Tag Archives: College Board privacy

Did College Board change its mind about requiring cameras on this year’s online AP exams? What security software will the online AP require?


College Board’s AP Guide said the 2021 Digital AP Exams Require Computers with Cameras–but then changed their mind?

Last week the College Board announced they were making changes to this year’s Advanced Placement exam administration, offering both paper or digital versions.  While reading about the online testing options, on the College Board website, I clicked on this 2021 AP® Exam Administration Planning Guide. (I downloaded and archived the AP Guide here on Feb 5, 2021.) 

This guide said students would  be required to use a computer that has a camera and would have to use their camera to take a picture of their photo ID prior to taking the digital AP exam.  The guide also said that schools must  “push” (install) exam application software on all devices to be used for digital testing.

The AP planning guide also said,  “The exam application includes security features to detect impersonation, plagiarism, or other cheating attempts, and restricts students from returning to answered questions or moving back and forth between unanswered questions.” [emphasis added]

 

 

I asked the College Board (on twitter) if students would be required to have their camera or microphone ON during the online tests:

February 10: College Board removed the wording about the camera requirement

Although College Board has not yet answered my Feb 8 twitter questions about the camera requirement or monitoring software, it does appear they removed any mention of  camera requirements on their updated February 10, 2021 AP Exam Administration Planning Guide It looks like College Board also removed any reference to the requirement that  students should take a picture of their photo ID with their computer camera, and upload it on the day of the exam.

However, this February 10 update does not address College Board selling/licensing of the data, nor does it address the online trackers we saw on the AP websites last year. The February 10 update also does not address what surveillance/proctoring software that schools and students will be required to upload and use.  The guidance still mentions “exam application” that technology staff will have to “push” to student devices. See text below surrounded by the red box.

https://apcentral.collegeboard.org/pdf/ap-exam-administration-planning-guide.pdf

The College Board’s lack of transparency about how it uses and shares and markets the troves of student data reminds us of the epistemic coup that Dr. Shoshana Zuboff wrote about in her recent New York Times Op-ed. 

Why it matters: College Board tracking, profiling, selling access to student data.

You will remember that last year, due to Covid-19 pandemic, the College Board administered the Advanced Placement (AP) exams in an online format for the first time. The technical problems of the online AP tests were widely reported, with students unable to complete their tests, unable to submit their answers even when they did complete the tests, and many claimed the online AP tests were discriminatory to disabled students. The 2020 botched AP tests led to a class action lawsuit against the College Board.  

In addition to the glitches and technical difficulties of the test administration, many were also concerned about hidden data collected during the online AP exams. It is well known that the College Board sells licenses to students’ personal data, such as test score ranges, names, and demographic information, and this data can be shared with third parties and even sold. 

In fact, another class action lawsuit was filed against the College Board last year for its deceptive practices, including selling student data to targeted advertisers such as Facebook.  

In 2020 Consumer Reports looked at how the College Board shared students’ data when online;  they found that the College Board was “tracking students and sending information about their activity to advertising platforms at companies such as Facebook and Google”  and “These practices seem to contradict the College Board’s explicit promises to consumers. The company may be sharing students’ information without consent.”    

We also looked at the data traffic and we found 25 trackers on the College Board’s websites–sending kids’ data to companies like YouTube, Facebook, Google, Adobe Marketing etc.  We also found Lucky Orange on the AP demo page which is a first party tracker that can record every keystroke and where the mouse moved, everything a student did on the webpage.

What monitoring software will the 2021 digital AP exam require? 

We do not know what software will be required for this year’s digital AP exams, because the College Board has not released that information yet. 

Examity?

The College Board already uses the monitoring/ proctoring software Examity for its Accuplacer tests.  Examity is one of five software proctoring companies listed in a lawsuit brought forth by Electronic Privacy Information Center (EPIC), for their “collection of personal information and the use of “secret algorithms” — amount to “unfair and deceptive trade practices.”  Interestingly, Examity has a requirement for students to submit pictures of their photo ID prior to the online exam, similar to the protocol mentioned in 2021 original AP Guide

Some other secure browser in conjunction with Cambium?

The College Board has already used another company,  Cambium Assessment, Inc.™ (CAI)for this year’s online PSAT 8/9 exam delivery.  (Cambium Assessment was formerly owned by AIR, read about their 2019 purchase here.)   According this 2020-2021 College Board SAT Educator Guide, the Cambium platform was used for the first ever online PSAT online tests: 

College Board also posted this Testing System Overview description for the Cambium-based online assessments:   

Secure Browser 

The secure browser is the student testing application used for the preadministration session as well as testing. It prevents students from using other applications and from copying test information and must be installed on all test taker devices. The secure browser you install depends on the operating system your students use.”

If your school already uses the CAI test delivery system and your students take the test on Chromebooks or iPads, you’ll need to change the assessment program in SecureTestBrowser. For Windows and Mac, you’ll need to install the College Board version of the secure browser.

Install the secure browser

Digital Test Practice

For hands-on practice administering digital tests, proctors should use the TA Interface Practice Site. Students can practice navigating the test and using the available tools in the Student Digital Test Preview.

Each site can be used independently, but we recommend also using them together to hold a test day simulation and practice allowing students into the testing session.

Proctors can also click through a short simulation on their own—no sign-on required.

Learn how to practice giving digital tests.

Student Tools

When students take the test, they’ll be able to use these tools:

  • Clock: Counts down the time left for each section and gives a 5-minute warning. Can be hidden.
  • Mark for review: Allows students to flag questions for later review.
  • Embedded Desmos calculator: Available onscreen for calculator-allowed questions.
  • Reference: Allows students to view standard mathematical formulas.
  • Notes: For digital note-taking; students also receive scratch paper.
  • Highlighter: Available for making text, questions, and answer options.
  • Line focus: Uses masking to guide students as they read.
  • Strikethrough: Allows students to eliminate answer options.
  • Zoom in/zoom out: Enlarges the text and images on a test page.

Find out which additional tools are available for students approved to test with accommodations.”

— quoted from College Board digital testing overview here: https://digitaltesting.collegeboard.org/digital-preparedness/testing-system-overview

———————————

It’s interesting that this digital PSAT 8/9 testing guidance says students can flag questions and go back to review them, as opposed to the current digital AP guidance which says the exam application  restricts students from returning to answered questions or moving back and forth between unanswered questions.” 

It is also interesting that the online PSAT tests allowed students to use iPads but the 2021 online AP tests do not allow iPads. College Board also says schools should not assign the same device to multiple students for the digital AP tests. How will that work for schools who rely on students using computer labs or chromebook carts, or students at home who share a computer with a sibling? 

Remaining questions and concerns

  • Will the College Board allow third party tracking and sharing of student data during the online AP exam?  
  • What proctoring software will the digital AP exam use?
  • Will students still need to submit a photo ID? 
  • Will students’ keystrokes be logged, screens be recorded?  
  • Will the College Board allow disabled students the same approved accommodations for paper compared to digital exams?  
  • Finally, the elephant in the room: why must kids who study hard all year, have to agree to College Board’s (constantly changing) terms of service that allows the company to sell and market their data and strips students of their rights via a forced arbitration clause? 

Forced consent is not consent, and these provisions appear to be the company’s deceptive and legally dubious attempt to get around the laws in 21 states that bar school vendors from selling student data.

Top 10 back-to-school student privacy tips and resources for parents

It’s back-to-school time for K-12 students,  which will mean for many students remote online learning, or some type of hybrid, combining in-person with screen-based instruction.   We’ve gotten lots of questions from parents and educators concerned about the opportunity for expanded student data collection and disclosure in this new regime.

Here’s a checklist of resources and tips to help protect your students’ privacy:

  1. Opt-out of Directory Information.  Schools can share Directory Information about students with third parties without parental or student consent, unless you opt-out.   FERPA,  the Family Educational Rights and Privacy Act, requires schools to notify you of your right to opt-out of Directory Information, at the beginning of the school year. (FERPA is a privacy law that applies to any educational institution that receives federal funding, which includes all public schools and many private educational institutions as well.)  See our sample Directory opt-out form and resources  here and see World Privacy Forum’s video, flyer,  more information and opt-out form here Or use this school district’s Directory opt-out form as a template to also opt-out of online recorded or video conference learning.  Why does this matter?  What can be shared without your consent, via Directory Information? .According to the US Department of Education, Directory Information can include, but is not *limited to:
    • Student’s name
    • Address
    • Telephone listing
    • Electronic mail address
    • Photograph
    • Date and place of birth
    • Major field of study
    • Dates of attendance
    • Grade level
    • Participation in officially recognized activities and sports
    • Weight and height of members of athletic teams
    • Degrees, honors, and awards received
    • The most recent educational agency or institution attended
    • Student ID number, user ID, or other unique personal identifier used to communicate in electronic systems but only if the identifier cannot be used to gain access to education records except when used in conjunction with one or more factors that authenticate the user’s identity, such as a PIN, password, or other factor known or possessed only by the authorized user
    • A student ID number or other unique personal identifier that is displayed on a student ID badge, but only if the identifier cannot be used to gain access to education records except when used in conjunction with one or more factors that authenticate the user’s identity, such as a PIN, password, or other factor known or possessed only by the authorized user. 
    • *some schools include video as Directory Information
    • Unfortunately, FERPA has been rewritten to allow other exceptions to requiring parental consent, including allowing schools to disclose student information to contractors, researchers and others – which we describe in this fact sheet. But opting out of Directory Information is a good way to start and ensure that your child’s information isn’t shared with just anyone that the school or district might like, without any restrictions on re-disclosure or how the information might be used.                                                …………………………………………………….
  2.  Many schools are using Zoom, Microsoft Teams, or Google Meet for distance learning all day long and as The Washington Post reports, kids and parents are concerned about screen time and privacy issues.  If you are using Zoom (read our What you need to know about Zoom) or other video conferencing app for distance learning, be aware of your background (ie: that poster on the wall, your little sister in the room, etc) and consider asking your teacher if you can leave your camera OFF, (and covered with a band-aid)  to protect your child’s privacy.  At the very least, when using these video conferencing tools from home, use a virtual background.   (Per this very short video: it is your civil right to turn your camera off or use a virtual background for distance learning.)  Here is a Zoom tutorial on how to do virtual backgrounds.  Remember, students under the age of 16 cannot create a Zoom account.
    • Click here to see the US Department of Education Student Privacy Policy Office information and resources regarding FERPA and Virtual Learning
    • Does FERPA prevent a parent from observing their student’s classroom, whether on Zoom or in-person?  No. 
      USDoE Privacy Office says in the (above) FERPA and Virtual Learning Related Resources
      FERPA neither requires nor prohibits individuals from observing a classroom.  Our Letter to Mamas on classroom observation is also applicable to virtual classrooms.” 
      Mamas Letter: “FERPA does not specifically prohibit a parent or professional working with the parent from observing the parent’ s child in the classroom.
    • See this FBI warning about virtual learning via video conferencing and online classroom hacking
    • Read about the class action lawsuit filed against Zoom which alleges that Zoom unlawfully shared Zoom users’ personal information with third parties. …………………………………………………………….
  3. Ask your child’s school to limit screen time, maximize hands-on learning, and use paper and pencil assignments whenever possible.  Have your child work outside in sunlight if possible. Concerns about screen time are real, as this important 2020 study states, “Over exposure to digital environments, from abuse to addiction, now concerns even the youngest (ages 0 to 2) and triggers, as argued on the basis of clear examples herein, a chain of interdependent negative and potentially long-term metabolic changes.  And this equally important 2020 JAMA analysis shows that increased screen exposure, regardless of quality, (even educational screen time) can put kids at risk for delayed development.  For a detailed list of studies and harm associated with screen time such as depression, suicide, myopia, loss of sleep, changes in brain structure and developmental delays, click here.

    ……

  4. Ask teachers what apps they are assigning your kids to use; and if they have been screened by the state or district to protect privacy and to ensure they comply with student privacy laws. Ask teachers what data is being collected by these online apps and businesses; ask to see the contracts and terms of service.  Ask whether data are encrypted and held on the district servers.  Ask your school if they allow vendors to serve ads to students–some state laws prohibit targeted advertising, and federal law COPPA, the Children’s Online Privacy Protection Act, prohibits companies from collecting certain data from children under the age of 13, without parent consent.*

  5. Ask to see the data in your child’s education record – as is your parental right under FERPA. If information in their record is wrong, you also have the right to correct it. ……………………………………………………………………….
  6. Make sure your child only enters the minimum amount of personal information necessary when creating an account or using any app (supervise them if possible if they have to create an account). Ask teachers if your child can log-in to an online tool anonymously by using anonymous credentials (ie: log-in as blue42;  and use email that does not include student name or ID). …………………………………………………………..
  7. Make sure your child isn’t signed into their school account when engaged in non-school activities online.  Clear their cookies regularly. (Cookies are a privacy risk; they collect your personal information, track you across sites, and can use and sell your information to advertisers and brokers.)  Use privacy friendly browsers like Firefox or Brave that block ads and trackers. …………………………………………………………..
  8. Location, location, location.  Turn off location tracking permissions for any app and device.  (Ask your child’s teacher to help with this.)
  9.  If your school uses Gsuite for Education (Google Classroom, gmail, Google Docs, etc.), check your student’s account settings and make sure YouTube Search/Watch History, location tracking from apps, etc are turned OFF or paused. Use a privacy friendly search engine like Duck-Duck-Go instead of Google.  (Google Search is not in the GSuite for Ed “Core Services” and as an Additional Service, if a student uses Google Search or YouTube, their data will be processed under Google’s general terms of service, where their data could be mined and used for marketing purposes.)
  10.  When signing up for College Board AP,  SAT,  PSAT or ACT remember that students do NOT have to take the questionnaire /surveys and should only fill in required information. If  students opt-out of the surveys and Student Search Services, it will NOT affect their chances of getting into a college. Opting out will only prevent ACT or College Board from selling access to your student’s score ranges and  personal and family data the student would provide on the survey.
    • The U.S. Department of Education issued significant guidance in 2018 that prohibits states or districts to allow testing companies like College Board or ACT to sell or re-disclose student assessment data, including test score ranges, without parent consent. Regarding these College Board and ACT surveys, PTAC guidance also says:

      “The survey’s multiple questions are designed to allow targeted recruitment, and students are specifically asked whether they would like to receive materials from different organizations, including colleges and scholarship organizations. For students who consent to being contacted by these organizations, the testing companies then sell this information….The administration of these tests and the associated pre-test surveys by SEAs and LEAs to students raises potential issues under the Family Educational Rights and Privacy Act (FERPA), the confidentiality of  information provisions in the Individuals with Disabilities Education Act (IDEA), the Protection of Pupil Rights Amendment (PPRA), and several recently enacted State privacy laws, and generally raises concerns about privacy best practices.”

11. We know, we said top 10, but this last one is important.  Surveillance cameras in schools sometimes have video feeds that are shared with police, such as the Highland Park Independent School District in Texas where police and also the city have access to the school’s surveillance cameras. Parents were required to agree to this surveillance and waive their student’s privacy rights before they could register their child for school.

Some school surveillance cameras are powered with AI (Artificial Intelligence)– these cameras in Greeley, Colorado schools can read expressions on people’s faces and their mannerisms and be able to tell if they look violent.  Privacy experts warn about faulty facial recognition and predictive profiling.

Surveillance apps like Bark or Gaggle collect everything a student types and flag it for risk,  alerting teachers, administrators and sometimes warranting a visit from police.

As this Washington Post article details, some schools are using invasive online proctoring apps like Proctorio, ProctorU, and Examity, requiring students to agree to  let these apps monitor their webcams, their microphones, access their computers, and give the app companies “reams of sensitive student data such as their home addresses; details about their work, parental and citizenship status; medical records, including their weight, health conditions and physical or mental disabilities; and biometric data, including fingerprints, facial images, voice recordings and “iris or retina scans.”   As CNN reports, the AI and predictive algorithms  used in proctoring programs can be biased and inaccurate; wrongly flagging a student as suspicious can cause real life harm,  and these programs raise ethical and privacy concerns.  Parents and students are feeling pressured into giving up their rights as a condition of attending school. As this EdSurge article states, privacy leaders question whether school surveillance has gone too far:

“A growing chorus of education and privacy leaders are speaking out about the role of surveillance technology and whether it belongs in America’s schools or raises more issues than it solves. “

Parents have been told that students  cannot opt out of either the surveillance cameras or proctoring apps.   We challenge schools to do better.  We encourage parents to ask for copies of these data sharing agreements, contracts, MOUs.   Talk to your school boards, talk to your legislators and let them know that students should not have to pay the price of an education at the expense of their privacy.

Check out our Parent Toolkit for Student Privacy,  for more tips on how to protect your child’s personal data.  Read this open letter from our friends at Commercial-Free Childhood and Defend digital me,  signed by the Parent Coalition for Student Privacy and over 30 advocacy groups worldwide,  asking policy makers, data protection authorities, and providers to protect kids’ rights, privacy, and well-being when they are engaged on edtech platforms.  Join us.  If you have questions about your student’s privacy, we’d love to hear from you.