The Washington PostDemocracy Dies in Darkness

Is New York state about to gut its student data privacy law?


The ever-growing use of technology by schools, districts and states around the country to collect data on students continues to fuel concerns about the security of that information. Some states have passed laws to protect such information from being sold to third parties, but there is a huge, lucrative market for student data.

New York state has a student privacy law, but the Board of Regents is considering whether to significantly weaken it. The post below looks at the problem in New York and elsewhere.

It was written by Leonie Haimson, executive director of Class Size Matters, a nonprofit based in New York City, and the co-chair of the national Parent Coalition for Student Privacy, a national alliance of parents and advocates defending the rights of parents and students to protect their data. She successfully led the battle to stop nine states from disclosing personal student data to a student database project called inBloom.

ACT and the College Board were asked about comments in the story about selling student data to third parties. Their responses follow Haimson's piece.

The astonishing amount of data being collected about your children

By Leonie Haimson

The New York Board of Regents is currently considering whether to approve a radical weakening of the state student privacy law, which would allow the College Board, the ACT and other companies that contract with schools or districts to administer tests to use the personal student information they collect for marketing purposes — even though the original New York law that was passed in 2014 explicitly barred the sale or commercial use of this data.

Starting in 2014, many states, including New York, approved legislation to strengthen the protection of student privacy, because of a growing realization on the part of parents that their children’s personal data was being shared by schools and districts with a wide variety of private companies and organizations without their knowledge or consent. The U.S. Department of Education had weakened the federal student privacy law known as FERPA (Family Educational Rights and Privacy Act) twice over the past decade, rewriting the regulations during the Bush and Obama administrations to allow for nonconsensual disclosures for different purposes.

At that time, few parents knew that federal law had been altered to allow their children’s information from being passed into private hands. Then controversy erupted over the plans of nine states and districts to share personal student data with a comprehensive databank called inBloom, developed with more than $100 million of funding from the Gates Foundation.

InBloom Inc. was designed to collect a wide variety of personal student data and share it with for-profit vendors to accelerate the development and marketing of the education technology industry to facilitate the adoption of online instruction and assessment. As a result of widespread parental activism and concerns, all nine states and districts that had originally intended to participate in the inBloom data-sharing plan pulled out, and 99 new state student privacy laws were passed across the country between 2014 and 2018.

New York was one of the first to pass a new student privacy law. In March 2014, the state legislature approved Education Laws §2-c and §2-d, which among other things, prohibited the state from sharing student data with inBloom or another comprehensive databank, and also regulated the way schools and vendors must secure student data, including imposing a complete ban on the sale of personal student information or its use for marketing purposes.

As a result of these provisions, New York received a grade of A- in the category of “Limitations on the Commercial Use of Data” in our State Student Privacy Report Card, released in January by the Parent Coalition for Student Privacy, which I co-chair, and the advocacy group Network for Public Education. In turn, this high mark raised New York’s overall grade for protecting student privacy in our rating system to B-, the second-highest grade of any state after Colorado. (You can check out the interactive map that grades the 50 states on its student privacy laws, overall and in seven different categories).

Yet to the frustration of many parents and privacy advocates, it would be nearly five years before New York State Education Department drafted any regulations to implement its 2014 student privacy law. In October 2018, the Education Department finally released proposed regulations for public comment. In March 2018, the Parent Coalition for Student Privacy, along with the statewide coalition New York State Allies for Public Education, submitted recommendations on how to strengthen and clarify those regulations, as did more than 240 parents and privacy advocates.

Yet after the initial period of public comment had ended, instead of strengthening the regulations, the state Education Department gutted them, and now proposed allowing student data to be used for commercial purposes as long as there was parental “consent” — a huge loophole that would create the opportunity for districts, schools and vendors to misuse this data in myriad ways.

In their rationale to the Board of Regents, posted here, department officials were frank about their reasons for revising the proposed regulations in this way: to allow the College Board and ACT to offer “college search services to students and parents who consent to the release of college entrance test data to colleges and higher education institutions by college admissions testing companies.”

Yet the College Board and ACT do not just share the test score data in the ordinary ways that parents expect, that is, send these scores to whatever specific colleges that their children have applied to attend. They also sell personal student data to many unspecified organizations and institutions which then resell it to unscrupulous for-profit companies.

In particular, the College Board makes a great deal of money from marketing personal student data through its “Student Search Service.” Much of this confidential data is harvested through surveys administered to students right before they take the PSATs and SATs, or when they register for the test online, a practice that we have written about previously and more recently has been criticized by the U.S. Department of Education.

U.S. Education Department warns school districts to protect student privacy for SAT and ACT

In May 2018, the Privacy Technical Assistance Center of the U.S. Department of Education released guidance that if states and districts contract with the College Board or ACT to give these exams to students, as is increasingly the case across the country including in New York City, they may be violating federal privacy laws in several different ways.

First of all, as officials from the assistance center pointed out, the supposedly “voluntary” surveys given to students before taking the PSAT or SAT may include questions relating to highly sensitive issues including their religion, grade point averages and/or family income. Often, it’s not clear to these students that they have a choice not to offer this information, and because they are already feeling high levels of anxiety before taking these exams, they may feel pressured to do so.

They are not told that the data is sold at a profit by the College Board. In any case, some questions relating to sensitive issues cannot be asked legally of students who are under 18 without the prior notification and opt-out or consent of their parents, according to the federal law known as the Protection of Pupil Rights Amendment.

As the assistance center’s guidance document also makes clear: “The testing companies then sell [personal student] information to colleges, universities, scholarship services, and other organizations for college recruitment and scholarship solicitation.” If students are asked to take these exams by their districts, and the data is offered to third parties without explicit parental consent, this widespread practice may violate both FERPA and IDEA, the Individuals with Disabilities Education Act, the latter which has special provisions to protect the private data of students with disabilities.

In addition, the College Board sends conflicting messages about whether this data is actually sold. In the College Board privacy policy for the “Student Search Service,” it falsely reassures parents, “The College Board does not sell student information.

Yet on another page on their website, it hedges this claim by saying it doesn’t “sell information about participating students to any third party without the student’s permission.” (Never mind that many of these students have not yet reached the age of consent.)

On still another page on its website designed for potential commercial customers, the purchase price of this data is made clear: 47 cents per student name.

The College Board is also contradictory at times about what specific student data is shared with third parties through its “Student Search Service.” On its privacy policy page, it says the data may relate to the students’ “academic and extracurricular interests, career and field of study interests, family income, and religious preferences.”

A longer and more specific list of data is listed on the Student Search Web page, revealing that, depending on the test taken, it may include student email addresses, ethnicity, GPA, sports or “educational aspirations.” On that same page, the College Board affirms that “we never share” information through this service relating to a student’s “disability status, self-reported parental income, Social security number, phone numbers, or actual test scores.”

Parents are forced to dig even deeper into a SAT registration booklet, to discover that while their child’s “actual test scores” may not be sold to third parties, “Colleges participating in Student Search … can ask for names of students within certain score ranges [emphasis mine].”

So, unknowingly, students who are asked to answer questions from a survey before the administration of these exams may at the same time be unknowingly giving their permission to sell their data to a variety of institutions and organizations, who in turn, may then re-disclose the data to other organizations and/or for-profit companies.

In July 2018, in an explosive article entitled “For Sale: Survey Data on Millions of High School Students,” the New York Times exposed how the College Board sells the personal information it collects via these surveys to various “partners,” who in turn may resell the data to for-profit companies, allowing them to use the information to market their dubious products and services to unsuspecting families.

The article described how thousands of students attended a “Congress of Future Science and Technology Leaders” costing $985, run by the for-profit National Leadership Academies. The company had bought their names and other data from an unnamed university, which in turn had purchased it from the College Board: “In filling out those surveys, the teenagers ended up signing away personal details that were later sold and shared with the future scientists event.” Once the data is sold by the College Board, it is nearly impossible to monitor any other use or re-disclosures of the data.

There are also issues with ACT and what personal student data is collected and sold to colleges and other third parties through the survey on the online ACT Student Profile Section that students are asked to voluntarily fill out when registering or before taking the exam.

A class-action lawsuit was filed in August 2018 in U.S. District Court in Los Angeles alleging that ACT identified student disability status through this information on the score reports sent to colleges and sold this information to colleges and other third parties. In a recent legal filing, ACT informed the court that it will no longer sell student disability status in the data collected voluntarily by students, but refused to admit to flagging its regular score reports with this information.

As Joel Reidenberg, a professor at the Fordham University School of Law, head of the Center on Law and Information Policy, told the New York Times in 2018: “The harm is that these children are being profiled, stereotyped, and their data profiles are being traded commercially for all sorts of uses — including attempts to manipulate them and their families.”

A research report co-written by Reidenberg found that there exists a thriving marketplace in student data, in which brokers offer a wide variety of sensitive student information for sale, including their ethnicity, income, religion, and interests, and that this data could “be used for a range of malicious purposes, including discrimination and identity theft.”

In 2014, after both New York and California passed laws prohibiting the selling of personal student data or their use for any commercial purposes, the College Board and the ACT and/or their allies realized how these laws represented a severe threat to their thriving business in student data. In Colorado, the College Board pushed to persuade legislators to provide a special exemption from the law for their benefit — to allow school vendors to “sell, rent, or trade” personal student information for the “purpose of providing the student with information about employment, educational scholarship, financial aid, or postsecondary educational opportunities ” — as long as parents or students over the age of thirteen gave their consent.

In Arizona, Nebraska, North Carolina, Texas and the District of Columbia, student privacy laws incorporated these exemptions to allow the College Board and ACT to continue selling personal data for these purposes.

Now, these organizations and/or their allies have apparently persuaded the New York State Department of Education to rewrite its state law, by creating an expansive new loophole that would allow these practices to continue, by redefining the term “marketing” in the following way:

“Where a parent or eligible student requests a service or product from a third-party contractor and provides express consent to the use or disclosure of personally identifiable information by the third-party contractor for purposes of providing the requested product or service, such use by the third-party contractor shall not be deemed a marketing or commercial purpose prohibited by this Part.”

As the Parent Coalition for Student Privacy and the New York State Allies for Public Education wrote in a letter to the state Education Department after the new draft regulations were revealed:

“To create a new, huge loophole in the law that would allow the College Board, ACT or any other contractor or subcontractor to sell student data and/or use it for marketing purposes, by making the untenable claim that such sale or marketing purpose is not truly marketing if there is consent, is a drastic weakening of the law which should NOT be contemplated….
If the College Board lobbyists or its supporters would like to eliminate the prohibition of the sale or marketing of student personal data in the law, they should go to the Legislature and ask that it be amended. This should not be done through regulations or by attempting to redefine the meaning of the term “marketing.”

In fact this loophole could benefit many other vendors, and even perhaps schools or districts that may want to profit off the use of student data, by asking for parental or student consent in surreptitious ways, for example requesting that they click on a button to signal their “consent” without carefully reading the privacy policy.

Even if students or their parents knowingly consented to the initial marketing use or sale of the data, once the transfer of information has occurred, it is nearly impossible to track how it will be commercialized from that time on.

Student privacy advocates oppose this wholesale rewriting and evisceration of the New York student privacy law. The deadline on public comment on the new regulations is Sept. 16, and the Board of Regents will be voting on the new regulations during their monthly meeting in October.

Comments on the regulations can be sent by clicking here or writing to Regents members should know that the proposed regulations would violate the original intent of the law, and would open a Pandora’s box of an unfettered marketplace of personal student data, with potentially damaging results.


ACT and the College Board were asked about policies on the sale of student data, and here are their responses:

This is from Ed Colby, spokesman for ACT:

ACT is committed to the appropriate use of information obtained through assessments that we administer. We share the public’s concern that assessments be used appropriately, and we recognize the importance of encouraging the appropriate use of assessment information in decision making.
We operate within a framework of policies and procedures designed to ensure delivery of high-quality programs and services and protect the privacy of the data we collect. We review our programs and services to confirm that they are consistent with the standards expressed in the current versions of the Code of Fair Testing Practices in Education prepared by the Joint Committee on Testing Practices, the Code of Professional Responsibilities in Educational Measurement prepared by the National Council on Measurement in Education, and the Standards for Educational and Psychological Testing prepared by the American Educational Research Association, American Psychological Association, and National Council on Measurement and Education.
ACT’s general policy is to provide individually identifiable information to a third party only at the direction of the individual or after the individual has been provided notice and an opportunity to opt out of such sharing. Our privacy policy is posted on our website and provides important information on the data examinees provide: [] [].
ACT’s Educational Opportunity Service (EOS) and Encoura, a matching program operated by ACT’s NRCCUA subsidiary, are college and scholarship information services designed to benefit students and colleges. Through EOS and Encoura, students receive information about colleges and programs that might be of interest to them, as well as college scholarship and financial aid opportunities. Colleges use EOS and Encoura information to reach out to students who best match and might be interested in the particular programs they offer on their campuses. The goal is to provide the best opportunities for the student.
We sell student names and selected information through EOS and Encoura only if a student authorizes us to do so by opting in and only to colleges and organizations that provide educational, scholarship, career, or financial aid opportunities – mostly colleges. ACT does not sell student information to companies for marketing purposes.

Zachary Goldberg, spokesman for the College Board, said:

Thanks again for the opportunity to share some background on Student Search Service, including clarifying that we don’t sell names, but license them under strict licensing agreements with colleges, scholarship partners and non-profit organizations.
Student Search Service gives students the opportunity to start the important conversations with colleges and scholarship organizations and explore their options. Search helps launch a student’s future, connecting students with college and scholarship opportunities at the time when they begin thinking about postsecondary education, so they have time to get to know various colleges and make informed college choices.
Search is a voluntary and free program for students. Students must affirmatively declare their desire to begin a conversation with colleges and scholarship providers. Students can opt-out of Search at any time. Since 1972, the College Board has worked with educational organizations to inform students and their families about available programs, admissions information, financial aid processes, and other opportunities. At the same time, we have been and remain committed to protecting student privacy. To participate in Student Search, colleges, universities, and scholarship organizations must agree to licensing agreements by which they:
* Adhere to strict rules that require student data only be used for non-commercial, education purposes;
*Agree not to share student information with third parties; and
*Destroy the data once the agreement expires.
We are transparent and consistent about what Search is and how it works: []
Students and their families need information to help them navigate the winding and complicated path to college and career. Student Search fills that need, providing information that can support their transition to college, particularly for historically underrepresented student populations who are already disproportionately unlikely to apply, enroll, and graduate from college.
New research shows that students whose names are shared with colleges and universities for direct outreach are 12% more likely to enroll in a four-year college compared to identical students who do not participate. Looking at the research another way, the probability of a student sending their SAT score to an institution goes up 23% when that that college can see a student through Search, and that increases dramatically for underrepresented students:
** African American students (46%)
** First-Generation students (49%)
**Low-income students (42%)
We work with our partners to protect student privacy and to ensure that students are connected to information on post-secondary options and scholarship opportunities that can help reduce the cost of college.

And he said:

Effective July 2018, the College Board restructured student information usage agreements with the small number of higher education organizations that shared that information with their affiliated educational programs. As a matter of policy, the College Board maintains a direct relationship with and oversight of all organizations using College Board-sourced student data. They are not able to re-license, sell or otherwise repurpose.