The US Federal Trade Commission (FTC) has issued a proposed consent order against edtech provider Edmodo, claiming that the company has violated the Children’s Online Privacy Protection Act (COPPA).
Children’s privacy is a stated FTC priority area, and Edmodo is not the only company to have been targeted by the FTC’s enforcement powers in 2023.
This article explains where Edmodo went wrong in the eyes of the FTC.
Edmodo and COPPA
Edmodo’s edtech platform provides “virtual classrooms”, enabling teachers to share materials, conduct assessments, and communicate with students.
There are premium and free versions of Edmodo’s services, which include student-facing mobile apps that collect children’s personal information from students and teachers.
COPPA was passed in 2000 and received an update in 2012 to cover edtech providers such as Edmodo.
At its core, COPPA requires certain entities to provide notice to parents and obtain their consent before collecting, using, or disclosing personal information about children under 13 (with some exceptions).
COPPA defines “personal information” as the following categories of data:
- First and last name
- Home or other physical address
- Online contact information
- Username (if it functions are online contact information)
- Phone number
- Social security number
- A persistent identifier that identifies a user over time and across websites or online services, e.g. cookie ID, IP address, device serial number, or unique device identifier
- Photograph, video, or audio file containing a child’s image or voice
- Geolocation information that identifies a street name and name of a city or town
- Information concerning the child or their parents, collected online by the operator and combined with one of the above identifiers
Edmodo is an “operator” under COPPA. The “operator” definition is complicated but effectively describes a company that collects children’s personal information in connection with providing online services to schools.
The FTC’s complaint concerns Edmodo’s activities until September 2022, when the company stopped providing its platform to US schools.
Failing to provide notice to schools
The FTC claims that Edmodo failed to provide parents or school representatives with appropriate notice before collecting, using, or disclosing children’s personal information.
Edmodo’s contracts with schools stated that the company relied on schools to provide notice to (and obtain consent from) parents, either:
- By acting on behalf of parents, or
- By acting as intermediaries between the operator and parents.
This practice is allowed under COPPA as an alternative to the operator providing notice to or obtaining consent from parents directly.
But, in order to rely on a school to provide notice to parents, an operator must provide the school with certain information about its practices.
The FTC said Edmodo failed to provide the required notice to schools. The platforms’ terms of service and privacy policy contained “confusing and inaccurate” information, and Edmodo did not ensure teachers had read the notices before children used the platforms.
As such, the company could not rely on schools to obtain consent from parents—either by acting on parents’ behalf or by acting as an intermediary between Edmodo and parents.
Failing to obtain parental consent
The FTC found that Edmodo failed to make “reasonable efforts” to obtain “verifiable parental consent” before “collecting, using, or disclosing” children’s personal information.
As noted, the FTC found that Edmodo could not rely on schools to obtain consent on parents’ behalf because it had not provided the schools with proper notice about its practices.
The FTC also pointed out that schools may only act on behalf of parents to obtain consent in “the educational context”. Edmodo collected, used, and disclosed some personal information for advertising and machine-learning purposes.
Schools could not have provided consent on behalf of parents in relation to Edmodo’s activities related to advertising and machine learning. Such consent would have needed to have come from parents directly.
Violating data retention rules
Under COPPA, operators may only retain children’s personal information for as long as necessary to fulfill the purposes for which it was collected. The FTC claims Edmodo violated this rule.
Until March 2020, the company allegedly had no data retention policy at all. After this date, Edmodo adopted a policy of deleting information after an account had been inactive for two years.
Even Edmodo’s post-March 2020 policy was deemed unacceptable by the FTC, as there was no justification for retaining children’s personal information for up to two years of inactivity.
Violating the FTC Act
On top of the alleged COPPA violations, the FTC claims Edmodo breached the FTC Act, a consumer protection law.
By having allegedly “outsourced its duty to comply with the COPPA Rule to schools or teachers without providing the schools or teachers with adequate information”, the FTC claims Edmodo’s actions “caused or are likely to cause” substantial injury to students.
The FTC Act seeks to prevent injuries to consumers that they “cannot reasonably avoid themselves” and that are “not outweighed by countervailing benefits”. The FTC says Edmodo’s reliance on teachers and schools violated this part of the law.
The FTC’s proposed consent order
Under the FTC’s proposed consent order, Edmodo must:
- Stop making children’s use of its platforms conditional on children providing unnecessary personal information.
- Fulfil certain requirements before obtaining school authorization to collect children’s personal information.
- Stop children’s personal information for non-educational purposes such as advertising or building user profiles.
- Stop using schools as intermediaries in the parental consent process.
- Implement and adhere to a valid retention schedule.
- Delete models or algorithms developed using children’s personal information collected without verifiable parental consent or school authorization.
Edmodo would also pay a $6 million monetary penalty (which has been suspended “due to the company’s inability to pay”).
How to increase student acceptance rates
Discover our guide to Higher Education Consent Management for enhanced student relationships.
In this guide, explore:
- The value of consent and preference management in education
- Leveraging granular preference management for recruitment success
- How Cassie drives universities to exceed compliance and amplify student engagement.