Education Week - April 11, 2018 - 10
DIGITAL DIRECTIONS > TRACKING NEWS AND IDEAS IN EDUCATIONAL TECHNOLOGY
Schools Re-Examine Facebook's Data-Privacy Protections
K-12 scrutiny follows
By Sarah Schwartz
Schools and education organizations are taking a closer look
at how they use Facebook in the
wake of a high-profile data-privacy
scandal involving the social media
The technology giant is facing
scrutiny over relevations that a
third-party consulting group collected the data of tens of millions of
Facebook users through its platform
and used the data to target political
advertising-news that has stirred
international outrage and given rise
to a social media hashtag that encourages users to #deleteFacebook.
One education research organization, the National Education Policy
Center, has deleted its Facebook page
entirely-and is suggesting schools
and districts do the same.
"Until [social media] companies are
subject to greater accountability and
transparency, schools should avoid
them," said Kevin Welner, the director of NEPC, a nonprofit that has
published papers critical of commercial companies' influence in schools.
But while some school districts are
re-examining Facebook's privacy
policies or their own security for
students and teachers in light of
the Facebook controversy, they also
say cutting out the platform completely just isn't practical.
Many school systems use Facebook
as a kind of virtual bulletin board,
pushing out information about snow
days or reminders of school events.
The platform allows districts to communicate quickly and publicly, in a
forum that they know parents and
students already frequent.
Taking a Second Look
At the heart of the controversy are
concerns about what data Facebook
collects from users, who Facebook allows to access those data, and how
those data are eventually used.
Cambridge Analytica, a political
consulting firm based in Britain
and backed by U.S. Republican donors, used data gathered in a personality quiz administered through
Facebook to create voter profiles.
The company then targeted political
advertising during the 2016 election, with the goal of swaying the
election for then-candidate Donald
Some 270,000 users downloaded
the quiz app. This gave the consulting
firm access to their profiles, and because of the way Facebook's permissions were set up at the time, it also
gave Cambridge Analytica access to
their friends' profiles. Most recently,
Facebook has said the profiles of 87
million users were affected.
The news has led some school districts to double check privacy settings
and take a closer look at what information Facebook collects and how
that information is being used.
Nancy Byrnes, the director of
technology for the Fairfield, Conn.
public schools, said after the scandal broke she devoted a weekend
to reviewing Facebook's policies
around data sharing.
Fairfield's Facebook page, run from
the central office, mostly posts reminders and announcements about
weather-related closures as well as
congratulatory posts about students'
academic and athletic achievements.
Individual schools and teachers also
administer closed Facebook groups
for students and parents-for example, a high school art department
created a group to showcase student
work. The district has reached out
to some of the administrators of the
closed groups, asking them to review
their privacy settings, too.
Conducting a careful review of social media practices is the first step
all districts should be taking in the
aftermath of the Cambridge Analytica news, said Linnette Attai, the
project director for the Consortium
for School Networking's privacy initiative, in an email. Districts should
be reviewing for what purposes
they're using the platform, and ensure they're making intentional
choices about what information
they're sharing about students.
School systems should also provide
options other than Facebook for parent communication, she said, if they
don't already offer such alternatives.
But NEPC, the education research organization that deleted its
Facebook page, recommends that
schools should try to avoid the platform altogether. It is possible for
schools to limit the "degrees of exposure" students have on Facebook,
Welner said. Districts can customize
privacy settings for school-related
groups, and teach kids not to engage with third-party applications,
such as the quiz that Cambridge
Analytica used. And at a minimum,
schools shouldn't require students
or parents to access the site for any
instructional purposes, he said.
But ultimately, he said, "It's only a
matter of mitigating. If you're using
these products, you are providing
data. That's the nature of use."
In response to a request for comment, a Facebook spokesperson suggested reviewing the company's data
policies, which are outlined publicly
on its website.
Those policies explain that the
company records users' activity on
the site. Facebook collects the content of users' posts and messages, as
well as metadata-information such
as how long someone spends looking
at a page, how often he or she visits
a certain page, or the time of day a
comment was posted.
Facebook can then use that information to choose which advertisements to show to certain users and to
personalize the ads' content.
When students and parents visit
a school district's Facebook page, the
amount of time they spend there,
and the "comments" and "likes" they
leave, can become part of the data
profile that Facebook has created for
10 | EDUCATION WEEK | April 11, 2018 | www.edweek.org
A school district page or group
gives Facebook "another data point"
on the users who visit it, said Doug
Levin, the founder and president of
EdTech Strategies, LLC.
"Those profiles are made richer by
schools pushing people in there," he
Some districts also have Facebook
trackers on their district sites, which
could give Facebook further access to
the online activities of people in the
school community. Levin's recent research report, "Tracking: EDU-Education Agency Website Security and
Privacy Practices," found that more
than 25 percent of the 159 school district websites he studied had embedded user tracking tools that reported
information back to Facebook.
These kinds of trackers can use
information about users' browsing
history and other activity across the
web-not just on Facebook-to target ads. Most school district websites
that include these trackers don't disclose in their privacy policies that the
data sharing is taking place, according to Levin's report.
Recently, Facebook created a "privacy shortcuts" page, with the goal
of making it easier to find and understand its policies. The company
also employs stricter data-privacy
standards for teenagers, limiting the
information that people can use to
search for teenagers on the platform
and disabling facial recognition technology for users under 18.
But in many cases, Facebook is
collecting the same data on teenage
users that it is for adult users.
Meeting Parents' Needs
The scale and scope of this data
collection isn't new, said Byrnes,
from Fairfield Public Schools. She
attributed the "incredulity" she's
seen after the Cambridge Analytica scandal to a lack of public
knowledge about how pervasive
data harvesting is across all social
media sites and applications, not
In Fairfield, the district won't approve instructional apps that claim
ownership of students' uploaded materials, or say they use any student
data to market advertisements, said
Byrnes. In past years, Byrnes has
instructed teachers in the district to
close public groups featuring student
But offering parents the option
to get district information via Facebook is a different situation, said
Byrnes. For one, visiting the page is
voluntary-parents can get the same
information through updates from
the district's student management
system, or Remind, a notification app
that Fairfield uses.
And parents want this information source, she said: Facebook is "a
broad-based, accepted product for the
age bracket of parents that are in our
In the Beaverton, Ore. school district, the opportunity Facebook offers
for better parent communication also
Beaverton uses Facebook simi-
4 TIPS FOR EDUCATORS
Student-data-privacy experts and
advocacy groups have offered tips for
district leaders, in the aftermath of the
Take stock of how the district is using social media.
Is it only being used by the district to put out information for
parents, or are teachers also using the platform in their classrooms? What
kind of student information is being distributed?
Ensure that students aren't pressured to use Facebook for instructional
purposes. Students shouldn't be required to communicate with teachers or
peers on the platform, or to share their work there.
Educate students on how to best avoid risk. For example, students should
know that taking a quiz on Facebook that was created by a third party-
like Cambridge Analytica-can result in their profile information being shared
with that third party.
Provide other avenues of communication for parents who aren't
comfortable using Facebook, such as regular updates to a district's
SOURCES: Consortium for School Networking and National Education Policy Center.
larly to Fairfield, posting inclement
weather updates and celebrations of
student achievements on its district
page. It's one of several digital communication tools the district uses,
said Steve Langford, the chief information officer, in an interview. It's
also one of the most effective, he said,
as students and families are already
on the platform.
Facebook also allows for fast,
large-scale communication in developing situations, like emergency
weather cancellations, said Kara
Yunck, the district's communications coordinator, who also manages the district's social media accounts. Parents can post comments
and questions, and the district can
issue an up-to-date, centralized, and
The likelihood that interaction with
the district's page will become part of
students' and parents' Facebook data
profiles is "out of our control," said
Langford. Like Byrnes, Langford
said he has a responsibility to meet
parents' needs. If some parents find
it useful to get updates through Facebook, then the district needs to be on
Langford said Beaverton doesn't
post information on the district
page that violates federal student
privacy laws or the district's own
privacy rules, and Yunck works
with teachers who create classroom Facebook pages to make
sure they're aware of privacy best
practices. The district has a digitalcitizenship curriculum and also is
launching a cybersecurity awareness campaign for staff.
But teaching educators and students about data privacy can't just
be tasked to schools, said Langford.
When social media companies have
access to personal data, it's their re-
sponsibility to be clear with consumers about how they're using the data.
This applies to Facebook, he said, but
also education vendors.
For Steve Smith, the news about
Facebook's breach of trust resurfaced concerns about a different
'Swiss Cheese' Privacy
In G-Suite for Education, Google's
web-based learning management
system used by tens of millions of
students worldwide, districts have
the option to authorize third-party
apps through the district Google account, said Smith, the chief information officer for the Cambridge Public
Schools in Massachusetts. Every
app authorized via the district could
be extracting data from a student's
school account, creating a "swiss
cheese effect" when it comes to student privacy, he said.
To prevent this, Cambridge uses
CloudLock, a tool that allows the
district to block these app authorizations.
G-Suite has faced a history of criticism-and legal action-around how
it handles student data privacy.
In 2014, the company was sued
in federal court for building hidden
profiles of users on the platform that
could be used for targeted advertising. Google told Education Week back
in 2014 that it had "scanned and
indexed" emails from millions of students using the platform, a practice
which it has since stopped. The potential exists, said Smith, for educational platforms to allow third-party
data harvesting, in a very similar
way to how Facebook gave access to
"It should be a wake-up call for districts across the country," he said.