Anyone know lots about children’s data privacy rights (Edtech / iPads)

[Plankton89]

Hello,

I have two young DS and they use iPads at school. A lot. They are given 1 to 1 devices from the age of 7 but use them in class a lot from age 4. This appears to include watching YouTube, playing Minecraft and being able to browse the internet on which the filters seem to be fairly feeble (there have been several instances in the class of kids seeing inappropriate stuff). I am raising this issues with the school… but it’s got me thinking about their data privacy. They have logins for several edtech apps that use their first initials and surname… and I have looked at the privacy policies of some of these apps (I found these online myself, the school never even told me what apps they were signing the kids up to never mind sharing the privacy policies with me). The privacy policies clearly say that they may “share” (sell??) the children’s data to third parties for commercial purposes. Not apparently related to the educating of my children but for things like software development , analytics …is this for training AI? is this allowed without my consent ? My children are both young primary age. I’m amazed that the school / local authority are agreeing to this. I am having a look at GDPR regs for children’s data but does anyone else have any knowledge ? I can’t find much discussion in the public domain. Of course I will raise with the school when the kids go back. Thanks in advance.

Have I stated the world’s most boring thread 😂 Surely affects all children currently ?

Not boring but it is midnight! Will be interested to read the responses.

Yeah I really need to go to bed 😂

YANBU at all.

This is and was a concern of mine too. Schools are naive to this.

Privacy notices targeting UK citizens are required to be explicit both about selling and use of AI. I.e. if they are selling data they cannot use the term “share” and if they’re using data for AI they must specify that they are doing so.

at 4 & 7 your DC are too young to have their own accounts so if you didn’t set them up under your own parent account, the school must be running access through their own version (usually Google workspace - although my expertise is on the privacy law not the education piece). This is restricted in terms of what the DC can view but does mean their information (user names, school)is processed.

you need to consider what the risk is. And if that risk bothers you. Personally I’d be comfortable with the processing risk, less comfortable with the use from an educational perspective.

The school should have carried out a data processing impact assessment and you can ask to have sight of it along with their general privacy policies.

I had a row with my daughters school about their use of Google Classroom because the way they configured it also installed a "work profile" that included YouTube... and the work profile bypassed all the screen time controls.

First off all the school denied that it worked like that, then when we proved the work profile was installed by their config they told me I'd given them permission to install it citing a GDPR permission letter they sent a few months earlier.

There were so many issues with the letter (when I read it properly) because they were asking parents to opt out of kids using all these apps rather than opt in (which is a requirement of the regulations).

So then I read all of the Ts & Cs of the various apps the kids were given access to and exactly as you say, they do whatever the hell they like with the data. Also YouTube Ts & Cs say that kids under 13 should not have access, if they do have access then parents remain responsible for the child's use.

I have no idea how schools can possibly reconcile any of this. But when I raised it with them they could not have given less of a shit. They changed the configuration for their Google Classroom so it no longer installs the profile but did nothing AT ALL to remove it from kids' phones. So anyone at the school with an Android phone could still have the work profile.

My dd was watching 2-3 hours of YouTube a day when we thought we had a 60min screen time limit in place. And school... not even slightly interested.

Thank you this is all helpful info. I’ll look at the privacy policy wording again. The individual apps all seem to have their own data processing polices. I do not have parent accounts for any of the apps.

I would be absolutely furious. That’s 3 major areas of concern 1) sharing your child’s personal data, 2) use of screens for learning, and 3) online safety.
My DS is starting school in September and in all the visits we’ve done my questions are all related to the use of iPads for learning- I am so against this and it makes me so angry that we know how bad screens are for kids and somehow have allowed their use in a learning environment? I totally agree there should be strict guidance from local authority on this.

GDPR letter is interesting … we haven’t signed anything like that. Was is some kind of waiver ? edited to add - sorry I have read your post again and see it was an opt out sort of document rather than opt in, I agree that GDPR seems to suggest that parents must effectively (informed / active) consent e.g. opt in

All I signed (upon enrollment) was a form with various permissions and one of tick boxes was “I consent to my child accessing the internet in a safe manner”. Which seems like a bit of a joke now to be honest! Interesting about YouTube as it’s used a lot in my kids class - another thing to add to the list, thank you .

Yes , there are so many separate but intersecting issues. Not to mentione that some of the edtech apps are very video game like and I suspect designed to get children hooked. It’s all quite overwhelming and I don’t know where to start.

Has anyone opted out of the devices and apps all together ? There seem to be so many harms but no proven benefits ?! (Except to the tech companies and their investors who are no doubt raking it in).

I'm so glad my dc finished primary some time ago, I hate the thought of children learn to read at 4/5/6 without being given physical books. Horrid. These ays many schools just tell pupils to read books on iPads.

Sorry, @DancingNotDrowning I have a quick question about the sharing / selling aspect. I understand if an edtech firm are selling data then they need to be explicit about this… So directly selling data for money.

What about if they are “sharing” it as some sort of broader Commercial contract where they are not receiving specific / designated funds in direct exchange for the data… But they are profiting from the contract/business deal overall? Hopefully I’ve explained that well enough (sorry, children asking me questions every three seconds)). I’m just wondering if they need to use the word “selling” in this set of circumstances or if they could wriggle out of it. From what I have seen these agreements seem to be extremely opaque but then I am not a lawyer.

So you need to look at the school policies first. If they are providing the logins and the service then they are the data controllers. So your first recourse is to ask them for their policies and see what they say. My DS old school was actually really hot on all this stuff and was very clear about blocking stuff on school WiFi etc and made it clear that if we put a SIM in their laptop (secondary school) then school could not be responsible for what they accessed whereas on the school WiFi they could block sites etc.
At primary the kids cannot consent so you need to be asking them to show you what safeguards they have in place and you can also ask them for copies or details of the licensing agreements with the software suppliers. This may reassure you that they've opted out of data being used for other purposes or reinforce your research !

Thanks @Whyherewego

@Plankton89I’m not sure what scenario you’re imagining so it’s difficult to give a clear answer, that said a notice should be transparent and provide an accurate reflection of processing activities.

in this context sharing almost certainly means shared with third party (and other group entities) exclusively to run and secure the platform (YouTube/minecraft). This is because some elements of those services may be provided by a third party and therefore require the data being processed by that third party (i.e. malware prevention, cloud services etc)

I would say there is a pretty much zero.zero zero risk of YouTube or Minecraft passing your child’s data on to third parties for purposes you wouldn’t happily agree to.

do you have a concern that something is specific is happening that shouldn’t from a privacy perspective? Or are you just broadly concerned about his email being shared?

as @Whyherewegosays the school are the data controller in these circumstances and should be your first port of call, however the school do not need consent and are likely relying on legitimate interests.

IME most small organisations - schools included - are woefully underprepared to deal with these sorts of issues so I’d encourage you to be very precise about what your concern is and how you want it remedied.

Not sure about the data privacy issue, but a really good point.

More generally I’d be appalled by this use of tech with such young kids and complete naïvety about the settings. No way would I agree this. I have a y5, they didn’t really use any apps at all until y3. Nothing involving you tube or Minecraft though, no way.

I allow them to use the maths one for homework as it seems fairly innocuous. I refuse the English one and the times table one for the most part, they are gamified and I refuse to believe are any more helpful for kids than their lessons and reading. I always check at the start of the year and the teachers haven’t minded so far, however it could be tough if your child finds school work a challenge. Suspect the current teacher agrees with me.

If they use a bit of them at school it’s not the end of the world, but no way are we adding to it.

I did get quite cross when they made the kids sign up for a coding app. Full messaging service with profiles and full of games. It was clearly done with zero awareness. Some of the kids are constantly on it. I hate it. Will resist it all as long as possible.

I found this petition if anybody would like to sign it ! It’s about edtech in schools.

https://petition.parliament.uk/petitions/746235