Strict federal privacy laws protect the private information of students. But those laws only apply to schools. As a new report from Fordham University shows, there are more than a dozen private brokers in the U.S. that can freely sell student data.
These brokers advertise lists of students with all manner of specific characteristics, from home-schooled Christians to teenage girls interested in birth control. However, even after years of research, the authors of the study found it almost impossible to find out where the student data on these lists came from.
“It’s a black-box, opaque marketplace,” said Cameron Russell, a co-author of the study, which was published on June 6 by Fordham’s Center on Law and Information Policy.
The study found 14 companies that market student data to commercial interests. Researchers were careful to search for brokers who stated that they had access to “student” data, not just to data on children generally.
One data broker advertised mailing lists with names like “Jewish Students in New York by Education Level,” “Rich Kids of America” and “The Awkward Years – High School Students.” Researchers contacted a sales representative from this company to ask if they could buy a list of “fourteen- and fifteen-year-old girls for family planning services” – and she readily agreed. While the researchers discontinued contact as they did not actually want this list, they wrote in the report that the sales rep “relentlessly” followed up on their inquiry.
“Basically, anything you want is advertised to be available,” said Russell. “Now, whether that’s in fact true that you can actually obtain anything you want is a different story.”
It’s unclear whether these lists contain accurate information. Since the researchers failed in their efforts to find out where the data brokers got their data, it is impossible to tell. Potential sources of data could include public records, retailers or information students give out online. That lack of transparency, Russell said, makes it more difficult to find out if companies that collect student data are following the promises of their privacy policies.
Related: How can schools protect student data without training teachers in privacy basics?
“Are guidance counselors giving students surveys that they think are going to help students go to college or find out about jobs, but then that data is being used to sell things to students that have nothing to do with educational opportunities?”
The authors of the study found no evidence that schools were giving or selling data to these data brokers.
“Schools are mostly doing the right thing. They are not sharing information with sketchy people who ask for it,” said Amelia Vance, director of the Education Privacy Project at the Future of Privacy Forum.
But schools may be unwittingly helping out data brokers in another way, by distributing third-party surveys to students. This does not violate privacy laws as long as schools get parental permission to administer the surveys.
“Once it’s through the gate, there’s little protection after the collection,” said Russell.
For example, Scholarships.com has an exclusive relationship with the data broker American Student Marketing, according to the LinkedIn page of Larry Gerber, who is the CEO of both companies. Students looking for scholarships might give the website highly sensitive information, such as their race, religion, disabilities, sexual orientation and immigration status.
“Are guidance counselors giving students surveys that they think are going to help students go to college or find out about jobs, but then that data is being used to sell things to students that have nothing to do with educational opportunities?” asked Vance.
The authors of the Fordham study created a fake account on Scholarships.com to see what kind of solicitations they’d receive. The vast majority of mail sent to the fake account was about colleges or military recruitment, but they also got two letters from a company that hires students to sell Cutco knives in the summer.
Vance noted that under a federal law called the Protection of Pupil Rights Amendment, or PPRA, schools must have a policy that outlines whether or not third parties can use survey data for marketing.
“Schools need to review their PPRA policies,” she said. “They need to make sure they have them in place.”
This story about data privacy training was produced by The Hechinger Report, a nonprofit, independent news organization focused on inequality and innovation in education. Sign up for our newsletter.
At The Hechinger Report, we publish thoughtful letters from readers that contribute to the ongoing discussion about the education topics we cover. Please read our guidelines for more information. We will not consider letters that do not contain a full name and valid email address. You may submit news tips or ideas here without a full name, but not letters.
By submitting your name, you grant us permission to publish it with your letter. We will never publish your email address. You must fill out all fields to submit a letter.