Schools Choose Not to Delete Facebook Despite Data-Privacy Worries

Schools and education organizations are taking a closer look at how they use Facebook in the wake of a high-profile data-privacy scandal involving the social media company.

The technology giant is facing scrutiny over relevations that a third-party consulting group collected the data of tens of millions of Facebook users through its platform and used the data to target political advertising—news that has stirred international outrage and given rise to a social media hashtag that encourages users to #deleteFacebook.

One education research organization, the National Education Policy Center, has deleted its Facebook page entirely—and is suggesting schools and districts do the same.

“Until [social media] companies are subject to greater accountability and transparency, schools should avoid them,” said Kevin Welner, the director of NEPC, a nonprofit that has published papers critical of commercial companies’ influence in schools. But while some school districts are re-examining Facebook’s privacy policies or their own security for students and teachers in light of the Facebook controversy, they also say cutting out the platform completely just isn’t practical.

Many school systems use Facebook as a kind of virtual bulletin board, pushing out information about snow days or reminders of school events. The platform allows districts to communicate quickly and publicly, in a forum that they know parents and students already frequent.

Related Video

Facebook remains the center of attention over concerns about data privacy and sharing. How are schools reckoning with how they use the social media platform? Education Week reporter Benjamin Herold discusses on PBS NewsHour:

Taking a Second Look

At the heart of the controversy are concerns about what data Facebook collects from users, who Facebook allows to access those data, and how those data are eventually used.

Cambridge Analytica, a political consulting firm based in Britain and backed by U.S. Republican donors, used data gathered in a personality quiz administered through Facebook to create voter profiles. The company then targeted political advertising during the 2016 election, with the goal of swaying the election for then-candidate Donald Trump.

Some 270,000 users downloaded the quiz app. This gave the consulting firm access to their profiles, and because of the way Facebook’s permissions were set up at the time, it also gave Cambridge Analytica access to their friends’ profiles. Most recently, Facebook has said the profiles of 87 million users were affected.

The news has led some school districts to double check privacy settings and take a closer look at what information Facebook collects and how that information is being used.

Nancy Byrnes, the director of technology for the Fairfield, Conn. public schools, said after the scandal broke she devoted a weekend to reviewing Facebook’s policies around data sharing.

Fairfield’s Facebook page, run from the central office, mostly posts reminders and announcements about weather-related closures as well as congratulatory posts about students’ academic and athletic achievements. Individual schools and teachers also administer closed Facebook groups for students and parents—for example, a high school art department created a group to showcase student work. The district has reached out to some of the administrators of the closed groups, asking them to review their privacy settings, too.

Conducting a careful review of social media practices is the first step all districts should be taking in the aftermath of the Cambridge Analytica news, said Linnette Attai, the project director for the Consortium for School Networking‘s privacy initiative, in an email. Districts should be reviewing for what purposes they’re using the platform, and ensure they’re making intentional choices about what information they’re sharing about students.

School systems should also provide options other than Facebook for parent communication, she said, if they don’t already offer such alternatives.

But NEPC, the education research organization that deleted its Facebook page, recommends that schools should try to avoid the platform altogether. It is possible for schools to limit the “degrees of exposure” students have on Facebook, Welner said. Districts can customize privacy settings for school-related groups, and teach kids not to engage with third-party applications, such as the quiz that Cambridge Analytica used. And at a minimum, schools shouldn’t require students or parents to access the site for any instructional purposes, he said.

But ultimately, he said, “It’s only a matter of mitigating. If you’re using these products, you are providing data. That’s the nature of use.”

In response to a request for comment, a Facebook spokesperson suggested reviewing the company’s data policies, which are outlined publicly on its website.

Those policies explain that the company records users’ activity on the site. Facebook collects the content of users’ posts and messages, as well as metadata—information such as how long someone spends looking at a page, how often he or she visits a certain page, or the time of day a comment was posted.

Facebook can then use that information to choose which advertisements to show to certain users and to personalize the ads’ content.

When students and parents visit a school district’s Facebook page, the amount of time they spend there, and the “comments” and “likes” they leave, can become part of the data profile that Facebook has created for them.

A school district page or group gives Facebook “another data point” on the users who visit it, said Doug Levin, the founder and president of EdTech Strategies, LLC.

“Those profiles are made richer by schools pushing people in there,” he said.

Some districts also have Facebook trackers on their district sites, which could give Facebook further access to the online activities of people in the school community. Levin’s recent research report, “Tracking: EDU—Education Agency Website Security and Privacy Practices,” found that more than 25 percent of the 159 school district websites he studied had embedded user tracking tools that reported information back to Facebook.

These kinds of trackers can use information about users’ browsing history and other activity across the web—not just on Facebook—to target ads. Most school district websites that include these trackers don’t disclose in their privacy policies that the data sharing is taking place, according to Levin’s report.

Recently, Facebook created a “privacy shortcuts” page, with the goal of making it easier to find and understand its policies. The company also employs stricter data-privacy standards for teenagers, limiting the information that people can use to search for teenagers on the platform and disabling facial recognition technology for users under 18.

But in many cases, Facebook is collecting the same data on teenage users that it is for adult users.

Meeting Parents’ Needs

The scale and scope of this data collection isn’t new, said Byrnes, from Fairfield Public Schools. She attributed the “incredulity” she’s seen after the Cambridge Analytica scandal to a lack of public knowledge about how pervasive data harvesting is across all social media sites and applications, not just Facebook.

In Fairfield, the district won’t approve instructional apps that claim ownership of students’ uploaded materials, or say they use any student data to market advertisements, said Byrnes. In past years, Byrnes has instructed teachers in the district to close public groups featuring student work.

But offering parents the option to get district information via Facebook is a different situation, said Byrnes. For one, visiting the page is voluntary—parents can get the same information through updates from the district’s student management system, or Remind, a notification app that Fairfield uses.

And parents want this information source, she said: Facebook is “a broad-based, accepted product for the age bracket of parents that are in our community.”

In the Beaverton, Ore. school district, the opportunity Facebook offers for better parent communication also takes precedence.

Beaverton uses Facebook similarly to Fairfield, posting inclement weather updates and celebrations of student achievements on its district page. It’s one of several digital communication tools the district uses, said Steve Langford, the chief information officer, in an interview. It’s also one of the most effective, he said, as students and families are already on the platform.

Facebook also allows for fast, large-scale communication in developing situations, like emergency weather cancellations, said Kara Yunck, the district’s communications coordinator, who also manages the district’s social media accounts. Parents can post comments and questions, and the district can issue an up-to-date, centralized, and public response.

The likelihood that interaction with the district’s page will become part of students’ and parents’ Facebook data profiles is “out of our control,” said Langford. Like Byrnes, Langford said he has a responsibility to meet parents’ needs. If some parents find it useful to get updates through Facebook, then the district needs to be on Facebook.

Langford said Beaverton doesn’t post information on the district page that violates federal student privacy laws or the district’s own privacy rules, and Yunck works with teachers who create classroom Facebook pages to make sure they’re aware of privacy best practices. The district has a digital-citizenship curriculum and also is launching a cybersecurity awareness campaign for staff.

But teaching educators and students about data privacy can’t just be tasked to schools, said Langford. When social media companies have access to personal data, it’s their responsibility to be clear with consumers about how they’re using the data. This applies to Facebook, he said, but also education vendors.

For Steve Smith, the news about Facebook’s breach of trust resurfaced concerns about a different tech platform.

‘Swiss Cheese’ Privacy

In G-Suite for Education, Google’s web-based learning management system used by tens of millions of students worldwide, districts have the option to authorize third-party apps through the district Google account, said Smith, the chief information officer for the Cambridge Public Schools in Massachusetts. Every app authorized via the district could be extracting data from a student’s school account, creating a “swiss cheese effect” when it comes to student privacy, he said.

To prevent this, Cambridge uses CloudLock, a tool that allows the district to block these app authorizations.

G-Suite has faced a history of criticism—and legal action—around how it handles student data privacy.

In 2014, the company was sued in federal court for building hidden profiles of users on the platform that could be used for targeted advertising. Google told Education Week back in 2014 that it had “scanned and indexed” emails from millions of students using the platform, a practice which it has since stopped. The potential exists, said Smith, for educational platforms to allow third-party data harvesting, in a very similar way to how Facebook gave access to Cambridge Analytica.

“It should be a wake-up call for districts across the country,” he said.