This year, the media has exposed — and the government, including through guidance issued by the F.B.I. has begun to address — a string of harms to individual privacy by the technology sector’s leading firms. But policymakers must intervene specifically to protect the most precious and vulnerable people in our society: children. Their behavioral data is continuously suctioned up by technology firms through tablets, smartphones and computers and is at risk of being misused.
For many American children, going to school means handing over personal data. The Summit “personalized learning” educational tool — a platform for online lessons and assessments that was developed by a charter school network with the help of Facebook engineers and is backed by the Chan Zuckerberg Initiative — has been criticized for asking parents to consent to sharing their children’s personal data, including their names, internet activity and grades. Google has vastly expanded its reach into America’s schools as more than half of students use its Gmail and Docs apps, and a majority of mobile devices shipped to schools are Chromebooks. Should the tremendous amounts of data underlying the operation of these kinds of services get into the wrong hands, our children’s futures could be at stake.
Concerns over illegitimate sharing of and access to student data have been raised by parent groups, consumer watchdogs, and privacy advocates, many of whom have begun public awareness campaigns and legal battles. They’re rightly worried, for example, about the fairness of college admissions processes that rely on student data profiles shared by personalized learning companies. Similarly, parents are concerned about the dispensation of financial awards including scholarships that are influenced by data that children have provided in surveys. In some cases the information doesn’t include just things like grades and test scores but also covers categories like race, religion, address and whether they have “impairments” like H.I.V. or depression.
In 2014, inBloom, a nonprofit that offered to warehouse and manage student data for public school districts, announced that it would shut down, after parents objected to 400 categories of information, including children’s reasons for absences and sensitive family relationships, being included in its database.
Beyond the collection of our children’s education-related data, we don’t want industry behemoths to profile our children and target them with advertisements and shady content. We don’t want children to fear that anything they say or do online could be used against them someday. And we don’t want technology companies to compete for our children’s attention just so that they can claim their loyalties when they come of age to join a social media network, choose an email provider or purchase their first cellphones. It is not just about the protection of data; it is a matter of letting children learn and grow without concern about how their early preferences, talents and habits could shape the opportunities they have in the future.
But laws in the United States offer students very little digital privacy or security protection against the wiles of the industry.
Wherever the rules are muddy for the industry, we should make them resoundingly clear in such a way that protects our children and, implicitly, our national interest. If we have learned anything about Silicon Valley this year, it is that we cannot sit back and wait for the industry to voluntarily act on behalf of children; our government must intervene before more harm comes to them.
Tech companies should not be permitted to collect data on children and profile them using their personal data without a parent or guardian’s meaningful consent to the data collection. In an educational setting, in which children might be denied the ability to participate in certain learning activities if their parents object, meaningful consent is a often simply not possible. They should not be allowed to market products to a child based on inferences about the child’s behaviors, preferences, beliefs or interests, and they should not be allowed to sell or share a child’s personal data to a third party under any circumstances. These protections, must be brought to every child in America.
We don’t have to start from scratch. In 2014, Gov. Jerry Brown of California signed into law an important piece of legislation to protect children’s privacy. Months later, President Obama pushed to federalize a similar approach through his announcement of the Student Digital Privacy Act. That bill, the culmination of years of advocacy and conversation, gained bipartisan support in the House and the Senate — but it continues to languish in Congress largely because of industry attempts to water it down. Another recent effort deserving broader support is the Do Not Track Kids bill, which too gained strong bipartisan support and would prohibit behavioral advertising targeted to children under the age of 13 — but the political impetus behind it has also fallen off in recent months.
National policymakers should act more decisively. They should reignite efforts in the House and Senate to federalize the California law, and we should tack on the additional measures proposed in the Do Not Track Kids bill. They should assure that industry efforts to encourage passage of a weak federal privacy law do not interfere with efforts made by state legislatures to protect students. More broadly, we cannot allow the industry to overtake the American classroom. The alternative — to enable commerce to rule the classroom — can only spell danger to the long-term educational interests of our children.
Dipayan Ghosh is a fellow at the Shorenstein Center at the Harvard Kennedy School. Jim Steyer is the chief executive and founder of Common Sense Media, a nonprofit organization devoted to improving media and entertainment for families.