Brazil: Online Learning Tools Harvest Children’s Data

1 “Educational websites directed at Brazilian students, including two created by state education secretariats, monitored children and collected their personal data”, Human Rights Watch said today. “The national government should revise Brazil’s data protection law by adding new safeguards to protect children online”.

2 Analysis conducted by Human Rights Watch in November 2022 and reviewed again in January 2023 found that seven educational websites extracted and sent children’s data to third-party companies, using tracking technologies designed for advertising. These websites not only watched children inside of their online classrooms, but followed them across the internet, outside school hours, and deep into their private lives.

3 “Children and their families in Brazil are being kept in the dark about the data monitoring conducted on children in online classrooms,” said Hye Jung Han, children’s rights and technology researcher and advocate at Human Rights Watch. “Instead of protecting children, state governments have willfully enabled anyone to monitor them and collect their personal information online.”

4 Human Rights Watch found that five websites deployed particularly intrusive tracking techniques to invisibly spy on children in ways that were impossible to avoid or protect against. One of these websites uses session recording, a technique that allows a third party to watch and record a user’s behavior on a webpage. That includes mouse clicks and movements around a webpage; the digital equivalent of logging video monitoring each time a child scratches their nose or grasps their pencil in class. Typically, the third party would then scrutinize the data on behalf of the website to guess a user’s personality, their preferences, and what they are likely to do next, or how they might be influenced. Advertisers might use these insights to target the child with personalized content and ads that follow them across the internet.

5 Profiling, targeting, and advertising to children in this way infringes on their privacy, as it is neither proportionate nor necessary for these websites to function or deliver educational content. It also risks violating children’s other rights if this information is used to guide them toward outcomes that are harmful or not in their best interest. Such practices also play an enormous role in shaping children’s online experiences and determining the information they see, at a time in their lives when their opinions and beliefs are at high risk of manipulative interference.

6 Brazil’s data protection authority should stop these assaults on children’s privacy. It should require these companies and state governments to delete children’s data collected, and prevent them from further using children’s data for any purpose unrelated to providing education.

7 Brazil’s constitution protects the right to privacy. The country has also ratified the UN Convention on the Rights of the Child, which entitles children to special protections that guard their privacy. Brazil’s data protection law, however, – the Lei Geral de Proteção de Dados Pessoais, or the General Personal Data Protection Law – does not provide sufficient protections for children. It does not explicitly prohibit actors from exploiting children’s information or require them to provide high levels of safety and security for children. Lawmakers should amend the law to establish comprehensive child data protection rules, including bans on behavioral advertising and the use of intrusive tracking techniques on children. These rules should also require all actors offering online services to children – including online learning – to provide the highest levels of protection for children’s data and their privacy.

Available at: https://www.hrw.org/news/2023/04/03/brazil-online-learning-tools-harvest-childrens-data. Retrieved on: Feb 15, 2024. Adapted.

Brazil: Online Learning Tools Harvest Children’s Data

1 “Educational websites directed at Brazilian students, including two created by state education secretariats, monitored children and collected their personal data”, Human Rights Watch said today. “The national government should revise Brazil’s data protection law by adding new safeguards to protect children online”.

2 Analysis conducted by Human Rights Watch in November 2022 and reviewed again in January 2023 found that seven educational websites extracted and sent children’s data to third-party companies, using tracking technologies designed for advertising. These websites not only watched children inside of their online classrooms, but followed them across the internet, outside school hours, and deep into their private lives.

3 “Children and their families in Brazil are being kept in the dark about the data monitoring conducted on children in online classrooms,” said Hye Jung Han, children’s rights and technology researcher and advocate at Human Rights Watch. “Instead of protecting children, state governments have willfully enabled anyone to monitor them and collect their personal information online.”

4 Human Rights Watch found that five websites deployed particularly intrusive tracking techniques to invisibly spy on children in ways that were impossible to avoid or protect against. One of these websites uses session recording, a technique that allows a third party to watch and record a user’s behavior on a webpage. That includes mouse clicks and movements around a webpage; the digital equivalent of logging video monitoring each time a child scratches their nose or grasps their pencil in class. Typically, the third party would then scrutinize the data on behalf of the website to guess a user’s personality, their preferences, and what they are likely to do next, or how they might be influenced. Advertisers might use these insights to target the child with personalized content and ads that follow them across the internet.

5 Profiling, targeting, and advertising to children in this way infringes on their privacy, as it is neither proportionate nor necessary for these websites to function or deliver educational content. It also risks violating children’s other rights if this information is used to guide them toward outcomes that are harmful or not in their best interest. Such practices also play an enormous role in shaping children’s online experiences and determining the information they see, at a time in their lives when their opinions and beliefs are at high risk of manipulative interference.

6 Brazil’s data protection authority should stop these assaults on children’s privacy. It should require these companies and state governments to delete children’s data collected, and prevent them from further using children’s data for any purpose unrelated to providing education.

7 Brazil’s constitution protects the right to privacy. The country has also ratified the UN Convention on the Rights of the Child, which entitles children to special protections that guard their privacy. Brazil’s data protection law, however, – the Lei Geral de Proteção de Dados Pessoais, or the General Personal Data Protection Law – does not provide sufficient protections for children. It does not explicitly prohibit actors from exploiting children’s information or require them to provide high levels of safety and security for children. Lawmakers should amend the law to establish comprehensive child data protection rules, including bans on behavioral advertising and the use of intrusive tracking techniques on children. These rules should also require all actors offering online services to children – including online learning – to provide the highest levels of protection for children’s data and their privacy.

Available at: https://www.hrw.org/news/2023/04/03/brazil-online-learning-tools-harvest-childrens-data. Retrieved on: Feb 15, 2024. Adapted.

Brazil: Online Learning Tools Harvest Children’s Data

1 “Educational websites directed at Brazilian students, including two created by state education secretariats, monitored children and collected their personal data”, Human Rights Watch said today. “The national government should revise Brazil’s data protection law by adding new safeguards to protect children online”.

2 Analysis conducted by Human Rights Watch in November 2022 and reviewed again in January 2023 found that seven educational websites extracted and sent children’s data to third-party companies, using tracking technologies designed for advertising. These websites not only watched children inside of their online classrooms, but followed them across the internet, outside school hours, and deep into their private lives.

3 “Children and their families in Brazil are being kept in the dark about the data monitoring conducted on children in online classrooms,” said Hye Jung Han, children’s rights and technology researcher and advocate at Human Rights Watch. “Instead of protecting children, state governments have willfully enabled anyone to monitor them and collect their personal information online.”

4 Human Rights Watch found that five websites deployed particularly intrusive tracking techniques to invisibly spy on children in ways that were impossible to avoid or protect against. One of these websites uses session recording, a technique that allows a third party to watch and record a user’s behavior on a webpage. That includes mouse clicks and movements around a webpage; the digital equivalent of logging video monitoring each time a child scratches their nose or grasps their pencil in class. Typically, the third party would then scrutinize the data on behalf of the website to guess a user’s personality, their preferences, and what they are likely to do next, or how they might be influenced. Advertisers might use these insights to target the child with personalized content and ads that follow them across the internet.

5 Profiling, targeting, and advertising to children in this way infringes on their privacy, as it is neither proportionate nor necessary for these websites to function or deliver educational content. It also risks violating children’s other rights if this information is used to guide them toward outcomes that are harmful or not in their best interest. Such practices also play an enormous role in shaping children’s online experiences and determining the information they see, at a time in their lives when their opinions and beliefs are at high risk of manipulative interference.

6 Brazil’s data protection authority should stop these assaults on children’s privacy. It should require these companies and state governments to delete children’s data collected, and prevent them from further using children’s data for any purpose unrelated to providing education.

7 Brazil’s constitution protects the right to privacy. The country has also ratified the UN Convention on the Rights of the Child, which entitles children to special protections that guard their privacy. Brazil’s data protection law, however, – the Lei Geral de Proteção de Dados Pessoais, or the General Personal Data Protection Law – does not provide sufficient protections for children. It does not explicitly prohibit actors from exploiting children’s information or require them to provide high levels of safety and security for children. Lawmakers should amend the law to establish comprehensive child data protection rules, including bans on behavioral advertising and the use of intrusive tracking techniques on children. These rules should also require all actors offering online services to children – including online learning – to provide the highest levels of protection for children’s data and their privacy.

Available at: https://www.hrw.org/news/2023/04/03/brazil-online-learning-tools-harvest-childrens-data. Retrieved on: Feb 15, 2024. Adapted.