Thread by @random_walker

Many online education platforms track and profit from student data, but universities are able to use their power to negotiate contracts with vendors to get much better privacy. That’s one of the findings in our new paper “Virtual Classrooms and Real Harms” arxiv.org/abs/2012.05867

We analyzed 23 popular tools used for online learning—their code, their privacy policies, and 50 “Data Protection Addenda” that they negotiated with universities. We studied 129 (!) U.S. state privacy laws that impact ed tech. We also surveyed 105 educators and 10 administrators.

A major reason for poor privacy by default is that the regulations around traditional educational records aren’t well suited to the ‘data exhaust’ of online communication, echoing arguments by @elanazeide & @HNissenbaum here: papers.ssrn.com/sol3/papers.cf…

The good news is that universities can and do take steps to protect students and educators. We recommend they move away from a complex, expensive, and slow up-front vetting process before licensing software to a more nimble system for incorporating continual feedback.

Some backstory for our work: soon after covid-19 hit, we realized that many tech policy problems had acquired a new urgency. The privacy and security risks of the sudden shift to remote learning in higher ed seemed to be one where we could use our skills to uniquely contribute.

We’ve tried to find a balance between the speed and thoroughness of our research while battling the chaos of 2020. We hope our recommendations can help universities, including yours. arxiv.org/abs/2012.05867

We also have a blog post about our work: freedom-to-tinker.com/2020/12/15/new…

I had a small role in this paper but credit really goes to @shaananc, @RossTeixeira, @akohlbre, @ynotez, @MrsMRS_PhD, and Mihir Kshirsagar, as well as the supportive, interdisciplinary environment at Princeton CITP that is conducive to this kind of research. 🙏