Are schools and universities failing to protect students’ privacy?

In February, a student at the University of Waterloo in Ontario was buying a snack from a normal-looking vending machine.  

The treat failed to dispense, and the machine displayed an error message reading:  

“Invenda.Vending.FacialRecognition.App.exe — Application Error”. 

“Hey so why do the stupid M&M machines have facial recognition?” the student asked on Reddit, in a post that led the Canadian university to remove 29 similar machines from its campuses. 

“We thank our students for bringing this matter to our attention,” university spokesperson Rebecca Elming said in a statement to CBC News. 

Swiss technology company Invenda, the company behind the so-called “stupid M&M machine”, says its snack dispensers use “people detection and facial analysis” to wake up their displays when a potential customer approaches, but maintained that they don’t recognize individual faces. 

However, students investigating the incident allege that the company also collects age and gender information, raising the question of whether privacy-invasive technologies belong in educational settings at all. 

Facial recognition in lunch queues 

In the UK, several schools have caused controversy by using biometric technologies to speed up mealtimes, including a council in North Ayrshire, Scotland, which used facial recognition technology to operate “cashless catering” across nine schools. 

For several days in September 2021, over 2,500 pupils’ faces were scanned while they waited for lunch. The students’ identities were checked against a database of headshots so that lunch money could be deducted from their accounts automatically without payment cards. 

The council was referred to the Information Commissioner’s Office (ICO) the following month. The regulator found that the project hadn’t been properly risk assessed and had failed to meet the requisite security, data retention, and consent requirements. 

While the North Ayrshire schools halted the scheme throughout the ICO’s investigation, the regulator didn’t issue a fine or even give a formal warning. In fact, the case arguably opened the door for further use of such technology in schools, provided certain conditions are met. 

US edtech privacy crackdown 

In the US, privacy in education is in the Federal Trade Commission’s (FTC) sights – and the regulator appears ready to take a more robust approach than in the UK, despite the arguably weaker set of legal tools available. 

Last May, the FTC issued a proposed order against edtech provider Edmodo, which the regulator accused of violating the Children’s Online Privacy Protection Act (COPPA). 

The FTC said Edmodo had used children’s personal information to serve them advertising on its platforms without providing notice to parents or getting their consent as COPPA requires. Edmodo had been relying on schools to do this on its behalf, but the FTC said the information given to schools was unclear. 

Edmodo was required to pay a $6 million penalty as part of the FTC’s order—which was issued under COPPA’s current rules, the bulk of which passed in 1998. The FTC is in the process of updating its COPPA Rule to broaden the law’s applicability and strengthen kids’ privacy requirements. 

States across the US, along with lawmakers at the national level, are also focused on children’s privacy, with Florida’s troubled attempts to ban social media for under 16s and the federal Kids Online Safety Act (KOSA) proposing strict online age verification requirements that could reshape the web. 

As governments struggle to figure out how to protect kids online, schools and education providers failing to take a privacy-first approach might find their practices are unsustainable in the long term.