Dive Brief:

• The Children’s Online Privacy Protection Act has a seismic impact on schools, and the Federal Trade Commission, which enforces the law, says that while schools are required to notify parents of students under 13 when commercial businesses or service providers access information about students, the schools can offer consent in lieu of the parents, Education Week reports.
• However, third-party contractors still face tough hurdles and oversight by the FTC, as operators are required “to disclose the existence of any third-party tracking system” utilizing the information, and the agency also stated that “click-wrap” agreements (i.e. long forms asking people to agree by clicking at the end) would not suffice for notification and consent.
• Though COPPA consent can last for a number of years once granted by a school, companies face strict regulations on how a student’s information can be used after that student turns 13, with third-parties not, for example, allowed to combine information about a student prior to that age with information collected after they turn 13.

Dive Insight:

The clarifications around COPPA come amid increased concern among K-12 school districts and higher ed institutions about the safety of their data from hacking and phishing attempts. Higher education, for example, is the second most-vulnerable industry for hacking attempts behind healthcare. As K-12 school districts face their own cybersecurity challenges, it is especially important to be knowledgeable of the third-party businesses that may have access to student information. Particularly if schools are not required to get consent from parents, they must understand who has access, because parents will hold schools accountable in the event of any data breach even if it was the fault of a third party.

When it comes to broader issues of data security among administrators, students and educators, teacher training about best practices to maintain secure data and classroom instruction for students can be beneficial in a variety of ways. Data literacy might make students, teachers and leaders more careful about how and what data they access (and how they are potentially vulnerable). Leaders instilling data security instruction and practices can also introduce K-12 students to a burgeoning field in computer science — one that is struggling to fill a glut of open positions with qualified applicants.