental effect on people. So we recognize that a lot of tech companies, they have admirable goals, which is that they wanna increase student engagement, they wanna make sure that we end up with better results for our students. So I think it's great that they wanna do that. Simultaneously though, we encourage these companies and then as we lay out in the report, we have specific recommendations for them to engage in when it comes to improving their products and services that they offer to the school districts or classrooms across the country. So in terms of specific, I'm gonna refer to my notes here. Yeah, sure. And in terms of specifically what they can do is explicitly state how data will be collected and how it would be used. A lot of the times we're seeing that specifically, and I'll allude to this one particular policy that I saw from a school administrator, or from a parent actually, where they received, where they, where the contract said something like, we'll use this data for educational purposes and as required. So yeah, so as required, like what the hell does that even mean? You know? It's pretty vague. And so the parent was rightfully concerned and they crossed out as required part and they sent it back to the district who was like, no, we are in a contract with our vendor so you have to use the standardized forms. So what they can do is make, that ed tech providers can make sure that this kind of like vague language is not in the contract or the privacy policy that they are incorporating into their services. And more specifically, and in terms of, get opt-in for product improvement, a lot of the times this data is being collected under the guise of like, we're gonna use this to improve our product. Another pretty vague term. Yeah, another, like what does that exactly mean? Does that mean like, you know, you're gonna be using it to data mine to see what exactly how the services are being used or you're gonna use it to create a profile on your students to make sure like your databases are in sync, you know? It can mean like a whole lot of things. It can mean a lot of things, some of which are more a violation of privacy than others, I can imagine. For sure, yeah. And you know, we want them to get, you know, ideally we want them, and not ideally, I feel like they should have to get opt-in from parents when they want to use this data. That's the best practice, yeah, for sure. And another thing they could be doing is to make sure that the data security practices that they have are industry standards or maybe even far beyond, given the sensitive nature of this information, they should make sure that, you know, they're incorporating encryption. There's students who are accessing this service over HTTPS. Absolutely. And there's, you know, forward secrecy built in. So basically a lot of these things that are now industry best practices when it comes to security, they should be incorporated. Absolutely. And another role that companies have is to make sure that districts are actually following good rules and teaching their students privacy enhancing skills. So for instance, product, the companies can insist on like, you cannot use like a six character password for our services, you know. Because that's often the length of a birthday. Yeah. And we've found a lot of schools kind of report us through the survey and through intake that they're using students' birthdays as passwords, which is not a good password. It's not strong. It's not randomly generated. And you're right. Tech companies can have safeguards against that. Yeah. They can totally mandate, you know, it should be, you know, 18 characters long or something like that. So that's like another way. And, you know, we lay out more of these recommendations for our type providers in the white paper. And as I mentioned, a big part of this campaign is to sort of teach students about, you know, how it is that they can enhance their privacy. They should have, you know, lessons on digital privacy and things of that nature. So I kind of want to turn and, you know, this is a question that I want to ask you, Jenny, which is that why the focus on students, you know, what makes student privacy an important issue and sort of going along those lines? What can concerned students do about it? Yeah, absolutely. I think that's a really important question when we're looking at privacy in schools. You know, why privacy in schools? Why not just privacy everywhere? What makes the school setting and the student role so special? I think it's because there's two aspects of it. First, they're students and they're learning. And learning requires that you feel safe taking risks and making mistakes and voicing unpopular opinions. And when you feel watched or under surveillance, that becomes very difficult to do. The research has shown chilling effects in students when they feel watched, when they feel that teachers or companies or some kind of big brother is always watching them. Then they can no longer be creative. One of the librarians we interviewed voiced that sentiment, which I thought was great. It kind of surveillance impedes creativity and schools are a place where we want intellectual freedom and creativity to be imperative. Second, we're talking about children, often minors. And a lot of special considerations for sensitive data come in there. In particular, what we've focused on a lot at EFF is teaching children surveillance culture at a young age. We shouldn't be teaching students that it's normal or regular to hand over your information to companies in exchange for free services. We shouldn't teach children to be comfortable with and accept kind of constant monitoring or collecting or commodification of their data. We should teach really solid privacy expectations as students are just beginning to learn how to use technology and how to protect themselves and be safe on the internet. So with that, what can students do? I think something we've been really excited about at EFF is the agency of students. So often recommendations really focus on parents and teachers and administrators, the adults in the room, who should absolutely be protecting students before students have to do anything themselves. But at the same time, students have a lot of agency and can take a lot of control to protect their own data. And it can be as simple as, if you're a tech savvy student or a privacy conscious student, voicing your concerns to your teacher, starting really locally. And it can get as complicated as taking control of your own device or your own account and changing settings. You can find other students who share your concerns and present them to teachers or administrators. And as we're wrapping up, I think we've got five minutes left. We have another question. This one is from Jonathan. He writes, you've addressed data collection and use by corporations and vendors, but what about by schools? Schools now have access to large amounts of data about students and their online behavior, which raises ethical questions for educators. Did you encounter this? Oh, do you want to share your thoughts today? I can talk a little bit about that. So as I'm mentioning, school districts have a unique role in this ecosystem because they are the ones who are incorporating this technology. So a lot of times we've seen, so the document that usually accompanies students using this technology is called an acceptable use policy document. So what we've actually noticed is that a lot of the time schools are using that to enhance their own power. For instance, they're using that to police student conduct outside of the school. We've seen it being used to basically say that as school districts, now we have the ability to monitor student conduct on social networks and things like that. So this actually can be very problematic and school districts do have access to a lot more data about their students than they ever did before. And so to answer your question more specifically, John, then yes, this is something that we've encountered than we've thought about and that's why we kind of push school districts to make sure that they actually do not collect this data. And it can certainly present ethical questions because when it gets to the territory of policing student conduct outside of the school and also it can have a lot of sensitive information, especially if school districts don't teach students about the privacy nature and how they're actually sending this data to a third party to a company which the school district itself may have access to. So yeah, this is definitely an area that we're concerned about. And Jenny, would you like to add to that? Yeah, I think this question also raises a really interesting point, kind of the difference between ed tech company policies and school policies. At EFF we focused mostly on ed tech company policies. That's where we've really put the most of our investigation and research. But at the same time, school policies take on totally different implications once ed tech is in the picture. And often for people on the ground, for students and parents, it's very hard to see the difference between kind of the privacy actions of a school and the privacy actions of a company. So often there's a lot of overlap or kind of the presence of these new ed tech tools really changes the school's responsibilities. Like you said, they're getting more information on students than ever before. With that, I think it's time for us to wrap up. So before we wrap up, we want to let you know that you can find the report on EFF's website. I think we'll, we put a link in the description or in the comments. It's called spying on students, school-issued devices and student privacy. It's in the white paper section of our website. With a cool graphic that you can check out. Yeah. We'll put this video up later on YouTube if you need to refer back to. And remember that you can support our work at EFF. If you like this work and want to see more of it, please consider joining and becoming a member of EFF, becoming one of the many tens of thousands now who is a card carrying EFF member. And with that, I think we're signing off. Yeah. Thank you very much everyone for joining us today. So thanks for watching and bye. Bye bye.