Skip to Content

Student digital privacy concerns drive Capitol Hill legislation

March 23, 2015

Several efforts in Washington are converging on the sensitive question of how best to safeguard the information software programs are gathering on students.

A proposed Student Digital Privacy and Parental Rights Act of 2015 is circulating in draft form. It has bipartisan sponsorship from Democratic Rep. Jared S. Polis of Colorado and Republican Rep. Luke Messer of Indiana.

Drafted with White House input, the bill joins a previous Senate proposal, plus much action on the state level, from regulators, and from industry and other sector leaders.

Consumer groups like Common Sense Media and companies like Microsoft have spoken positively of the bill.

But some student-privacy advocates are saying it doesn’t go far enough in restricting what private companies can do with student data.

“It is a start to try to get at a very complex issue,” says Elana Zeide, an expert on student privacy at the Information Law Institute of New York University, who saw an earlier draft of the bill. “But it’s not going to satisfy a lot of parent advocates, because it leaves a lot of discretion to schools and companies.”

Mike Goldstein works with education clients at the law firm Cooley. He says there’s been an “explosion” of interest in privacy issues over the past five years. Technological advances have schools and universities outsourcing many more basic functions than in years past. Everything from gradebooks to tests to entire academic programs, he adds, is being handled by third-party, for-profit providers.

And these providers are capturing far more than names, addresses and end-of-term grades. In some cases, large amounts of student work, and literally millions of tiny interactions, are collected and stored in the cloud. Think of all the edits on a school paper written in Google Docs. Or all the interactions a student has with a Khan Academy math program.

The major federal student privacy law on the books, FERPA, doesn’t have much to say about this avalanche of data. That’s because it deals mainly with the security of basic demographic information collected and held by schools themselves. “There’s been a shift in focus in terms of privacy laws and regulations affecting both schools and colleges — from a focus on what the schools do, to what providers do,” says Goldstein.

In order to understand this issue, Goldstein and Zeide say, it’s important to separate out several distinct, but related, concerns that fall under the broad umbrella of student privacy.

1) SECURITY My child’s information will be stolen and misused by hackers. She will be a victim of identity theft or her information will be exposed in an accidental data breach.

Setting rules about how long data can be stored, and who can access it, helps security. The draft House bill contains some broad security provisions, but security, says Zeide, is also determined by good training and protocols, not just regulation.

2) TRANSPARENCY My child’s information is being collected, circulated, stored and shared, but I don’t know where or by whom or why. I won’t be informed if there’s a data breach.

This bill includes some provisions on disclosure and parental notification.

3) COMMERCIALIZATION My child’s information will be used to target online advertising or otherwise exploited for commercial gain. My child will be marketed to while she’s doing her homework — or her homework will be used to sell things to other students.

This is where the House bill focuses. It would prohibit the sale of student information and the targeting of advertising based on a profile of a student assembled over time. It contains an exception, though, meant for companies like The College Board, which sell information on students who take the SAT to colleges, which is then used to target scholarship offers.


My child’s information will be “out there,” discoverable in the ether somewhere. Her youthful mistakes and foibles, her low-income or English-language-learner status will follow her around. One day, her “permanent record” could limit her options.

These “reputational” issues are much more complicated than the rest. They cover not only privacy, as it’s been discussed here, but related situations, like the recent reports of Pearson monitoring public posts on social media for mentions of the PARCC test by students. One day, student data could start to wield reputational power similar to what a bad credit record does for adults: It could limit your ability to get a job, not just your access to credit.

“There’s a whole other set of more difficult, deeply troubling concerns about the use of information for educational purposes,” that aren’t addressed in the new bill –or in most of the proposals out there, Zeide says. “There are harms that can happen regardless of intent.”

Copyright 2015 NPR. To see more, visit

You Care.

You are one of the CPR readers who wants to know what is really going on these days. We can help you keep up - The Lookout is a free, daily email newsletter with news and happenings from all over Colorado. Sign up here and we will see you in the morning!

CPR Podcast Explores Police Reform

Logo for Systemic - Silence Is Not An Option

Systemic is a new podcast taking an innovative look at those working to reform policing from inside and outside the system.

Listen to the four-part audio documentary — out now.

CPR Classical's Summerfest

Logo for Summerfest

Let CPR Classical take you to some of the most breathtaking mountains, valleys and towns in Colorado this summer from the comfort of your own home with Summerfest 2021. There’s no better way to tour the state than through the gorgeous sounds of world-class music at Colorado’s wide array of outdoor and state-of-the-art venues.

Sign Up For Our Newsletters

It takes a good day’s drive to cover Colorado, but we’ll help you do it in a few minutes. Our newsletters bring you a closer look at the stories that affect you and the music that inspires you.