Apps and websites used in online classes in Brazil collected private data from children

Since the pandemic pushed school classes to digital media, thousands of children have had private data, such as their location and online behavior, collected by websites and apps used to access educational content, either overtly or secretly.

This is what an international investigation by Human Rights Watch (HRW) points out that analyzed 165 distance education products used in 49 countries, including Brazil, during the Covid-19 pandemic and recommended by local governments for teachers, parents and students.

They are websites and applications dedicated to the education of children and adolescents that emerged when educational institutions closed their doors, or that were adapted to the new urgent demand. The companies that develop these products are generically called edtech, flexing education with technology in English.

The study points out that 89% of them “jeopardized or directly violated the privacy and other rights of children and adolescents for purposes unrelated to their education”. violated, according to Human Rights Watch.

They are: Estude em Casa, from the Minas Gerais State Department of Education; São Paulo Education Media Center, of the São Paulo State Department of Education; Descomplica, Dragon Learn, Escola Mais, Explicaê, Manga High, Stoodi and Revista Enem – the latter being the only one that only puts student data at risk.

“Children are as subject to surveillance and monitoring in their online classrooms as adults shopping in the world’s largest online stores,” illustrates the text of the report, released this week by an international investigative journalism consortium called Edtech Exposed, of which Sheet is part and which is made up of 12 other media vehicles from 16 countries.

The consortium was coordinated by the NGO The Signals Network, which supports whistleblowers who reveal information about corporate misconduct and human rights violations.

In most of the cases analyzed by the HRW report, the products taught math and English, for example, while also gathering information from students and sharing it with other companies, such as tech giants such as Google and Facebook, as well as data brokers (see glossary on this page) and digital advertising companies.

And, in a context of a pandemic, the decision-making power of parents and students regarding the use or not of these devices was extremely restricted.

With the exception of Estude em Casa, all other websites and apps were recommended by the government of São Paulo. Bruna Waitman, coordinator of the Centro de Mídias da Educação de São Paulo, stated that the developers of all these platforms “have signed a confidentiality agreement indicating that no information acquired can be used in any way, which would imply administrative, civil or criminal liability. “.

The analyzes of the HRW study were carried out between March and August 2021 and represent a snapshot of the prevalence and frequency with which monitoring technologies are embedded in each product at that time – something that may have changed since then.

Of the 164 products analyzed, 147 of them (89%) monitored the behavior of students in digital media, collecting data on who they are, where they are, what device they use, what they do in the classroom and who their friends are.

The study found that there are more companies receiving student data than sharing it: 147 products sent data to 199 online advertising technology companies.

“This allows the sophisticated algorithms of these ad tech companies to stitch data together and analyze it together to infer personal characteristics and interests of children that suggest how they might be influenced,” explains Hye Jung Han, a technology and children’s rights researcher at Human Rights Watch in the US.

“It’s information that can be marketed to anyone with an interest in that target audience.”

One such case is Stoodi, an educational website recommended by the government of São Paulo and which the research revealed to use a technology considered particularly invasive, key logging, which records the keys pressed on the keyboard, allowing the collection of information that were typed, even if they were later deleted from forms and search engines.

The data, according to HRW, was automatically sent to a digital advertising company called VE Global without informing parents or students through the company’s privacy policy.

Sought, Stoodi informed, through a note, that it does not sell or transfer user information to third parties, as well as does not deliver third-party advertisements within its platform. The company says it does not have an active contract with VE Global and that the use of ad trackers and cookies is in compliance with the data usage policy and “aim to improve the product for educational purposes suited to the interests of students”.

Criteo, another international behavioral advertising company, was also identified as receiving data from children and their IPs (a kind of Internet address for each one) from seven websites, two of which are used in Brazil: Descomplica and Escola Mais.

When contacted, Descomplica did not comment on the research findings.

Escola Mais stated, in a note, that it is a physical school and created a technology structure in its domain to provide emergency services to students, shared free of charge with students from public schools in the state of São Paulo and municipalities in Bahia, Pernambuco and Rio de Janeiro “until August 17, 2020, before the LGPD enters into force in the country”. It also informs that it has never used the personal data of children and adolescents for any purpose.

Human Rights Watch identified 6 cookies and 11 tracking technologies that sent data to domains like Google, Facebook and Universo Online, among others. Sought after, Google and Facebook did not comment. UOL reported that it has no relationship with or receives data from Escola Mais.

“Today, many platforms are free because they work based on massive data collection to target behavioral advertising”, explains Marina Meira, project coordinator at Associação Data Privacy Brasil de Pesquisa.

“When we think of children and teenagers users, who are in the development phase and have difficulty discerning advertising from reality, the urgency of changing this business model is evident and we can even talk about commercial exploitation of the educational activity of children and teenagers” , says the lawyer.

Article 14 of the LGPD determines that the processing of personal data of children and adolescents must be carried out “in their best interest”, a principle established by the UN International Convention on the Rights of the Child, in 1989, and ratified by Brazil in 1990.

Although the law was passed in 2018, the LGPD only came into force in September 2020. The sanctions – with fines that can reach BRL 50 million – went into effect in August 2021.

According to Meira, “the commercial use of this data goes against the principle of the LGPD by privileging the client, and not the child and adolescent”.

The Brazilian data legislation also says that data collection from children must have specific consent and that information about the treatment must be provided “in a simple, clear and accessible way, considering the physical-motor, perceptual, sensory, intellectual characteristics and mentality of the user”.

Of the 9 distance education tools analyzed by HRW, two did not even have a privacy policy published on their website (Estude em Casa and Revista Enem) and only four informed in an objective and accessible way that they shared data with third parties, without specifying, however, how it was done.

Sought after, Revista Enem did not return the messages of the report, while the Estude em Casa platform reported that it had been developed to “meet the urgent demand” during the suspension of face-to-face school activities and that “the update of said policy is already being carried out and incorporated accessible on our page”.

Christian Perrone, coordinator of law and govtech at ITS Rio (Instituto de Tecnologia e Sociedade do Rio de Janeiro), assesses that there has been an explosion of opportunities for these digital technologies during the pandemic.

“It is very likely, as the Human Rights Watch report points out, that these new technologies were developed and put into practice without care about what information from children was collected, with whom it was shared and how it was stored,” he explains.

“This may have occurred in virtually all countries, even without negative intentions, and it could not occur in a normal process, they were from the times of the pandemic”, he evaluates, for whom these tools “provided an incredible service” and need, now , adapt.

The platform Explicaê, through a note, explained that “given the urgency caused by the pandemic, it made its platform available free of charge to all students of the public education network in São Paulo”, without implementing technological changes to serve students in São Paulo.

In recent years, Meta and Google have come under pressure to revise their under-13 policies. In 2019, Google mandated that all YouTube creators should mark whether or not videos are suitable for children.

YouTube also decided to stop targeting advertising to younger users. Meta, a company that includes Facebook and Instagram, blocked the creation of Instagram Kids, a version of the app dedicated to children, and imposed barriers to advertising for children on its platforms.

The proper treatment of traces left by children and adolescents in virtual environments has been the subject of concern and debate.

The UN Committee on the Rights of the Child has warned that children’s data processing practices “may result in violations and abuse” and recommended that States “prohibit by law the use of such data for commercial purposes based on their digital footprints”.

The European Council declared that applying profiles to children and adolescents users from the processing of their data “to make decisions on behalf of children or to analyze or predict their preferences, behaviors and attitudes should be prohibited by law”.

The American Academy of Pediatrics has raised concerns about the impact on children’s health of practices “tracking and using their digital behavior to inform digital marketing campaigns.”

For Meira, from Associação Data Privacy Brasil, it is important to “give visibility to a process that is not very transparent”. “Companies need to consider who people under the age of 18 will be using their platforms and set different rules in the best interests of children and teens.”