The Washington PostDemocracy Dies in Darkness

How the SAT and PSAT collect personal data on students — and what the College Board does with it

Placeholder while article actions load

If your child takes the SAT or PSAT, is his or her personal information being collected, profiled, licensed and sold?

That is the question that Cheri Kiesecker, Colorado parent and member of the Parent Coalition for Student Privacy, asks and attempts to answer in the following important post. The Parent Coalition for Student Privacy is a national alliance of parents and advocates defending the rights of parents and students to protect their data.

The SAT has traditionally been used as a college entrance exam but it, and the ACT, also a college entrance exam, are increasingly being used as high school tests. In fact, 25 states now require that high school students take them for school accountability and other purposes, Education Week reported here.

The protection of personal data is in the news with the recent passage by Congress of legislation that eliminates landmark online privacy protections established by the Obama administration. It removes limits that had been placed on Internet service providers —  such as AT&T, Comcast and Verizon — on how they can use data they collect on their customers, including browsing habits and Social Security numbers. Privacy advocates are especially concerned with how this will affect young people.

The House just voted to wipe away the FCC’s landmark Internet privacy protections

Here’s the post by Kiesecker, and following it is a response from the College Board, which owns the SAT and the PSAT exams.

By Cheri Kiesecker

 In schools all over the country, middle and high school students will soon take PSAT and SAT assessments. I’m a parent and after my child’s class was asked to take the PSAT 8/9 (given to eighth and ninth graders) this past October, I discovered that the College Board, owner of these assessments, solicits personal information from each student without parental consent.

Several weeks after the test, the College Board returned the completed PSAT answer sheets and test booklets to students once the exam had been scored and recorded. I was surprised to learn that the PSAT 8/9 answer sheet begins by asking many very personal questions of each student; though nowhere on the form or booklet does it say these questions are optional.

The PSAT 8/9 instructions printed on the answer sheet said only this:

  • Use a Number 2 pencil only. Print the requested information in the boxes for each item.
  • Fill in the matching circle below what you write in each box. Erase errors completely.
  • In very fine print, at the top of Page 4 on the answer sheet, it states:                                                                                                              “QUESTIONS TO HELP THE COLLEGE BOARD HELP YOU — Your answers to the following questions will help the College Board ensure that tests and service are fair and useful to all students. Your responses may be used for research purposes and may be shared with your high school, school district and state.”

The answer sheet had spaces for the student’s name, grade level, sex, date of birth, student ID number or Social Security number, race/ethnic group, military relation, home address, email address, mobile phone,  grade point average, courses taken, and parents’ highest level of education.

The astonishing amount of data being collected about your children

If parents or students were to take it upon themselves to peruse the College Board website, they would find a page which urges students to participate in the College Board’s Student Search Service. See the table below for a list of the data that is potentially collected and shared, depending on the specific College Board assessment — SAT, PSAT or Advanced Placement.   Many of these questions are also asked of students right before they take the exam, as part of the Student Data Questionnaire.

(Correction: 25 states now use the SAT and ACT for accountability and other purposes)

As you can see, among students’ personal information collected and possibly sold includes citizenship — a particular concern given the increased risk that undocumented students may be identified and targeted by immigration officials. In New York City, apparently because of these concerns, public schools that are administering the SAT have now been alerted not to include the Student Questionnaire as part of the test.

After searching the College Board website, I contacted the College Board and asked why students are being asked about their family’s race, religion or military background. What does the College Board do with this personal data? Who specifically do they share data with? You can see my questions and the confusing and evasive response from the College Board here.

It took the College Board over three months to answer. Additionally, my immediate follow up questions sent two months ago, which include asking whether they sell student data and whether it is required for students to provide their religion, are still unanswered.

In their January response, the College Board claimed that students were told which questions were optional and that students had given “express consent” to share this information. In actuality, after talking to students, parents, and administrators at the school, it was clear they were unaware that these questions were optional. Additionally, Colorado law says students must be at least 18 years old to consent to the use, sharing, or retention of their personally identifiable information.

Neither the PSAT 8/9 answer sheet or test booklet informed students that most of these questions were optional, or distinguished them from the obligatory questions, demanding they fill out their name, school, etc. In fact, the “optional” questions are not identified in the PSAT 8/9 Supervisor Manual or the script which proctors are instructed to follow.

However, according to the College Board’s response to my query, only the first five questions on the answer sheet are obligatory, including student name, grade level, sex, date of birth, and student ID number. The remainder of personal questions, including race, religion, military background, GPA, home address, phone, etc. are optional.

When sitting down to take this high-stakes test, how is a student able to know which questions are considered voluntary if this is not clearly marked or communicated? With the answer sheet instructions stating to fill in every box, students tend to follow suit, fearing that an incomplete answer sheet could render their scores invalid. Why does the College Board even have a space for a student’s social security number in place of student ID number, when most states forbid using social security numbers as primary identifiers? Why aren’t parents asked for consent before information about their child’s attitudes, religion and race are collected and apparently shared, accessed by outside organizations via purchased license according to the College Board website?

Under federal Protection of Pupil Rights Amendment, sensitive questions such as religion or income require prior informed parental consent.

Remarkably, there is no federal law prohibiting the sale of personal student data. However, there is a self-policed software industry privacy pledge in which signers promise not to sell a student’s personal information. The College Board has signed this pledge.

In addition, like many other states that have recently enacted student data privacy laws, Colorado’s student data transparency and security law also prohibits vendors from selling personal student data except in the case of a merger or acquisition. Accordingly, the amended contract between the state of Colorado and the College Board for SAT and PSAT 10 (the PSAT for 10th graders) expressly says that the “contractor shall not knowingly….License or sell Covered Information, including PII  to any third party.” PII means personally identifiable information.

Consider the astonishing amount of data collected on students today. In particular, think of the data collected and analyzed when students take a college entrance assessment. Many states now require high school students to take the SAT in eleventh grade. Some states, districts, or individual schools require students to take the PSAT assessment in eighth, ninth or tenth grades in hopes of improving their scores later on the SAT.

However, what many parents and schools do not know is that their student’s personal data, including “geographic, attitudinal and behavioral information” can be profiled and accessed by organizations via a license they purchase from the College Board. Yet the College Board’s privacy policy to parents and students claims they do not sell student data. Rather, they sell a license to access a student’s personal data. What is the difference? Indeed, this distinction seems only semantical.

The College Board sells licenses to access the data through a tagging service called College Board Search. The Segment Analysis Service™ is one of three featured tools of the Search, along with the Enrollment Planning Service™, and the Student Search Service®. These are “enhanced tools for smart recruitment.” The College Board’s Authorized Usage Policies states, “Student Search Service in connection with a legally valid program that takes such characteristics into account in furtherance of attaining a diverse student body.”

The pricing for the College Board Search student data tagging service is $0.42 cents per student, and allows college admission professionals to identify prospective students based on factors such as zip code and race and to Leverage profiles of College Board test-takers for all states, geomarkets, and high schools.”

Segment Analysis Services is “for admission offices that need market and attitudinal information early in the recruitment process in order to better segment and target the admission pool,” and “Use Educational Neighborhood and High School Clusters as criteria when licensing names with Student Search Service, Access individual cluster factor scores. Tag an unlimited number of files…”

Which organizations buy personal student data licenses from the College Board? They are not listed anywhere on the website. A New York Civil Liberties Union fact sheet reveals that the Department of Defense is among the institutions which buys student data for recruiting purposes.

The College Board, ostensibly a non-profit, had $77 million in profits and $834 million in net assets in 2015,  according to Reuters. How much of that income  was garnered through the licensing of student data?

Why is the College Board allowed to share personal student data through the Student Search Service, in which companies are charged via a “license agreement” if this is specifically prohibited by Colorado law?

Is the College Board selling personal student data in other states, through their “license” agreements, despite having signed the student privacy pledge?

 Interestingly, since I’ve started asking questions to the College Board and the state, the College Board recently sent home Student Data Consent Forms for the PSAT 10 and SAT to some Colorado families the week of March 6, 2017. This is a good first step and should have been done prior to students taking the PSAT 8/9 assessment last fall.

However, there is no parent signature required on these new consent forms. Why is the College Board still asking for consent from a minor student and not the parent?

Here is an excerpt of the new SAT consent form sent home to Colorado students:

The SAT Student Data Questionnaire asks students about their personal attitudes and interests.

The Colorado contract with the College Board for SAT and PSAT10 states the following about this Student Descriptive Questionnaire:

Curiously,  the SAT Consent Form links to instructions for the College Board’s Student Data Questionnaire which say, “The data you provide will be added to your College Board student record, even if you choose to not participate in Student Search Service.” What personal information is being “added” to a student’s record and what is the purpose? Can that information still be licensed and shared?

As reported by independent consultant Nancy Griesemer in 2015, ACT also has a lengthy pre-test survey that collects personal data from students which, combined with other data, is being used by colleges and universities to assess the student’s “Overall GPA Chances of Success” in various majors and courses, measured in terms of likely to receive “B” or “C” or in these areas. You can see what these scores look like on this updated sample ACT report. (Notice this ACT report also includes the student’s citizenship status.)

As discussed in The Washington Post last year, there’s still a lot students and parents need to know about how data is collected, shared, and accessed via licenses sold. And as Politico reported in 2014:

“Many kids also put their personal profiles on the market — whether they realize it or not — when they take college entrance exams. Students taking the SAT, ACT, Advanced Placement exams and other standardized tests are asked to check off a box if they want to receive information from colleges or scholarship organizations. Depending on the exam, at least 65 percent — and as many as 85 percent — of test takers check that box, according to the College Board and ACT. That consent allows the College Board and ACT, both nonprofits, to market students’ personal profiles…”

That struck me as almost predatory, playing on students’ hopes and fears by having them surrender their personal data. So, I wrote to the College Board and asked this: “What happens if students do NOT give their data to Student Search? Will this limit their ability to get into colleges? Will they still be considered for scholarships?

The answer from the College Board is important for every student, parent and school administrator to hear: “If a student does not opt in to Student Search Service it will not impact their chances at being accepted into colleges or scholarship programs in any way.”   This should be printed on instructions, every test booklet, and website.

My experiences as a Colorado parent show that this frustrating lack of transparency still exists today. And it’s getting worse as  data and algorithms are being increasingly used to make decisions about students’ lives, without their knowledge. These algorithms can analyze and recombine data to make predictions about their futures. As an article in “Fast Company” reveals, students’ data footprints are affecting their lives in ways they can’t even imagine:

“…Even major life decisions like college admissions and hiring are being affected. You might think that a college is considering you on your merits, and while that’s mostly true, it’s not entirely. Pressured to improve their rankings, colleges are very interested in increasing their graduation rates and the percentage of admitted students who enroll. They have now have developed statistical programs to pick students who will do well on these measures. These programs may take into account obvious factors like grades, but also surprising factors like their sex, race, and behavior on social media accounts. If your demographic factors or social media presence happen to doom you, you may find it harder to get into school—and not know why.”

Despite much opposition, a 2011  regulatory change to the Family Educational Rights and Privacy Act, FERPA,  weakened this federal law that once protected student information from being shared without consent.  FERPA needs to be fixed and parents need to be given back their rights to consent to student data sharing. State laws as well as the Student Privacy Pledge need to be scrupulously enforced so that personal student data is not sold for profit. Bottom line, parents and students after they reach 18 should own and control their own data. They should have a say as to whether and how personal information about their child is shared outside of the school walls.

(Correction: Earlier version said 25 states use SAT or ACT for accountability purposes; only 12 use it for accountability purposes and 13 use it for other purposes)

The Senate has voted to repeal an FCC ruling that protects your Internet privacy and data from ISPs. Here's all the steps you can take to protect yourself. (Video: Jhaan Elker/The Washington Post)

Here is an emailed response from the College Board:

We have been in touch directly with Cheri Kiesecker to address her concerns. As we shared with her, the College Board has a deep respect for student privacy, and we are committed to protecting it. We are a signatory, with more than 200 K-12 school service providers and education leaders, of the Pledge to Safeguard Student Privacy, a public commitment for the responsible collection and use of student data. Additionally, you can find online our commitment to full data privacy.
The College Board collects information on students to help them access relevant college information, including scholarship opportunities, student services and campus life. Parents of students may remember answering such questions when they took their own college entrance exams. Student data privacy is of great importance to us, and we are continually evaluating our policies and procedures to ensure that we are clear about the data we are collecting, why we collect it as well as its optional nature.
• Nationally, when students take the SAT, language online and from the actual questionnaire clearly indicates that there are a number of questions that are optional. Below is language from the questionnaire itself. When completing the questionnaire, students have the option to select “I do not wish to respond” or skip over the optional questions.
How Answering the Questionnaire Helps Your College Search  
Item 12 on side 2 of the questionnaire form consists of 35 questions about you, your high school experiences, and your thoughts about college. You don’t have to respond to the questions, but we strongly recommend that you do, because your responses:
– Give your counselors and college admission officers information they can use to help you make plans for the future. The more information you supply, the more they’ll be able to help you.
– Provide information to the College Board that helps us ensure that the SAT is a fair and accurate test for all students. Your answers to some questions (the questionnaire lets you know which ones) will not appear on your score report but will be used by the College Board for research and planning.
– Along with those of all other students taking the SAT, create a picture of the academic preparation, extra- and cocurricular involvement, and post-high-school plans of your graduating class, which can help colleges and universities deliver programs and opportunities to serve you and your classmates.
• When students take the SAT and PSAT, the proctor instructions make clear that some items on the questionnaire are optional, and they may skip if they prefer not to answer. Information such as their racial/ethnic background and language spoken, are used for validity analysis to evaluate the fairness of the assessment, only if provided by the student.
• For SAT and PSAT/NMSQT and PSAT 10, it includes opting into Student Search Service and providing their mobile phone to opt into receiving information about tests they are registered to take and/or to receive college planning resources.
• PSAT 8/9 student data is not shared with colleges, universities or scholarship providers.
This spring, Colorado will give the SAT and PSAT 10 to all 11th and 10th- grade students, and we have worked closely with the Colorado Department of Education to ensure that students taking those tests and their parents know that completion of the Student Data Questionnaire and participation in Student Search Service are optional and voluntary for all students. In advance, each student must sign a consent form prior to completing the questionnaire. Please see the links below:
SAT Student Instructions
SAT Student Consent