Definitions Guide

Definitions for Privacy Evaluation Questions

This guide provides the meaning of key terms used in the privacy evaluation questions in the context of edtech privacy and security.

 

abuse: cruelty, violence, or insulting or offensive behavior directed at individuals or groups

actual knowledge: a particular fact a vendor knows or has reason to know -- for example, when a user enters a birth date showing their age

alternate dispute resolution (ADR): arbitration, mediation, or another method of resolving a dispute between parties other than filing a lawsuit

analytics: computation or use of data or statistics

anonymous: indicates that no personally identifying data is associated -- for example, name, address, or other data that could be used to reidentify or deanonymize

application: software or a program written for a mobile device or computer that may or may not require login authentication

assistive technology: tools designed to assist a user with one or more life functions -- for example, a tool that allows users with visual impairment to access larger fonts or one that allows users with hearing impairment to access read-aloud text

audit: a third-party company review of the practices of a vendor

authorized individual/user: a user who is permitted by a vendor to use a product, including a student, parent, guardian, or school official

behavioral advertising: commercial messages displayed to a user by a vendor or third party based on data collected from that user's online activities

behavioral data: information about a user's activities -- for example, how long the user has looked at a webpage or which webpages they have looked at

biometric data: health and physical information from human bodies -- for example, fingerprints

changelog: a record of changes made to a project, program, or policy

class action lawsuit: a legal action brought by one or more individuals on behalf of a larger group of similarly situated individuals

collection: as defined here, first-party collection of data or information from a user

compliance: legal and/or regulatory rules and standards being followed

consent: a user or responsible individual giving written or electronic agreement to an action -- for example, a user allowing collection of their information

contextual advertising: commercial messages displayed to a user based on the surrounding content

control: legal or physical power over an action

cookie: message given to a web browser by a web server to facilitate the storage of information about a user

persistent cookie: a cookie that stores information on a user's computer for longer periods, even after a user closes their web browser. This type of cookie remains on a user's hard drive until it reaches its expiration date or is deleted by the user

session cookie: a cookie that is stored temporarily on a user's computer and lasts only as long as the web browser is open

 

COPPA: the Children's Online Privacy Protection Act, a law created to protect the privacy of children under age 13

COPPA Safe Harbor Program: a self-regulatory compliance program approved by a regulatory agency

copyright license: permission given to use another's content

cyberbullying: bullying that takes place over the internet on devices like phones, tablets, and computers. It can happen in social media, texts, or online games, where people can view, participate in, or share content. It typically includes sending, posting, or sharing negative or harmful content about someone else on purpose. It can include sharing private information about someone else to cause embarrassment or humiliation.

data: raw unprocessed facts -- for example, that Tim is six feet tall

data at rest: information stored or not in transit between software and/or devices  

data breach: unauthorized disclosure of information to a third party, voluntarily or involuntarily

data controller: principal party for responsibilities such as collecting consent, managing consent-revoking, enabling right to access, securing, etc.

data enhancement: adding information to existing data to improve, augment, or correct it

data processor: person who processes or analyzes information on behalf of a data controller

data-protection officer: person in a privacy and/or security leadership role at a company

data-retention policy: a vendor's rules for how long user information is kept in its storage facility before it is deleted permanently

data sunset: the phasing out, terminating, or deleting of information

data transfer: any change of control of data, including a change of ownership of data

de-identification: the processing of data to remove information that can directly or indirectly be used to identify an individual person

direct control: legal and physical access -- to, for example, education information collected by a school or third party

directory information: school lists of students, faculty, and/or parents that show names and/or addresses. This includes information contained in the education records of a student as defined under FERPA.

disclosure practices: a vendor's activities relating to the public display or availability of user information

Do Not Track: a policy used to indicate that, upon request of a user's web browser agent, a company should not monitor that user's behavior on websites or should stop monitoring them

education record: information directly related to an individual K–12 student and maintained by their educational institution or by a third party acting as a school official on behalf of the educational institution

educator: a teacher at an educational institution who uses curriculum to instruct students

encryption: the process of encoding data or information to prevent unauthorized or unintended access

federated identity: information provided to a vendor from another vendor's sign-in process that is used to authorize a user and provide for the exchange of information about that user among companies

federated login: a process that allows user access to a product or application via another vendor's sign-in process

FERPA: the Family Educational Rights and Privacy Act of 1974, a federal law that, among other things, protects the privacy of student education records

filtered: processed (as of data or information) so that only a subset of the original data or information is included

free/reduced lunch status: indicates a government program providing free or subsidized meals for lower-income students that also serves as a proxy for estimating the poverty level of students' families, which then is used to determine school district funding

FTC: the Federal Trade Commission, a government agency responsible for regulating commerce and unfair and deceptive trade practices

GDPR: the General Data Protection Regulation, effective as of May 2018, which is European laws protecting the privacy and security of personal information

geolocation data: information related to the physical location of a user

government request: indicates a federal, state, or local agency asking for information

home page: the first page a user can view when linking to a company (includes App Store purchase page and landing pages for websites)

HTTP: hypertext transfer protocol, the underlying instruction system used by the web to communicate information.

HTTPS: a secure version of HTTP (hypertext transfer protocol secure)

hyperlink: a connection to another website, usually accessed when clicking on a word that is underlined

in-app purchase: the buying of something with real currency while logged into an application

indexing: processing data in order to identify it, label it, or make it easier to search

information: as defined here, data that has been processed, organized, or otherwise structured

intellectual property: generally, creative work produced and owned by an individual or company, covered by copyright, trademark, or patent law

interaction: social communication by text or posting, or information being passed from an individual to another individual or a group of individuals

internal operations: operations used for the function of a company, not for disclosure or use outside the company

IP address: internet protocol address, which identifies a computer or device's location on the internet

jurisdiction: location where a legal action may be brought

legacy contact: individual to whom an account may be assigned if that account becomes inactive

legal request: a request for information from a court or attorney as part of a legal action or in preparation for a legal action

logged: recorded electronically

login page: a webpage where a user can input authentication information, often a username and password, to access a product

machine crawling: programmed, automatic electronic searching for data or information

markup length: character length of the HTML markup used to deliver a website or privacy policy

material change: a change that affects a user's rights or responsibilities

mobile device: standalone or hand-held electronic technology that can connect to a cellular telephone network and/or the internet

moderate: to monitor and review information (as of by human or machine) for the purposes of controlling or filtering the content that is available to users

monitored: indicates when content or communications channels are reviewed, watched, or listened to

non-personally identifiable information: information that cannot be associated with an individual without the association of additional information or analysis

notice: communication from a vendor to a user for the purpose of informing the user

offline: not connected to the internet

opt-in: when the user affirmatively indicates they agree to something before it is allowed to occur

opt-out: when the user indicates they do not agree to something to continue to occur

parent: parent or legal guardian of a minor child under the age of 18, or 13 with respect to COPPA regulation

parental consent: a parent verifiably communicating to a vendor that they agree to a certain action performed by the vendor with respect to the parent's child

password: a series of letters, numbers, phrases, or symbols allowing access to an account or other restricted materials

persistent identifier: a unique electronic number used to identify a user or device on more than one application or website that allows tracking of an individual across multiple devices or sessions

personal information: characteristics that are associated with a unique individual

personally identifiable information (PII): characteristics associated with a unique individual that allow someone to identify that individual

physical access controls: controls that grant or restrict individual access to facilities -- for example, doors, gates, or pass cards

privacy certification: awarded when a vendor follows certain rules or affirms certain privacy practices in its privacy policy to receive approval from a government or privacy standards organization

privacy pledge: pledge by which a vendor affirms it will agree to uphold certain privacy industry standards

privacy policy: a document a vendor publicly posts explaining its data collection and use and disclosure practices associated with its protection of personal information

privacy shield: indicates that a vendor follows a set of privacy principles from an agreement between the United States and the European Union to meet the EU's regulatory standards

product: as defined here, an application or service offered by a vendor to the public for use

profile: a set of information about a single individual that can be used for identification

prohibited activities: actions that are not allowed in relation to a product or contract between vendor and user

protective order: a court-issued document that requires that certain information remain secret

reidentification: the taking of information that has been made anonymous and analyzing it or adding information so it can be associated with a particular individual

safe interaction: communication with trusted users only

screen reader: assistive technology used to aid in understanding the textual content of a page

school: as defined here, an educational institution offering full or partial instruction from pre-K through 12th grade

school district: a regional group of pre-K–12 schools under a central administration or authority

school official: an individual with a legitimate educational interest in, and under direct control of, a school (in this context, regarding the use and maintenance of education records)

security: as defined here, the practice of keeping personal data and information from discovery, disclosure, or use by unauthorized individuals

sensitive information/sensitive personal information: information that contains categories that have been given strong legal protections; categories vary by region

service: indicates an offering by a vendor to the public for use through a website that may or may not require login authentication

sharing: affirmative allowing of access to information, including its selling, giving, and disclosing

shouting index: amount of capital-letter text used to convey information relative to that of non-capitalized text

signal-to-noise ratio: the amount of plaintext policy information (signal) relative to the markup length (noise). This can be used as an indication of how much extraneous detail is on a policy page

social advertising: commercial activities designed to sell products or services using social media

social login: the use of a username and/or password from a social media account to gain access to another product and to share information with that product

student: a user enrolled in a level of school from pre-K to 12th grade

successor vendor: a new vendor that purchases or acquires a named vendor

teacher: a certified individual employed in pre-K–12 education

terms of service: a legal document describing both a vendor's and a user's rights and responsibilities

terms of use: a legal document describing a vendor's restrictions on a user's interactions with the product or service

third party: an entity or person other than the vendor, specifically excluding a user's parent if the user is a minor and/or that user's teacher if the user is a student using a product for school

third-party access: the allowing of third parties to access data on their own without it being affirmatively shared

third-party affiliate: company associated with a vendor not involved in providing the primary service

third-party subsidiary: legal business entity of a vendor not involved in providing the primary service

tracking: the practice of observing and recording a user's activities on one or more products

traditional advertising: advertising that is not generated by any particular user's data and is not targeted to an individual

transit: the transference of data from one electronic device to another

tracker: a cookie or other electronic mechanism used to observe and record user activities on one or more websites

trusted user: an individual who has provided credentials to use a product on behalf of themselves or another user

unauthorized user: an individual without credentials or permission to use a product on behalf of themselves or another user

unique device ID: a number/letter/symbol code to point to a particular piece of electronics, often used to track that device and therefore a user

URL: uniform resource locator, a location on the internet for a website

user: an individual who engages or attempts to engage with a vendor's product

user-created content: textual, visual, or audio information originating with an individual user rather than a vendor that may be uploaded or posted using the vendor's product

username: a word that identifies an individual user and that may be used for login and identification

vendor: a company that offers a product to the public, either for sale or free use

verifiable parental consent: a method that is reasonably designed in light of available technology to ensure that the person giving consent is the child's parent

waiver: an agreement to forgo a certain right

web: connection of human-readable pages of information on the internet