Student Data Brokers: Shady Practices Put Private Student Data on the Open Market

Student Data Brokers: Shady Practices Put Private Student Data on the Open Market 

Most of us are only vaguely aware of the shadowy data brokers, who buy, sell, and bundle our personal information — taking things like age, grocery purchases, education, address, magazine subscriptions, favorite apps and number of children (along with thousands of other data points, per an FTC report) to categorize us into segments like “Thrifty Elders,” “Resolute Renters” or “Metro Parents.” But even fewer people know that a marketplace for student information exists as well. And that this market may be fed by unwitting students, who turn over sensitive information that they believe they must provide in order to learn about educational opportunities and scholarships.

A new study from Fordham Law School’s Center on Law and Information Policy (CLIP) shines some light on this market — and reveals that lists of students, just like the rest of us, can be purchased based on “ethnicity, affluence, religion, lifestyle, awkwardness and even a perceived or predicted need for family planning services.” Some brokers have operated in this market for decades, and their lists include students as young as 2 years old.

While the researchers found it was not hard to purchase a list, it was hard to identify all the data brokers selling student information. And it was extremely difficult to determine how brokers compiled their lists — despite years of researcher efforts, the sources of student information remained opaque. Some brokers get information from students directly, when students fill out questionnaires and surveys handed out by teachers and counselors (which students may not realize are voluntary). Additionally, some brokers collect information from students online: Scholarships.com asks students about sensitive topics, such as disabilities and health concerns, views on political topics and sexual orientation. In addition, brokers obtain information from government sources, websites, social media and other publicly available sources.

Students presumably offer up this sensitive information in the hopes of getting college recruitments and financial assistance. And brokers do appear to share information with educational institutions and potential funders. But, as noted in the study, some brokers, like Scholarships.com, also share this information with other brokers who commercialize the information “for products and services wholly unrelated to education” — such as summer camps, weekend trips, clothing and shoes, smartphones, health and beauty products, cars and credit cards.

Such sharing, if not properly disclosed, can be illegal. Indeed, well before the study, in 2002, the FTC charged National Research Center for College and University Admissions Inc. and American Student List LLC with being unfair and deceptive in violation of Section 5 of the FTC Act, because the “companies collected extensive personal information from millions of high school students claiming that they would share the information only with colleges, universities and others providing education-related services, then also sold the information to commercial marketers.” In general, the “scholarship” arena has long been rife with fraud. The Federal Trade Commission, Department of Education and Department of Justice have fought against such fraud for decades and released multiple reports to Congress on the issue.

And, even if the sharing is deemed legal, it seems like an entirely inappropriate use of what may be extremely sensitive information students have turned over in the hopes of getting recruited to schools. Teachers, parents and students knowing this shadowy marketplace exists is a first step. But students and parents (and the public) need to know more — such as who they are giving their information to and how the information will be used and shared and what choices and controls students have. What’s more, privacy laws that require that student information — no matter how, when or from whom it is collected — be used only for educational, and not commercial, purposes could help prevent further abuse.

About the Author

Ariel Fox Johnson is Senior Counsel for Policy and Privacy at Common Sense, where she advocates for smart practices, policies, and rules to help all kids thrive in today’s wired world.  Her work focuses on child, teen, and student privacy, closing the digital divide, and families’ experiences with media and emerging technology. Ariel earned her A.B. from Harvard College and her J.D. from Harvard Law School. Prior to joining Common Sense, Ariel worked on privacy, media, intellectual property, and technology matters at corporate law firms.


Featured

  • circuit patterns

    Anthropic Intros Lower-Cost Claude Sonnet 5

    Anthropic has launched Claude Sonnet 5, positioning the model as its most autonomous mid-tier offering to date and a lower-cost alternative to its flagship Opus 4.8 system. The company said the model can plan multi-step tasks, operate tools such as browsers and terminals, and complete agentic work at a level that previously required larger and more expensive models.

  • digital lock

    CoSN: Cybersecurity and Data Privacy Remain Top AI Concerns in Education

    A leading concern for education technology leaders across the United States is the potential for AI to enable new forms of cyber attacks, according to the latest State of Ed Tech report from CoSN.

  • abstract smartphone translucent screen displaying AI interface

    Apple Unveils Redesigned Siri AI

    At its recent Worldwide Developers Conference, Apple announced Siri AI, a redesigned version of its voice assistant that Apple describes in its own announcement as "a profoundly more capable and personal assistant." The update is intended to make Siri more conversational, more context-aware, and more useful across iPhone, iPad, Mac, Apple Watch, and Vision Pro.

  • large cloud icon on the right in an abstract world above a polygon with a dark blue background

    Cloud Security Alliance Expands Agentic AI Governance Work

    The Cloud Security Alliance (CSA) has announced a series of CSAI Foundation milestones aimed at securing what it calls the agentic control plane, including a new catastrophic risk initiative, CVE Numbering Authority authorization, and the acquisition of two agentic AI specifications.