What is your child’s school app really doing with their data? BYU Information Systems Professor Justin Giboney breaks down a groundbreaking study—conducted with Mark Keith and the Utah State Board of Education—that compared what EdTech apps promised against their actual network traffic, uncovering student data flowing to advertisers, data brokers, and identity-resolution firms, often without app makers realizing it. policymaker.
Subscribe To “Broadcast Retirement Network” On YouTube For Aging, Finance, Lifestyle, Privacy, Retirement, and Wellness programming Monday through Sunday at 7:30 AM ET.
Transcript:
Jeffrey Snyder, Broadcast Retirement Network
Well, Justin, thanks so much for joining us this morning. Really appreciate you coming on the program.
Justin Giboney, Information Systems Professor, Brigham Young University
Thank you very much for having me.
Jeffrey Snyder, Broadcast Retirement Network
And I want to I want to dive right into the the report that you and Mark and the team created. Take us through the project. What was the project?
What were you tasked with finding? And then we can get into the results in a few minutes. But tell us what you were looking for.
Justin Giboney, Information Systems Professor, Brigham Young University
That’s great. We had an opportunity to work with the State Board of Education and they basically wanted to know what the privacy landscape in the ed tech ed tech apps that across the state of Utah, what was it like? They wanted to know what data was being shared and who was being shared with.
And where are we in the in the privacy sense, especially for our children? Right, because that’s what they’re mostly concerned about is for all of the children that the State Board of Education serves, at least in the state of Utah. So what we were able to do is we went out and collected the names of all of the ed tech apps or apps in general.
They were not all specifically ed tech. All of the apps that were required by the school, any that the teachers felt like their students needed to engage with. Many of these apps, school districts or the state have contracts with about what information they can share and what information they can collect while the students are using the apps.
So we’re able to compare what these contracts or privacy pledges said that they were going to collect. And then we looked at the computer network traffic to find out which companies the ed tech app was connecting to. So if it connected to an identity resolution company or a data broker and we tried to find out what data was being collected, whether it was just IP address or whether it was name or various things, ages and things like that.
What data and who it was being sent to. So if some of this data was being sent to an identity resolution company or an advertising company, we we could flag that, especially if it wasn’t part of the contract that they they had set up. And we were able to compare the contract to the actual data connections that were being made.
And then we flagged those for the State Board of Education and said, here’s where things are off or where they’re good. Many places they were good. And the State Board of Education then had the opportunity to have a dialogue with the companies and either set the record straight on what they were collecting or have the company fix what was going on.
In many cases, companies didn’t realize they were connecting to some of these advertising networks unintentionally because the company provides free analytics or or things like that. And so the State Board of Education contacted all these companies and had a lot of them get in more agreement with what the contract was going. And it set up this the this privacy law that allows the state to be able to audit more, be able to manage their contracts better with these companies to ultimately increase the privacy of all the students, at least in the state of Utah.
So all the minor students, so not necessarily higher education, but.
Jeffrey Snyder, Broadcast Retirement Network
Right. So we’re talking about K through 12 and these would be 18 and under most of the minors. If you’re not 18, you’re 17 and under, you’re going to be considered still a minor.
It sounds like the results were mixed. You don’t have to give me the exact percentages. People can look up the report online.
But did you know, just your reaction, I guess, as a parent, if I were a parent, I would expect that. You know, all of my child’s data would not be available to anybody but myself and maybe the school district, if I signed some kind of sharing agreement with the school district.
Justin Giboney, Information Systems Professor, Brigham Young University
Yeah, many of these tech apps collect student data in the sense that they they have graded assignments or there’s there’s, for example, there’s math apps that allow the student to to do math. And as the student is in a certain age or certain grade, the math changes. Right.
Or history or things like this. Right. So they are actually collecting valid information about the student in the sense that that they need it for something that’s related to school.
But I would say there was a large percentage of. Flagged connections from these apps that were going to these data brokers or identity resolution companies or advertisers that didn’t need to be collected from from our children. Right.
We don’t we don’t need to collect that information about them unless there’s some need to know that. Right. So but one of the surprising things is that a lot of the companies responded to the State Board of Education said, hey, we’re going to fix this or or or in some cases we got it.
We didn’t get it perfect. They said, oh, well, we have an app specifically for the state of Utah or for this school district that doesn’t collect that information. And we just got the wrong one.
And that happened a few times. And so there was a great dialogue between these companies and the State Board of Education. And that ultimately led to the to the privacy law that was just recently passed.
Jeffrey Snyder, Broadcast Retirement Network
So that, you know, it’s hard to money morning quarterback. I mean, in the world of information, and this is what you and Mark and the team do on a day to day basis. I mean, you are experts in information.
So it’s really hard. And it’s a good thing that you were there as a team to perform this audit because they would never have known. And look, they could have these companies could have built profiles for a five year old in first grade all the way through.
Till they were 18 or till they were 17, until they were an adult. And that’s a powerful that’s powerful to be able to build a profile from the time you’re five until the time you’re you become an adult. That’s powerful for a marketing company.
Justin Giboney, Information Systems Professor, Brigham Young University
Yeah. For a marketing company, they get to know all your interests or potentially, you know, if they can start collecting that at age five and say, OK, Justin’s interested in in computers, let’s advertise computers to them. You know, that that’s that’s that is a lot of information, a lot of powerful.
There’s a lot of money that can be made by knowing that.
Jeffrey Snyder, Broadcast Retirement Network
Anecdotally, you mentioned that so you did mention that the state of Utah was the legislators were able to pass a law that provided more audit ability. And that’s a good thing. Do you think parents have awakened?
You know, we just had the meta settlement on social media. I get the sense and maybe but you’re a lot closer. Obviously, you’re in Utah.
You’re a lot closer to it than I am. Do you think parents have awakened? Hey, what’s my kid doing online?
And and what’s happening with what they’re doing with their behavior?
Justin Giboney, Information Systems Professor, Brigham Young University
I do think that a lot of parents have growing up with social media themselves have a way better understanding of what these companies are doing, how the advertising companies work, what social media is doing, all of the data that can be processed than. You know, the previous generations, right, and it’s so much easier for these companies to do it. And parents, it’s clear that parents have a better understanding because we have all these laws that are being passed that are being pushed by parents.
Most of the people on the State Board of Education are parents themselves, and they want to protect their children and they want to know what’s going on. So I do think there’s a growing awareness of privacy out there and it’s improving the privacy landscape for for people that want to stay private.
Jeffrey Snyder, Broadcast Retirement Network
And I would imagine things are going to get even more complex and as artificial intelligence is being deployed and it continues to learn at an exponential rate, necessitating even more rules and guardrails, not just in the state of Utah, but but maybe across the United States and maybe across the planet.
Justin Giboney, Information Systems Professor, Brigham Young University
Our computing power has increased dramatically, especially with what we are now calling AI LLMs that that are able to make connections a lot faster than we have in the past. And we’re able to collect more information faster. So this whole new age is just making it easier for companies to identify who you are, even across multiple devices and sell you advertising or advertisements or market various things to you or find out just who you are and follow you or just know what you’re doing, who you are.
Jeffrey Snyder, Broadcast Retirement Network
Yeah, it’s a it’s a bit concerning, but I guess I guess the good news is that you and the and the state of the Board of Education were able to conduct an audit. You will continue to conduct the audit. And there’s other states that can do the same thing.
They can contact you and Mark Keith and the team to do it or they can look within their own state to do it. But they should probably do this sooner rather than later with any, I would say, probably not just with EdTech, right, Justin, but with any technology, with any technology that is being used at the higher education level or the employee level.
Justin Giboney, Information Systems Professor, Brigham Young University
Yeah, any anywhere where a company is collecting data and you are not informed explicitly about it is a violation of privacy, at least in a social sense, not necessarily a legal sense at the moment in the United States. Other other countries have different laws that protect things in different ways. So, yeah.
Jeffrey Snyder, Broadcast Retirement Network
You know, in 1993, when I started using the Internet, Justin, you never would have thought that this was going to be an issue. We didn’t think about it. We just thought about using Mosaic and Explorer and just trying to see what people put on the Web.
But but all that behavior is being tracked. And I’m not saying it’s being used for nefarious purposes, but certainly being used in different ways to track behaviors. Justin, we’re going to have to leave it there.
Great research. Thank you to you and Mark for doing it and the team. And we look forward to having you back on the program again very soon, sir.
Justin Giboney, Information Systems Professor, Brigham Young University
Awesome. Thank you very much.
