Earlier today the US Department of Education released a letter outlining their findings against Agora Cyber Charter schools. The letter, and Future of Privacy Forum’s commentary are worth devoting some quiet time to parse through. The primary evidence for Dept. of Ed’s finding of Agora’s violation of the parent’s FERPA rights was based on the requirement that the parent consent to K12’s terms of service, and specifically this sentence
“…you grant <vendor> and its affiliates and licensees the right to use, reproduce, display, perform, adapt, modify, distribute, have distributed, and promote the content in any form, anywhere and for any purpose.”
It appears that K12 has since updated their terms to add a qualifying clause.” ..only to the extent consistent with the Family Educational Rights and Privacy Act;” on their main site as well as the related sites of fueleducation and icademy.
Two things struck me as significant about this clause that have not yet been part of the discussion.
First is that like most language in Privacy Policies and Terms of Service, the language is not unique. A simple Google search for this exact phrase turns up 597 results (with a startlingly high concentration in the racetrack industry) . Anyone that spends a lot of time reading through vendor policies knows that there is a lot of copied content. One of the first things I do when evaluating a new product is to pick three sentences at random from a policy and google them.
- Sandbox Learning
- Nassau BOCES
- Big Universe
- Kaplan University
- Connections Academy
- Pennsylvania School Board Association
Second, is that the parent had to accept a set of terms and conditions for a vendor that was presumably operating within the framework of the “School Official” exception of FERPA, meaning among other things, that they are under the direct control of the school.
If a vendor can have a valid agreement on the use of data with a parent separate from the agreement with the school, it raises several questions.
- If they contradict, does this break their status as a valid “school official”?
- In the absence of any other evidence, does one take precedence over the other?
- Did the agreement with the school contain any language about precedence?
An example of how one large Edtech vendor attempts to deal with the issue of conflict and precedence of terms is seen in Google’s G Suite for Education privacy notice.
Determining if a vendor’s terms accurately reflect their practice and untangling conflict between school and end user terms are not simple questions and they don’t have simple answers. I look forward to the conversations our industry will be having over the next few months in light of the Agora letter.