Starting in May 2022, educational technology (Edtech) companies must by notice The Federal Trade Commission (FTC) says it is closely monitoring the industry to ensure student privacy protections in the digital environment. The first of these enforcement actions was announced by the FTC on October 31st. Complaints and consent agreements For Chegg, a company that provides educational products and services to high school and college students. The commission alleges that Chegg “failed to protect the personal information it collected from its users and employees,” including students’ medical and financial data and employees’ direct deposit information. The FTC’s May policy statement listed four focus areas for the commission’s investigations into edtech companies, including “security requirements,” stating that edtech providers must “ensure the confidentiality, security, and integrity of children’s personal information.” “We have to have procedures in place to maintain it.” In this case, the Commission cited Chegg’s inadequate security practices as the basis for its complaint and pointed to the harm caused by the unauthorized disclosure of confidential student and employee information. Notably, this is the Commission’s second enforcement action focused on data security. in the last month.

The Children’s Online Privacy Protection Act (COPPA) is not the basis for this enforcement action, so consumer websites that collect personal information from users should be careful. Nevertheless, the liability of edtech vendors subject to COPPA has increased, with the FTC stating in its policy statement that these companies may be liable for unfair security practices even in the absence of a violation. I warned you that there is. Therefore, it is a good time to revisit the other three areas of focus mentioned in this statement. (1) COPPA covered companies may not collect information from students beyond what is reasonably necessary to permit the student’s participation. (2) the company is only permitted to use that information; Information shall not be retained for longer than reasonably necessary to provide online educational services and (3) fulfill the purposes for which it was collected.

While we do not yet know whether COPPA will be the basis for future actions, we do know that:Action against Chegg This is part of the FTC’s aggressive efforts to ensure that education technology companies protect the personal data they collect and do not collect more information than necessary. ”