On February 13, 2024, New York State's Attorney General (AG) Letitia James and the New York State Education Department (NYSED) announced a $750,000 settlement with the non-profit College Board over allegations that College Board shared and sold student personal information in violation of the state's student privacy law, New York Education Law § 2-d ("NY Student Privacy Law"). The case marks the first major settlement under the NY Student Privacy Law against a service provider or contractor and indicates regulators' readiness to target service providers or contractors who use student personal information in violation of contracts with educational agencies. It underscores the importance for companies and organizations partnering with educational agencies of understanding and complying with applicable education privacy laws, including "school official" obligations under the Family Educational Rights and Privacy Act (FERPA) and service provider or contractor obligations under state privacy laws. That essentially means ensuring that any student data they process is used strictly for authorized educational purposes, not for commercial or marketing purposes, and is shared only with necessary consent.
NY Student Privacy Law
The NY Student Privacy Law applies primarily to educational agencies, including schools and school districts. The law also places certain restrictions on "third-party contractors," defined as "any person or entity . . . that receives student data . . . from an educational agency pursuant to a contract or other written agreement for purposes of providing services to such educational agency."
Specifically, the law prohibits contractors from disclosing any student data received from an educational agency to any other party without the prior written consent of a parent or the student themselves if 18 or over. The law also prohibits contractors from selling student data or otherwise using it for marketing purposes. This is an absolute prohibition and there is no exception, even if the contractors engage in marketing activity with the consent of the parent or the student who is 18 years old or older.
College Board Student Search Service
College Board is a nonprofit organization that administers standardized tests (including the PSAT, SAT, and AP tests), primarily to high school students as part of the college admissions process. In addition, College Board operates the "Student Search" service, in which it licenses data it collects from students — including their names, contact information, ethnicity, and test scores — to customers like colleges and scholarship programs to use for recruiting students.
College Board entered into a contract with NYSED to provide exams to New York students during school hours and cover the students' exam fees. According to an investigation led by the NY State's AG office, prior to June 2022, College Board solicited students to provide information, such as their Grade Point Average (GPA), anticipated course of study, interest in a religiously affiliated college and religious activities, and parents' level of income, during the administration of exams, as well as when students signed up for a College Board online account. Even though students were not strictly required to provide this data in order to participate in "Student Search," participation was solicited within the urgent context of an important exam, and students were incentivized to sign up because doing so would connect them with scholarship and college opportunities.
In the fall of 2023, further to concerns raised by the NYSED, College Board stopped soliciting any student data as part of participation in "Student Search" in connection with its administration of school-day exams.
Settlement
An investigation by the New York State's AG and NYSED concluded that College Board (i) licensed "Student Search" personal information to third parties for student solicitation purposes, and (ii) used student data for its own marketing purposes, in violation of the New York law and its contracts with educational agencies in the state.
The settlement requires College Board to pay a $750,000 fine. Moreover, College Board is (1) prohibited from using or sharing student data that it receives pursuant to its contracts with a New York educational agency for commercial or marketing purposes; and (2) prohibited from sending students marketing materials for membership in "Student Search" or any other programs that generate student data if the data is used for commercial or marketing purposes.
Implications
Regulators at the state and federal level are increasingly turning their attention to the protection of children and teens, including student data, online, and there has been a specific focus on data collected by education technology providers within educational contexts. For example, on May 22, 2023, the Federal Trade Commission (FTC) issued a proposed order against the online learning platform Edmodo, who allegedly violated the Children's Online Privacy Protection Act (COPPA) by collecting more personal information from children than was needed for educational purposes, using and disclosing children personal information for advertising purposes, and unlawfully outsourcing its COPPA compliance responsibilities to its school customers. This FTC enforcement action followed a policy statement the FTC issued in May 2022 that warned education technology companies about forcing parents and schools to provide personal information about children in order to participate in online education.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.