Privacy Risks of the Top 5 Distance Learning Apps

Over the past few months of the coronavirus pandemic, there has been a significant surge in demand for videoconferencing services as distance learning meant more educators used video and audio communication technology to connect with children and teens learning from home. (For more information on quality educational applications and services to use with your kids at home and students in the classroom, check out our Resources for Educators During the Coronavirus Pandemic and Resources for Families During the Coronavirus Pandemic.) Because of the concerns and restrictions associated with the coronavirus pandemic, millions of Americans are also now working from home, often using videoconferencing software to stay connected.

Video communication can provide a critical service with features that enable you to stay connected to co-workers, classmates, families, and friends. But using video and audio communication technology also brings risks, and it's important to understand the privacy risks and harms of sharing personal information—for both you and your children or students.

Many companies that develop videoconferencing applications try to include different features for different audiences. For example, some are intended for general audience consumers to stay in touch with friends and family, while others are intended for business teams to use as a way to collaborate. However, these applications were not designed with student data privacy in mind. During the coronavirus pandemic, videoconferencing companies had to adapt their products and privacy policies quickly to meet the needs of students and educators across the country that required videoconferencing to support emergency remote learning. Due to time constraints, distance learning technology was rolled out to educators without the normal safeguards and planning that schools and districts usually have.

For example, the videoconferencing service Zoom was originally designed for consumer and business customers, but the company has seen explosive growth over the past few months to more than 300 million active participants, including educators, children, and students. To put this in context, Zoom said they had only about 10 million paid and free daily active participants at the end of December 2019. Increasing demand by 30 times essentially overnight can understandably put a strain on any system. Companies are working under the same constraints as everyone else and struggling to find the work and life continuation in this new reality. Check out our Parents' Ultimate Guide to Zoom to learn more about the privacy risks of using it and other similar videoconferencing services.

Which apps did we test?

We interviewed many parents and educators to find out which distance learning apps kids and teens used most often at home. For this article, we evaluated the most frequently used distance learning videoconferencing services, which included Zoom for Education, Cisco Webex, Google's suite of apps, Microsoft's apps, and Apple FaceTime. 

Google has several different videoconferencing applications that could all be used by educators for distance learning. Each one offers a very similar experience but is intended for different users. Google Meet is intended for business meetings, and Google Chat is text messaging for business team collaboration. Google Hangouts is intended for keeping in touch with friends and families, and Google Duo is intended for mobile devices and can work between iOS and Android devices. Google Voice is intended for phone calls only.

Similarly, Microsoft offers two different videoconferencing applications. Skype is intended for general audience consumers, including children and students. Microsoft Teams is intended for business team collaboration, but Teams for Education is also included in the Microsoft Education product suite and has additional privacy protections for students. (You can learn more about these in our Office 365 Education privacy evaluation.)

Both Google and Microsoft use the same privacy policies to cover all their consumer products used for distance learning described above. Our privacy ratings for each company apply to all products that share the same privacy practices. For this article, we looked at only the privacy practices of Google and not the distance learning tools included in the Google for Education suite of products which have additional privacy protections for students. You can learn more in our Google Classroom privacy evaluation.

Zoom takes a slightly different approach with only one application that changes features and privacy practices automatically based on the type of subscriber account. Zoom has a general audience privacy policy and terms of use, but schools and districts can use Zoom with a school subscriber account, which protects student data under an additional K-12/Primary and Secondary Schools Privacy Statement. This approach treats users' data differently based on whether they are using a free, paid, or school subscription account. For this article, we looked at only the privacy practices of Zoom for Education.

What we found

The following ratings and scores are from our privacy evaluation results of distance learning applications that are being used at home for learning by kids, students, and families. For more privacy evaluation information about each product, click on the app's name in the chart below. The following chart illustrates a range of privacy practices from "best" to "poor" based on our privacy ratings. Products that scored "poor" are not necessarily unsafe, but they have a higher number of privacy problems than an "average" product. Similarly, products that scored "best" are not necessarily problem-free, but had relatively fewer problems compared with other products.

From the privacy concern chart above, you can see that Zoom for Education, along with Apple FaceTime, received the highest overall score and our highest Pass rating. Zoom for Education and Apple's privacy policies had very similar scores across all categories, but Zoom clearly had better practices in the School Purpose category because they provide an additional K-12 School Privacy Statement describing school use by students and educators. In contrast, Cisco Webex received the lowest overall score with a Warning rating. Both Zoom and Apple did better than Cisco in almost every concern category.

In addition, Microsoft Teams and Google Meet both received similar overall scores, but each had different strengths and weaknesses in their concern scores that contributed to their overall points. For example, Microsoft Teams had better practices in the Data Collection concern and describing school use by students, but Google Meet had better practices in place for protecting data collected from children with parental consent.

Compare privacy ratings

The following chart compares each products' privacy practices which are used to determine their privacy ratings. These worse practices can put children's and students' privacy at risk by selling personal data to third-party companies or use of personal information for third-party marketing, advertising, tracking, or ad-profiling purposes.

From the privacy ratings chart above, you can see that both Zoom for Education and Apple received our highest Pass rating because they did not engage in any of the worse practices—for the purposes of our evaluation—that prohibit selling data, or engaging in third-party marketing, targeted advertising, or profile tracking of children or students. In contrast, Microsoft, Google, and Cisco all received Warning ratings because their policies all disclose they engage in practices designed to profit from their users' data, such as third-party marketing, targeted advertising, and tracking of their users which includes children and students. Under the CCPA law you have the right to protect your personal information. Make a Do Not Sell request.

For example, Cisco Webex's privacy policy disclosed they engage in several worse practices used to determine our privacy ratings. This is concerning given the number of schools and educators around the country using Cisco Webex for distance learning. Microsoft and Google's policies received much higher scores than Cisco (because they disclose a wider range of better practices), but in terms of their privacy rating, both Microsoft and Google are not much better than Cisco. One exception is that both Microsoft and Google have separate education specific products for students that have better ratings.

Considering these results as well as the widespread use and importance of these tools, schools and districts should contact the companies that produce the distance learning products they plan to use for the upcoming school year to learn their privacy practices and how they protect student data. If privacy concerns are not addressed with the distance learning products they plan to use, schools and districts may need to negotiate additional Student Data Privacy Agreements to better protect student data and meet state or local student data privacy compliance obligations.

Even though many distance learning products were designed for business purposes rather than educational ones, times have changed. Vendors and schools are all facing this new learning modality together. Companies that rise to the challenge and build or adapt new tools specific to education need to be encouraged and supported to build in the privacy needed to keep student data safe.

Together we can all better understand the privacy challenges we face during this unprecedented period of emergency distance learning, and companies and schools can collaborate on better products that protect student data privacy, no matter what platform or product students and educators use to connect with each other.

For more information, visit us at https://privacy.commonsense.org.