Hello and welcome to our special series where we share the moving stories of parents who have had to become privacy champions for their children, specifically within the school environment. These stories are about the moments when those parents realized that they needed to take action to protect their children's digital lives at school. By sharing them we aim to [00:00:30] motivate other parents to do the same.

Hello and welcome to another episode. Today I'm really excited because we're talking to Heidi Saas, who's a privacy and technology lawyer but also a parent who has gotten quite passionate about Edtech and privacy and she actually got me involved in it because we're working on a information campaign for parents to help them understand what's really going on and ask the right questions and it will culminate in a conference in [00:01:00] February.

The SHIELD Global Online Safety Conference will help people from all over the world because this is a worldwide problem which we're showing with these interviews. So Heidi, thank you so much for being here to tell your story. Can you tell us what triggered your edtech privacy passion?

Sure. Thanks for having me. Well, I am a data privacy and technology attorney. These are my personal opinions, not legal advice. But it got pretty personal for me when my children got to an age that the school was insisting [00:01:30] that they use their devices. I had resisted for quite a while because I work in this industry and I was not willing to subject my children to it for as long as possible.

So once I got to that decision, I, I dealt with the school to say I have concerns and some of the paperwork that came home with the device was also concerning. So I'm, I'm looking through the device. Number one, I can't get to any of the administrative settings. So I can't download a [00:02:00] privacy preserving browser.

I can't check the network apps for the traffic, unless I use other testing devices that they don't need to know I use. But just knowing what I know about how the data flows, I was concerned, and then one of the pamphlets that came with it said, listen, we've already signed you up for this mental help app, and just log on or snap this QR code so that you can claim your [00:02:30] account.

Well, that really bothered me because it means you already gave my data and my child's data to this app. I was opted into this by default.

Into a mental health app by the school? What's the logic in that?

Basically, that's what it's there for. And it is owned by a VC who spent billions of dollars to go in and buy an edtech tool company so that they could get free R&D data out of our children and the parents.[00:03:00]

So, I am already suspect. But when I started looking into it, I thought, I've got to be able to say no to this. Somehow, how dare you opt me into this, and my child. So, I started talking to the school about it, I started talking to other lawyers about it, and pushing back. Because the companies that buy these tools, they say they make this much on subscriptions, but they have this many millions in revenue every year. And people just don't understand that the delta between the two, [00:03:30] that money is coming from sale of our children's data.

And they built these tools in such a way, you can look back through the marketing materials for these tools, where they're telling each other in the field, build these tools in a way that the parents have to get involved. It's crucial to get parental involvement, which sounds like a nice thing, but their motivation for getting parental involvement was just to collect behavioral data.

They built nudges into these systems, so that the [00:04:00] parents would have to go in and spend time in these systems, creating behavioral data for them to collect for targeted advertising, and for whatever other purpose they want. And there's no way to say no to this. If you want to go and check on your kids homework, and you do it on your work computer, oh they just swipe the data from that computer too, because you went into that app and they say that you agreed to that at some point.

All of this is such a fiction here in this country because they're saying that, you know, they're allowed to do this because of COPPA, which is an [00:04:30] old law. It is a law that regulates private companies. The word schools isn't even mentioned in the text of this law. There's no loophole for edtech apps in COPPA.

Schools aren't in there. So, the FERPA regulates schools. That's kind of the fiction that built this whole industry, and they haven't been called out on it because the Department of Education has not done any enforcement on the FERPA, so nobody knows about it, right? And they're thinking like, you know, this is just gravy.

We're, we're [00:05:00] going to build these tools that add a modicum of convenience. But it's only in our benefit to make these people use these tools so we can collect all of this data to build other tools, to train AI, to do whatever they want to do. In their contract languages, it says, quote, to improve our services.

And that's like a loophole big enough to drive a billion-dollar industry through, apparently. So that's We've got to go to the courts now to pull [00:05:30] that back and set where the lines are for data brokers when it comes to our children's data. So I didn't want to get involved in this. I got other things I need to work on in data privacy, but I have children, you know, and I am concerned.

So I'm doing everything I can at this point to try to bring about positive change. Working with people like you and the Plunk Foundation, and Jesper, with his case in Denmark, and other parents around the world. [00:06:00] Because we should have more rights over our children's data, and all of these tools are shit. I mean, really, if you look at the productivity, the accuracy, and you know, if you test these tools to see if they even do what they claim they're supposed to do, they don't even work.

So teachers are telling me they need me to bring in more tissues and, you know, hand sanitizer, because they don't have the money. Yet we're spending hundreds of thousands of dollars on snake oil technology that doesn't even work, and [00:06:30] as a kicker, we have all of our privacy rights being violated at the same time because they're monetizing our data. So, working with parents around the world saying we're all suffering the same fate here. It's the same common targets that are imposing their will upon us.

So let's coordinate and push back and use every avenue that we have for leverage.

Yeah, this is what we're trying to do, and I've been speaking to parents and getting the same messages from a lot of them. There's two [00:07:00] things I want to ask you about that, that I keep as a non-privacy expert that's passionate about privacy.

It feels like all of this stuff with the data is very, very well hidden. Like, if you ask… “of course the data is secure!” And, you know, one of the fathers that I spoke to and I interviewed, he had one of those devices and he took it into the school and showed the superintendent of the school the data that was flowing out and they had no idea.

And if you look and ask, is the data, no, no, [00:07:30] no, we don't sell the data. How can we solve this? Because it's like one person's word against another to the extreme. And this is the thing that other parents have come up with a problem. About the efficacy of the programs, it's, you know, it's still being developed, and one of the parents heard that Jesper was fake news, and that the message was sent out to the whole school, so I just wanted to ask, like, how can we solve that?

First, kill all the lawyers. Might solve some problems, [00:08:00] but yeah. Okay, so opacity is definitely a problem when it comes to technology. That is exactly how they've been able to get along doing what they're doing with the grift. Because no one knew about it. But as time has gone on, awareness has been their biggest risk factor.

And now that people are aware of the data flows and where the cash goes, they're upset about it. And they said, you know, your privacy rights, like, what do you have to hide? Everything. Everything I have to hide. It's [00:08:30] about agency and choice. Do I want to share my data with you? Do I even know you're doing this to my data?

It's beyond disrespectful. It's criminal. Stop with all of these things that you were doing because we never said it was okay. The opacity really continues to be a large problem with technology because independent audits are the only way to verify that these tools are actually working. Like you said, the parents are showing them the traffic, and the school administrators are like clutching their pearls.

That [00:09:00] really should have been done before the tool was paid for in a vetting process with procurement procedures so that people can test and vet their tools before they integrate them into their school districts. Now, do they have enough technologists and people to, to help them with that? No. Are the contracts confusing?

Yes. You know, they're nested. So they have the, the terms and conditions, and then see this terms and conditions, and then see this cookie policy. So, I mean, you're six agreements deep into[00:09:30] these links rabbit hole to read the whole agreement to find out what in fact they are doing. When basically five of those links were telling you how they don't sell data but if you get down to the very bottom when you get to see who they're really sharing the data with it's everybody.

Yeah.

Right?

Yeah.

I, if I see you're going to, you know, I've got API calls and data transferring out to LiveRamp, that's targeted advertising. You cannot tell me you're not selling data for targeted advertising, because that is exactly what that ecosystem does. [00:10:00] So, in these instances with these tools, they've not been properly vetted, the opacity continues because the VC market saw that there is all kinds of grey area and an opportunity to make money before that grey area gets into a bright line.

So, we can make a lot of money if we do this over here until maybe someone tells us no and we can fight it, right? But there's a lot of money to be made between now and when the fight is over. So, why not continue to violate people's rights and make massive [00:10:30] profits at that? So, the VC market has come in and now some of these companies are no longer even publicly traded.

They're private held equity companies. That means they no longer have reporting and disclosure requirements to the SEC. And other trading boards so that we would have more information about what they're doing. The opacity is getting worse, so they're like, Let's make the company a black box around a whole suite of tools of black boxes and then nobody will ever get inside.

The way to get inside is through court [00:11:00] discovery. You gotta sue them, gotta get standing, then you can get to discovery, and then you can get into the tools. It shouldn't have to be that way. If they allowed independent testing, people would be able to test these tools before they would implement them into their systems.

Like if you buy a used car, you're going to look at the tires, maybe look at the engine, whether you know what you're looking at or not. You're going to drive it around. If you're smart, you take it to a mechanic for a pre-purchase inspection before you buy this car. That's just for a couple hundred dollars on a used car.

Why are we not [00:11:30] affording the same level of scrutiny to the vendors that are collecting data on our children?

Exactly. And one thing that I've noticed, and I've heard from a lot of different people, and I think it's actually impeding us making progress quite a bit, is that schools, for example, and other parents will actually get defensive if someone starts pointing these things out. They'll be like, I don't know, feel like they're being blamed for something, and the teachers won't want to talk about it, principals don't want to talk about it. There was one school where Google [00:12:00] was pitching in Spain to become the Silicon Valley, and I was like, well, if this poor principal of this school is being pitched directly by Google, what chance do they have?

So. I mean, what do you think is the best way to just, so people, you know, we're not trying to point fingers at people except for the ones that are taking the data, like, how can we move

past this? So, I did talk to the school people. I started by saying, listen, I, I don't want to throw shade at you for things you don't know.

It's just the right way to approach [00:12:30] a collaborative effort. I don't want to have a conflict right off the bat because you don't know something. I want to bring information to you that you should know. I mean, the only people talking to you about this have been the vendors, and they definitely are financially motivated to tell you whatever you want to hear.

But, I do this work and I will die on this hill. So I'm not going away, and here's what you need to know about this. Check me out if you want to, but there's a growing body of research that backs up everything I've told you so far. [00:13:00] So let's talk about how to move forward now that you are aware of what's going on, and let's move forward so that you can one, build an opt out for parents who do not want their children to participate in these digital ecosystems unless it's absolutely necessary.

Right? We want our kids to know how to use computers, but do they need to be online with all kinds of data being collected all the time? Nope. No, they don't. So, two, we need proper vetting procedures in place as part of your procurement processes. [00:13:30] Those need to be beefed up. Because I know you have people that review the contracts, but having a general counsel review a technology contract does not always mean you’re gonna to get a full understanding of what that contract means. Because they're a general counsel, and maybe they focus on these areas in education, and they don't know data privacy or, you know, international data transfers or anything in the area that I work in, because it was not in their purview.

[00:14:00] Well, it is now. So, I think one of the best things we can do is to bring forward these things of education between parents and students because the schools need to hear it from multiple sources, not just from, you know, lawyers and think tanks and things like that. They need to hear it from the faces of the people they see every day.

Like my kid will read a privacy policy and go to school and say, I read this privacy policy and it says this right here. Why do you think this is okay? And they're like, wow, I didn't know about that. And they're like, but it's right here. Why didn't you [00:14:30] read it? You know? So that's my kid. But if we could get more people, more parents involved in doing this, I think that's going to be the biggest way to bring about change as well as shining a light on these contracts themselves.

So if we start a FOIA request project and teach parents how to request through the FOIA process, Freedom of Information Act, how to request through that process, the contracts that the school administrators signed [00:15:00] behind these tools. If we could get a database of all of these contracts together, we could review them all and look and find out where they have issues or gaps. Because I'm thinking they're probably using the same agreement all over the place.

But at this point, we have different countries and those agreements from other countries as well. So when the vendor says, I can't do this for you this way, because it would be more privacy preserving, they're going to say, I can't do this for [00:15:30] you this way because it's not built that way. Yet here I am bringing up five contracts from five other countries where you in fact did do this this way because they had stronger privacy laws than we have in the US.

So I think if we can start getting everybody on board to bring forth more evidence, more network traffic from different tools that are used and captured, more exposés on the actual tools and what the tools are supposed to do versus what performance they have. The FTC [00:16:00] recently put down a case on AI because a company was claiming that they could do identification of weapons in children's school bags going into the school.

But the accuracy rate was terrible. They kept flagging bananas as weapons, and it slowed down process, and to fix it, they did a software update to increase the accuracy, but it required more humans to manually do the work. So when they sold you something to say you don't have to get magloves at the door and hire a security guard, you can just use this, you know, [00:16:30] scanning tool.

They sold it saying you wouldn't need as much help. They ended up needing more help in the human side which was more expensive just to help their tool which was snake oil. But the regulator stepped in and was like, careful what you claim about what your AI can do, and that company got in trouble. That is a case by case analysis going through the different tools.

We need broader rules across the board to say all of the tools have to be properly vetted. I think the Fair Credit Reporting Act could do some work here. [00:17:00] Education is one of the protected areas under the Fair Credit Reporting Act and the agency, the CFPD, is working very hard to bring back our protections under the Fair Credit Reporting Act.

I think that will have a big change on the digital ad tech ecosystem, which will definitely, and should definitely, inhibit their ability to operate this way in the school systems. Like I said before, it's a grey area, how long is it going to take before the changes are actually implemented, and we see those protections in place? It might be a while.[00:17:30]

But we're working on getting there, so I think all the efforts that we have ongoing with raising awareness, getting parents involved, giving them a voice so that they know how and where to push back. Educating our children to say here's what's happening behind what you see on the screen. So make better choices without clicking I accept if you really don't need to be in there or download another app, just say no.

One thing I wanted to highlight because I don't see enough people aware of this, is what you said about the kids, getting the kids involved. Because a lot of times we think as parents [00:18:00] we need to solve it for the kids, but they are so much better digitally than most of us. Then we have to solve it with the kids.

And I was speaking to a young person just a few hours ago, and she told me, all of you older generations think that we don't care about our privacy, but we do care about our privacy more than you think. So you don't necessarily even have to say, I need to solve this for my kids.

Yeah, I think that's exactly right.

The better that we are in bringing everybody on [00:18:30] board with this mission, the better results we're going to see. Because not all school districts are created equally. And so, it's going to take quite a while to move through, uh, these tools, because I suspect they're going to get blown up in courts, and then they're going to modify their tool and say everything's okay until they get tested again and blown up again, you know, because there's just so much money involved, right?

And like you said, it's hard to see what they're doing. Like, if somebody's stealing from your apple cart on the sidewalk, [00:19:00] you can see them stealing from you. Right? But if you are in the digital world, you're standing there, and you're looking the other way the entire time. You never know what's happening to your cart of apples.

Everybody's feeling it from you. So, we gotta get people to like, turn around and take off the blinders and see what's happened.

Exactly.

Right?

They're taking the apples and multiplying them.

Yeah. Yeah. Turning it into, you know, all kinds of money for them on the other side. Now, you know, and the schools are not in a position to be throwing money away.

So, [00:19:30] it's kind of one of those situations, like, look at that. What are we doing here? Like really, what are we doing here? Why are we not paying attention to this? Honestly, I did not want to pay attention to this. I'm busy. I'm working on other things. I did not want to have to pay attention to the educational tech space, but I didn't have an option because there are my sweet innocent children looking at me going, well, what do I do?

So, it's, it's turned into an issue and I'm going to do… My rights aren't going to be violated [00:20:00] without some sort of remedy here, I, this has, this has to change, right, so I'm excited the progress is being made, and I'm grateful for all the help that I've gotten so far from all the people that have jumped in, the amount of evidence people are gathering is overwhelming.

We are all experiencing the same problems from the same toolmakers. So, I think the sooner that we, you know, get this show on the road in February with this conference series that you're doing, I think the better. Because people feel [00:20:30] apathetic because they don't know where they have grounding to stand.

Yes.

So, if we speak up, we will make space for those to find their ground and stand with us.

Yes. Perfect. Thank you. That's the perfect way to end. And thank you for explaining all of this in ways that we can all understand, because it's so important. Yeah. Awesome. So we're moving this forward with passion. I got researchers working on multiple projects in multiple continents right now.

My signal has been going nuts for [00:21:00] days. It really is thrilling. It's exciting.

We encourage all parents and loved ones to ensure that the digital footprints their children create at school are treated with the respect and care they deserve. If your school or area hasn't yet leaned heavily into technology at school, we hope these stories will help you ask the right questions when they do.

If you have a story to share, would like more info on these issues, or would like to contribute in any way, please contact [00:21:30] us. Together we can make a difference in safeguarding our children's digital futures.

Digital Dominoes.