Blog

Coalition tells the FTC: Time is up for TiKTok

Video

 

The Parent Coalition for Student Privacy is one of twenty advocacy, consumer, and privacy groups that filed a May 14, 2020 complaint with the Federal Trade Commission (FTC), asking them to investigate and sanction TikTok, formerly Musical.ly, for continuing to violate COPPA, the Children’s Online Privacy Protection Act. The complaint argues that TikTok continues to store and collect children’s personal information without notice to and consent of parents, in violation of its 2019 order by the FTC.

If you are not familiar with TikTok, it is a very popular social media app, with 800  million worldwide users, many of them children.  TikTok allows users to record and upload videos of themselves dancing and singing and the app has more downloads than Facebook.  As this Manchester Evening News piece points out,  the recommended ages are for 12 plus, but “online safety experts say it has been designed with the young user in mind and has a very addictive appeal.”

Why this complaint is important

Because TikTok  is a popular platform for children, parents  worry that TikTok is not safe and that it puts kids at risk of sexual predation. For example, this father warned other parents after his 7 year old daughter was asked to send nude pictures of herself on TikTok. In another instance, a 35 year old Los Angeles man was allegedly targeting girls by posing as a 13 year old boy on TikTok and engaging in  “sexual and vulgar conversations with at least 21 girls, some were as young as 9”.  This February 2020 piece in Parents  says,  “TikTok allows users to contact anyone in the world, and this comes with its own host of hazards”.  The Parents piece goes on to point out that “kids can be targeted by predators, it’s easy to encounter inappropriate content”, and “Even if you set your own account to private, you may still be exposed to sexual or violent content posted to the public feed.”

There are many more concerning  examples of underage TikTok use cited in the complaint. And as the complaint notes, it is easy for a child to fake their date of birth and sign up for an adult TikTok account.

Data is money. Children’s data is valuable, predictive and can profile the user.  As the complaint states,

“TikTok collects vast amounts of personal information including videos, usage history, the content of messages sent on the platform, and geolocation.  It shares this information with third parties and uses it for targeted advertising.”

Parents want to know how TikTok is using their children’s data.  TikTok, owned by Bytedance, uses Artificial Intelligence (AI) and facial recognition.  Per this 2018 Verge article,

 “A Bytedance representative tells The Verge that TikTok makes use of the company’s AI technologies in various ways, from facial recognition for the filters through to the recommendation engine in the For You feed. “Artificial intelligence powers all of Bytedance’s content platforms,” the spokesperson says. “We build intelligent machines that are capable of understanding and analyzing text, images and videos using natural language processing and computer vision technology. This enables us to serve users with the content that they find most interesting, and empower creators to share moments that matter in everyday life to a global audience.”
TikTok also uses persistent identifiers to track kids and TikTok algorithms create profiles of children.  Per the complaint, 

 

“TikTok uses the device ID and app activity data to
run its video-selection algorithm. When a child scrolls away from the video they are watching, TikTok’s algorithm uses artificial intelligence to make sophisticated inferences from the data TikTok collects to present the next video. The algorithm “entirely interprets and decides what the user will watch instead of presenting a list of recommendations to the users like Netflix and YouTube.”

 

Using personal information in this manner exceeds the limited exceptions for personalization of content. The COPPA Rule is quite clear that information collected to support internal operations may, under no circumstances, be used “to amass a profile on a specific individual.”

 

Yet TikTok does, indeed, amass a profile of each user—including child users—and draws upon that profile to suggest videos of interest to the user. That profile may be based in part on users’ overt behavior, such as liking videos. However, TikTok also appears to amass user profiles based on passive tracking.  As reported in The New Yorker, “Although TikTok’s algorithm likely relies in part, as other systems do, on user history and video-engagement patterns, the app seems remarkably attuned to a person’s unarticulated interests.” Another article observed that the algorithm “goes right to the source using AI to map out interests and desires we may not even be able to articulate to ourselves.” The profiles that TikTok amasses on its users are designed to be used not only to curate which user-generated videos appear in each users’ stream, but also to assist with advertising. ” [Emphasis added]

 

It’s time the FTC uses its power to protect children and enforce COPPA.  The FTC should investigate TikTok,  ensure TikTok is in compliance with COPPA and its consent decree. If TikTok is found in violation, the FTC should take action and sanction TikTok again–with a fine that is proportionate to the degree of TikTok’s violations.

 

We are grateful to the Campaign for a Commercial-Free Childhood (CCFC), the Center for Digital Democracy (CDD), Institute for Public Representation Georgetown University Law Center  and many others for their work on this complaint.

 

Here is The Campaign for a Commercial-Free Childhood (CCFC) full press release.  Additional coverage of the TikTok complaint can be seen as reported in the New York Times, Financial Times, Politico, Morning Tech, and Reuters. 

Blog, press release

Eva Moskowitz and Success Academy charters found guilty of violating NY State student privacy Law

For immediate release: May 14, 2020

More information: Fatima Geidi, [email protected];   (646) 373-1344
Leonie Haimson, [email protected]; 917-435-9329

 

Eva Moskowitz and Success Academy found guilty of violating NY State student privacy Law

 

The Chief Privacy Officer of the NY State Education Department issued a ruling on Tuesday May 12 that Eva Moskowitz and Success Academy had violated Education Law 2d, the state student privacy law, that prohibits the disclosure of personal student information without parental consent except under specific conditions required to provide a student’s education.

In 2015 and thereafter, Success Academy officials published exaggerated details from the education records of Fatima Geidi’s son when he was attending Upper West Success Academy, and shared them with reporters nationwide.  They did this under Eva Moskowitz’ direction to retaliate against Ms. Geidi and her son, when they were interviewed on the PBS News Hour in 2015, about his repeated suspensions and the abusive treatment he suffered at the hands of school staff from first through third grade.

Ms. Geidi filed a student privacy complaint to the State Education Department in June of last year.  In response to her complaint, Success Academy attorneys made a number of claims, including that the statute of limitations had lapsed, that charter schools were not subject to Education Law 2D,  and that school officials have a First Amendment right to speak out about her child’s behavior.  All those claims were dismissed in the decision released yesterday by the NYSED Chief Privacy Officer, Temitope Akinyemi.

The State Education Department has now ordered Success Academy to take a number of affirmative steps, including that administrators, staff and teachers must receive annual training in data privacy, security and the federal and state laws on student privacy, that they must develop a data privacy and security policy to be submitted to the State Education Department no later than July 1, 2020, and that after that policy is approved, it must be posted on the charter school’s website and notice be provided to all officers and employees.

As Fatima Geidi said, “ I am happy that my son’s rights to privacy and hopefully all students at Success Academy from now on will be protected, and that Eva Moskowitz will be forced to stop using threats of disclosure as a weapon against any parent who dares speak out about the ways in which their children have been abused by her schools.  However, I am disappointed that the Chief Privacy Officer did not order Ms. Moskowitz to take out the section of her memoirs, The Education of Eva Moskowitz, that allegedly describes the behavior of my son.  I plan to ask my attorney to send a letter to Harper Collins, the book’s publishers, demanding that they delete that section of the book both because it contains lies and has now been found to violate both state and federal privacy law.  If they refuse, we will then go to the Attorney General’s office for relief.”

Last year, the US Department of Education also found Ms. Moskowitz and Success Academy guilty of violating FERPA, the federal student privacy law.  The official FERPA findings letter to Ms. Moskowitz is here.  Yet Ms. Moskowitz launched an appeal of that ruling on similar First Amendment grounds, with the help of Jay Lefkowitz of Kirkland and Ellis to represent her in the appeal.  Lefkowitz is the same attorney who negotiated a reduced sentence for Jeffrey Epstein, the notorious child sex abuser, in a controversial plea deal in Palm Beach County in 2007. Though Ms. Geidi has repeatedly asked the U.S. Department of Education about the outcome of this appeal, she has heard nothing in response.

As Leonie Haimson, co-chair of the Parent Coalition for Student Privacy, pointed out: “Fatima’s son is not the only child whose privacy has been violated by Success Academy.  Last year, Success shared details from the private education files of Lisa Vasquez’ daughter with reporters from  Chalkbeat without her consent, after Ms. Vasquez spoke about how her daughter had been unfairly treated at Success Academy Prospect Heights.  The SUNY Charter Institute also noted unspecified violations of FERPA by SAC Cobble Hill, SAC Crown Heights, SAC Fort Greene, SAC Harlem 2, and SAC Harlem 5 during site visits, noted in their Renewal reports.  The time for Eva Moskowitz to comply with the law and stop violating the privacy of innocent children whose parents dare to reveal her schools’ cruel policies has long passed.”

###

Blog

A model Google contract that has strong student privacy protections

We have received many questions from parents and teachers  over the last few weeks concerned about the privacy practices and policies of the various ed tech tools and programs being adopted hurriedly by schools and districts in the wake of the coronavirus crisis.  One of the most widely used programs, even before many schools were shut down, was Google classroom or G-suite.

We just received a copy of the model G-suite contract that upstate NY administrators negotiated this fall with Google that complies with NY State’s student privacy law, Education § 2-d.  Because of the relative strength of this law, New York state received a B-, the second highest grade of any state in our state privacy report card, .

Parents in NY and elsewhere should ask their districts for a copy of their contract with Google Suite to see if it includes the same or similar privacy-protective provisions.  If not, ask why, and whether their district could negotiate a similar contract, or if in NY State, simply opt into this one.  If your NY district refuses to make available the contract upon request, you should remind them that they are required to post all contracts online that allow for the disclosure of student data, according the regulations promulgated by NY State Education Department in January.

BOCES model contract with Google – G Suite 19-20

BOCES district Opt-In – Erie1 9.3.19

Blog

How to safeguard your family’s health while they use screens and digital devices

by Cindy Eckard, reposted from Screens and Kids

Some basic measures could help protect your family from avoidable aches, strains, eye health impacts and sleep disruptions while using the schools’ digital devices at home. Some of the following suggestions also relate to the potential for these devices to cause fires. Be careful.

This is not to be construed as medical advice. Consult your device manufacturer for explicit safety warnings and instructions.

However, the following suggestions have been culled over several years from a variety of professional sources identifying a broad number of associated health risks:

Princeton Univ. (ergonomics; eyestrain)
HP’s health & safety warnings
Dell’s health and safety warnings
The Sleep Foundation (blue light & sleep)
Johnson & Johnson Vision (myopia)
Prevent Blindness (blue light)
American Heart Assoc.  (kids’ screen time)
World Health Org. (gaming disorder)
OSHA/NIH (ergonomics checklist)
Oregon OSHA (improving work spaces)
Cornell University (children’s ergonomics)

Hewlett Packard’s information is extensive, and includes helpful videos – it’s a very good resource.

According to Dell (a Chromebook manufacturer) laptops were never designed to be safe full-time workstations – they require modification to make them ergonomically safer.

1. The screen should be just below eye level. Depending on the height of the user and the relative height of the surface the device is resting on, it’s likely you’ll need a monitor stand to raise the screen to the proper level.

OSHA/NIH Graphic

This lightweight, inexpensive, adjustable, folding monitor stand can be found on Amazon. It easily adjusts to the height of any user.

2. Once the monitor is raised to the correct height, the keyboard is at an awkward angle, so an external keyboard is recommended, along with a mouse (not a scratchpad).

There are many options available – here is a lightweight, inexpensive external mouse and keyboard.

Now your laptop can be used in a manner that experts suggest might help you and your child avoid discomfort or injury.

DO:
1. Sit up straight at a table or desk, with feet flat on the floor
2. Keep arms at 90-degree angle
3. Adjust the device so that the top of the monitor is just below eye level
4. Keep monitor at least 15″ from the face
5. To prevent glare, set up workstation perpendicular to windows (remove light sources from directly in front of, or behind, the monitor)
6. Blink. Keep blinking. Remind your kids to blink.
7. Take frequent breaks – stretch, get a drink of water… dance!
8. Turn off devices around sundown
9. Remove all devices from bedrooms at night
10. Consult your device manufacturer’s health and safety warning documentation

DON’T:
1. Use devices on laps, or place on beds or cushions
2. Have screen closer than 15″ from face
3. Look down at screen, or use device lying down on bed, couch or floor
4. Sit on feet, or sit slouched over device
5. Work for more than 30 minutes without a stretch/water – or dance!- break
6. Stare into monitor without blinking
7. Allow young kids to use devices without supervision, or rely on devices to keep kids occupied
8. Stay on devices – or allow kids to – close to bedtime
9. Put light source in front of or directly behind monitor
10. Allow or require kids to use devices without offering alternatives

As we all face unchartered waters in the coming days and weeks, it’s especially important that our children have the benefit of every health and safety protection we can give them.

Cindy Eckard
@screensandkids

Blog

Montgomery MD parents ask, is our children’s privacy safe when they use Google classroom?

Many districts are now using Google classroom and Chromebooks for remote instruction while schools are closed.  Below is a sample letter for Montgomery County (MD) Safe Tech Subcommittee of MCCPTA’s Health and Safety Committee, that they are encouraging parents  to send to their district to ensure their children’s privacy while using this program.

As MCPS diligently works on distribution of Chromebooks for remote learning should school be closed longer than two weeks, I, along with the MCCPTA Safe Technology subcommittee, urge MCPS to take important precautions to protect our children’s personally identifying information as part of the roll-out. Here’s why:

As you know, we’ve been trying for over half a year to secure verification from Google that our student’s data has been deleted in accordance with the Data Deletion Day policy we worked with MCPS to develop. Without any visibility into the contracts between MCPS and Google, we have no idea what Google’s obligations are with regard to our student’s data: whether, how, and when they share and use this data.

Further, the New Mexico Attorney General’s Office filed a lawsuit against Google for deceptive trade practices in terms of how it collects, shares and uses student’s personal data. The suit alleges that “children are being monitored by one of the largest data mining companies in the world [Google], at school, at home, on mobile devices, without their knowledge and without the permission of their parents.” The New Mexico AG finds that once Google accumulates student data, it shares it across all of its business segments “for its own commercial purposes” despite having promised to use it only for educational purposes.

Up until last week, kids currently only used Chromebooks in school for limited periods of time, thus exposing only a limited amount of information to Google. Once we allow students to use Chromebooks at home, they’re likely to use them for school work for exponentially more time — given social distancing, no teacher oversight, etc. This will turn the small spigot of information that currently flows to Google into a virtual fire hose.

Prior to rolling out the Chromebooks for home-based learning, MCPS must require a written promise from Google stating that they segregate student usage information from all of their other lines of business; do not share, or otherwise utilize this data for any other purpose other than to provide the educational services; will delete all student data collected during this national crisis at the end of the current school year.

Google is required to protect our children’s data under their current contract with MCPS. They would be negligent to deny this request, and ‘crisis capitalists,’ as well.

We look forward to working with you on this. As you know, my experience in the cybersecurity arena is long and deep. I have additional experience as a first responder and know the value of being prepared and staying ahead of potential damage and threats to communities. I feel strongly that we do this now, and offer my continued assistance.

Sincerely, [sign here]