It’s been a tough year for students - but a good one for resistance. 

As schools have shuffled students from in-person education to at-home learning and testing, then back again, the lines between “school” and “home” have been blurred. This has made it increasingly difficult for students to protect their privacy and to freely express themselves, as online proctoring and other sinister forms of surveillance and disciplinary technology have spread. But students have fought back, and often won, and we’re glad to have been on their side. 

Dragnet Cheating Investigations Rob Students of Due Process

Early in the year, medical students at Dartmouth’s Geisel School of Medicine were blindsided by an unfounded dragnet cheating investigation conducted by the administration. The allegations were based on a flawed review of an entire year’s worth of student log data from Canvas, the online learning platform that contains class lectures and other substantive information. After a technical examination, EFF determined that the logs easily could have been generated by the automated syncing of course material to devices logged into Canvas. 

When EFF and FIRE reached out to Dartmouth and asked them to more carefully review the logs—which Canvas’ own documentation explicitly states should not be used for high-stakes analysis—we were rebuffed. With the medical careers of seventeen students hanging in the balance, the students began organizing. At first, the on-campus protest, the letter to school administrators, and the complaints of unfair treatment from the student government didn’t make much of an impact. In fact, the university administration dug in, instituting a new social media policy that seemed aimed at chilling anonymous speech that had appeared on Instagram, detailing concerns students had with how these cheating allegations were being handled. 

But shortly after news coverage of the debacle appeared in the Boston Globe and the New York Times, the administration, which had failed to offer even a hint of proper due process to the affected students, admitted it had overstepped, and dropped its allegations. This was a big victory, and helped show that with enough pushback, students can help schools understand the right and wrong ways to use technology in education. Students from all over the country have now reached out to EFF and other advocacy organizations because teachers and administrators have made flimsy claims about cheating based on digital logs from online learning platforms that don’t hold up to scrutiny. We’ve created a guide for anyone whose schools are using such logs for disciplinary purposes, and welcome any students to reach out to us if they are in a similar position. 

Online Proctoring Begins to Back Down—But the Fight Isn’t Over

During 2020 and 2021, online proctoring tools saw upwards of a 500% increase in their usage. But legitimate concerns about the invasiveness of these tools, potential bias, and efficacy were also widespread, as more people became aware of the ways that automated proctoring software, which purports to flag cheating, often flags normal test-taking behavior—and may even flag behavior of some marginalized groups more often. During the October 2020 bar exam, ExamSoft flagged more than one-third of test-takers or almost 3200 people. Human review by the Bar removed nearly all flags, leaving only 47 examinees with sanctions. In December of 2020, the U.S. Senate even requested detailed information from three of the top proctoring companies—Proctorio, ProctorU, and ExamSoft—which combined have proctored at least 30 million tests over the course of the pandemic. 

This year, we continued the fight to protect private student data from proctoring companies, and to ensure students get due process when their behavior is flagged. We took a close look at the companies’ replies to the Senate and offered our own careful interpretation of how they missed the mark. In particular, we continue to take significant issue with the companies’ use of doublespeak—claiming that their services don't flag cheating, just aberrant behavior, and human review is required for any cheating to be determined. Why then do many of the companies offer an automation-only service? You simply can’t have it both ways. 

After coming under fire, ProctorU, one of the largest online proctoring companies, announced in May that it will no longer sell fully-automated proctoring services. The company admitted that “only about 10 percent of faculty members review the video” for students who are flagged by the automated tools—leaving the grades of the vast majority of test takers at the whims of biased and faulty algorithms. This is a big win, but it doesn’t solve every problem. Human review on the company side may simply result in teachers and administrators ignoring even more potential false flags, as they further trust the companies to make the decisions for them. 

We must continue to carefully scrutinize the danger to students whenever schools outsource academic responsibilities to third-party tools, algorithmic or otherwise. And we hope legislators begin to reign in unnecessary data collection by proctoring companies with some common-sense legislation in the new year.

The New Future of Privacy Forum “Student Privacy Pledge” Has New Problems (and Old Ones)

The Future of Privacy Forum (FPF) originally launched the Student Privacy Pledge in 2014 to encourage edtech companies, which often collect very sensitive data on K-12 students, to take voluntary steps to protect privacy. In 2016, we criticized the Legacy Pledge after it reached 300 signatories—to FPF’s dismay.

This year, we carefully reviewed the new Privacy Pledge, and found it equally lacking. This matters because schools, students, and parents may believe that a company which abides by the pledge is protecting privacy in ways that it is not. The Student Privacy Pledge is a self-regulatory program, but those who choose to sign are committing to public promises that are enforceable by the Federal Trade Commission (FTC) and state attorneys general under consumer protection laws—but this is cold comfort when the pledge falls so short, and because enforcement actions against edtech companies for violating students’ privacy have been few and far between. 

The new pledge stumbles in a variety of ways. In sum: it is filled with inconsistent terminology and fails to define material terms; it lacks clarity on which parts of a company that signs the pledge must abide by it; it leaves open the question of whether companies that update certain privacy policies must notify schools; it provides a variety of unclear exceptions for activities undertaken for “authorized educational/school purposes”; it does not define any sort of minimum standard for resources companies must offer to schools about using their tools in a privacy-protective way; and it does not give any guidance as to the privacy-by-design requirements that it otherwise expresses a company should engage in. 

EFF is not opposed to voluntary mechanisms like the Student Privacy Pledge to protect users—if they work. The FTC rarely brings enforcement actions focused on student privacy, and the gaps in the Pledge don’t help. We hope the FTC and state attorneys general are willing to enforce it, but so far, its usefulness has been underwhelming, and its holes don’t help. 

Disciplinary Technology Isn’t Going Away

While we’ve made some headway in protecting student privacy during the pandemic, the threats aren’t going away. Petitions and other campaigns have helped individual schools and students, but we are still pushing for Canvas, Blackboard, and other learning tools to clarify the accuracy of their logs. And we are glad that the California Bar this year is offering free re-do’s and adjusting scores of those affected by 2021’s glitch-filled experience--but that comes on the heels of the Bar also signing a lengthy agreement with ExamSoft. Proctoring must be reined in, and used more carefully; and the only data that should be collected from students should be what is required to offer proctoring services.

EFF devoted additional resources to student privacy this year, and we’re glad we did. We’ve learned a lot about what it takes to resist school surveillance, defend young people’s free expression, and protect student privacy—and we’ll continue the fight in 2022. If you’re interested in learning more about protecting your privacy at school, take a look at our Surveillance Self-Defense guide on privacy for students.

This article is part of our Year in Review series. Read other articles about the fight for digital rights in 2021.