LET'S DIG IN:

ANNOUNCEMENT 1: FTC settlement with edtech company Edmodo has major implications for schools

The settlement has many positive implications for local education agencies (LEAs). It reaffirms that the onus for verifying parental consent for collecting personal data from children should be on edtech providers and not schools. It also pushes companies to have an adequate data retention and deletion policy.

However, LEAs also have significant reasons for concern: the settlement changes COPPA interpretation about whether students can use edtech without LEAs obtaining parental consent. While such use was previously permitted, it now appears that the FTC is changing course by limiting what types of educational institutions can consent to the use of edtech on parents’ behalf. The settlement also raises new questions, such as whether parents could access or delete their child’s information from, for example, a standardized test company, without the school’s knowledge and/or consent.

Remember: COPPA protects data from children who are under age 13 - so any data that is outside that scope is not impacted by this settlement. FTC settlements have become the primary lens through which companies interpret the law; settlements determine how companies interpret and comply with COPPA. Unfortunately, the Edmodo settlement makes this law very convoluted, and will open up major compliance and administrative problems with using edtech in schools.

However, the settlement is not final until it is signed off on by the court. If the FTC and Edmodo mutually agreed on a change to the current text before it is approved, the biggest problem for LEAs–changing the definition of “School” and “School Representative” to include all LEAs–could potentially be fixed.

The settlement likely changes how COPPA works with educational institutions in two major ways:

1. Edmodo - and, therefore, likely all other edtech companies - must obtain either Verifiable Parental Consent–in the school context, this would require parents to opt-in to each and every edtech use–or School Authorization (newly defined term) for the collection and use of student data. “School Authorization” is defined as “a School Representative authorizes an Operator to Collect Personal Information from a Child, on the condition that Personal Information is Collected only for an Educational Purpose and follows the School Representative’s receipt of Direct Notice from the Operator.” School Authorization is only allowed when data will be used exclusively for an educational purpose.

This sounds great! Except when you look at the narrow definitions of “School Representative” and “School.” School is defined as “an institutional day or residential school, including a public school, charter school, or private school, that provides elementary or secondary education, as determined by State law.” A “School Representative” is defined as “a School employee.” Bottom line? These definitions exclude all other LEAs–like districts or education service agencies–that often contract with edtech companies. This settlement says companies must either go through VPC or get School Authorization - and, therefore, companies can probably never receive School Authorization from an LEA other than a school. Instead, companies will likely need to contract individually with each and every school their product will be used in or will be required to obtain COPPA-compliant consent from each and every parent. This is a (likely unintentional) change: the current COPPA FAQs specifically reference school districts contracting with companies. When this settlement is finalized by the court, companies are likely to assume that they can only contract with individual schools, unless additional clarifications are made.

2. To complicate matters, there are new requirements for how an edtech provider must obtain “School Authorization.” School Authorization requires a written agreement (which is good for education stakeholders if the definition of “School” was fixed) that says:

1. Personal information will only be used for educational purposes (this is great!);
2. Describes all Personal information that is collected and how it will be used and disclosed (schools should receive that information!);
3. Provides the School a link to its online notice of information practices and recommends the School make it available on the School’s website (again, a good thing!);
4. Provides that any Personal Information Collected by Defendant is under the Direct Control of the School with regard to its use and maintenance (which will help schools comply better with FERPA!); and
5. Requires a School Representative to acknowledge and agree that they have authority to authorize the Collection of Personal Information from Children on behalf of the School, along with their name and title at the School. (wait a second…)

That last requirement means that Schools will likely need to designate who has the “authority to authorize the Collection of Personal Information from Children on behalf of the School.” Schools should think through who can consent to the use of new edtech (and are required to do so under FERPA), but the specific requirements are a significant change to current practices and will undoubtedly create a large administrative burden. For example, requiring the School Representative’s name and title in the written contract–in addition to their affirmation that they have the “authority”–will be a shift for many schools. LEAs that provide significant leeway in deciding which edtech tools to use will also likely find these requirements particularly problematic.

There are numerous other questions raised by the settlement, including the aforementioned question of whether parents can now access and delete their child’s information from school services like assessment providers. Stay tuned for more analysis on this settlement and potential action steps.

It’s important to remember that this is happening while Congress is considering legislation that dramatically expands COPPA–increasing the age of children who are covered to 17, and covering some information about children, not just information collected from kids–and legislation with new child privacy protections (most prominently the Kids Online Safety Act).

This leads us to our next alert: