A majority of applications and services disclose they do not rent, lease, trade, or sell data, but many are non-transparent.
Among the applications and services we evaluated for our 2018 State of EdTech Privacy Report, approximately 65% disclosed a qualitatively better response that they do not sell, rent, lease, or trade any users’ personally identifiable information to third parties. However, our analysis indicates a large percentage, approximately 33% of applications and services evaluated are non-transparent on this critical issue. Moreover, because both Federal and State law clearly prohibit such activities involving children and students, it is assumed a large majority of non-transparent applications and services are in good faith following the law and not selling personal information to third parties, but are not disclosing their compliance.[1,2] Therefore, applications and services need to provide greater transparency on this issue, because they are among the 100 most popular educational technology products, and are intended for children and students, there is a significant percentage of applications and services that disclose they are intended for children and students, but do not also disclose whether they sell, rent, or lease collected personal information. When these practices are not transparently disclosed, there is no future expectation or trust on behalf of parents, teachers, schools, or districts about how collected information from children and students will be handled in order to meet their expectations of privacy.
Figure 1: This chart illustrates the percentage of question responses for Data Sold. Qualitatively better question responses indicate the application or service does not sell any users’ personally identifiable information to any third party. Qualitatively worse question responses indicate the application or service may sell any users’ personally identifiable information to any third party. Non-Transparent responses indicate the terms are unclear about whether or not the application or service sells information to third parties.
For more information about our key findings download the full 2018 State of EdTech Privacy Report.
 Children’s Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312.2 (release of personal information means the sharing, selling, renting, or transfer of personal information to any third party).
 Student Online Personal Information Protection Act (SOPIPA), Cal. B.&P. Code §22584(b)(3) (an operator is prohibited from selling or renting student information).