Student data privacy: what to check before you approve a new app

A teacher finds a great app on Friday and has thirty students signed up by Monday. That is how most student data ends up with companies the school has never vetted. The fix is a short, fast approval process that teachers will actually use.

This article covers what to check, in the order that saves the most time. It is not legal advice. Your data protection officer, district counsel or local authority has the final word.

Step 1: what data does the app collect?

Start by listing what the app needs to work. Then compare that with what it asks for.

• Does it need student names, or would initials or a class code work?
• Does it collect email addresses, photos, voice recordings or location?
• Does it ask for date of birth? If so, why?
• Does it collect free-text input where students might type something personal?

An app that asks for more than it needs is the first warning sign. A spelling game has no reason to read a student’s contacts.

Step 2: who is in control of the data?

Under most privacy laws, either the school or the vendor is in charge of deciding what happens to the data. For school use, the school should be in charge and the vendor should only process data on the school’s instructions.

Look for these in the vendor’s terms or privacy policy:

• The vendor uses student data only to provide the service to the school.
• The vendor does not sell student data or use it for targeted advertising.
• The vendor does not build profiles of students for purposes unrelated to school.
• The school can ask for data to be deleted, and the vendor says how quickly it does so.
• The vendor lists its sub-processors, such as hosting and analytics providers.

If the vendor offers a signed data processing agreement or a standard student data privacy agreement, ask for it. In the US, many states use agreements from the Student Data Privacy Consortium, and vendors may already have signed one with a district near you.

Step 3: the law where you are

The checks above are the same everywhere. The legal framework is not. This table lists the main laws to read up on.

A few points come up often:

• US schools and COPPA. The Federal Trade Commission allows schools to consent on behalf of parents when an app is used only for educational purposes. That consent does not cover the vendor using data for anything else.
• GDPR countries. The school usually needs a data processing agreement with the vendor. A new app that processes a lot of children’s data may also need a data protection impact assessment before you roll it out.
• India. The DPDP Act requires verifiable parental consent before processing a child’s data and bans tracking, behavioural monitoring and targeted advertising aimed at children.
• Data stored abroad. Check where the vendor stores data. Some provinces, states and countries have rules about student data leaving the jurisdiction.

Step 4: security basics

You do not need a full security audit for a quiz app. You do need a few answers:

• Does the app support single sign-on through Google or Microsoft, so students don’t create new passwords?
• Is data encrypted in transit and at rest?
• Has the vendor had a breach, and how did it tell its customers?
• Can the school remove a student’s account when they leave?

Step 5: make approval quick

The best process is the one teachers follow. Some ideas that work:

• Publish a list of approved apps, so teachers check it before they sign students up.
• Give teachers a one-page request form that covers Steps 1 to 4. Most requests can be decided within a week.
• Sort apps into three groups: approved, approved with conditions (for example, no student accounts, teacher-led only), and not approved.
• Review the list once a year and remove apps nobody uses.

Red flags

Say no, or ask more questions, if you see any of these:

• The privacy policy says the vendor may share data with “partners” for marketing.
• There is no way to delete student accounts.
• The app requires students to sign in with a personal social media account.
• The privacy policy was last updated years ago, or doesn’t mention children or schools at all.
• The vendor won’t sign a data agreement and won’t say why.

Summary

Check what data the app collects, confirm the school stays in control of it, read the law that applies where you are, ask four security questions, and publish an approved list. A clear process protects students and gets good apps into classrooms faster.