School apps found to harvest student data

“New research is warning teachers that many of the apps used daily in classrooms are quietly collecting children’s data. Widespread tracking, opaque privacy practices and almost no meaningful oversight mean long before a student taps the screen their data is at risk. The study , funded by the University of NSW Australian Human Rights Institute, analysed close to 200 Android apps that were either recommended by state education departments, listed on school app catalogues, or appear in the Google Play Store’s “Kids” and “Educational” categories. Nearly half of these (46 per cent) were found to engage in risky data practices, with 89.3 per cent transmitting data from the moment they were opened. From this point they were sending device identifiers, location metadata and other sensitive information to analytics platforms and advertising networks. “Even if you are not interacting with the app – you just open it and that’s it – it is still transferring lots of data,” researcher and cyber security expert Dr Rahat Masood said. She described this as “tracker-related identifiers and [is] used for the automatic collection and transmission of data to remote servers.” This collection of data is known as idle telemetry. The researchers found 83.6 per cent of apps transmitted persistent identifiers and 67.9 per cent embedded at least one tracker, including Firebase, Facebook SDK and Unity Analytics – none of which are required to actually run the apps. But the biggest shock for teachers and parents may be the privacy policies themselves, with only three per cent written at a level considered “fairly easy” to read. “Nobody will understand these terminologies and jargon,” Dr Masood said. “Comprehension, readability, understandability – all these metrics that we analysed were all very bad.” Even when someone manages to read them, the policies often don’t match reality. Only one in four apps analysed were consistent with their stated disclosures, and some, the researchers said, appear to have been generated using AI tools. Child‑branded apps no safer The UNSW team also found that apps marketed to young children, with names including “kids”, “preschool” or “ABC”, on the whole were less safe than general educational apps: 76 per cent had issues versus 67 per cent. The study labels this “the illusion of safety”, where child‑friendly branding builds trust without offering genuine protection. For teachers, these findings highlight a system where the use of digital tools is often mandatory in the classroom while transparency is optional. The researchers note that Australian education is deeply digital, yet the privacy infrastructure around these tools is weak, inconsistent and largely invisible to educators. More on this story: Children at risk from sexual AI chatbots | Victoria bans phones in non-govt schools | Deepfake apps blocked to all Australians Off the back of these results, the research team is developing a ‘traffic light’ tool to help parents quickly assess an app’s privacy profile. Although this might help, it won ’ t solve all the privacy and data problems, with the team calling for stricter oversight of child‑directed apps, plain‑language privacy policies and bans on idle telemetry. The study’s authors conclude that educators cannot be expected to audit apps themselves, but they need transparency, trustworthy vetting processes, and tools that genuinely protect children’s privacy. “Australia is moving towards digital education, including from kindergarten,” Dr Masood said. “We want to analyse whether Australia, the federal government and education departments are aware of the security and privacy risks.”

Summary generated from the RSS feed of Education Review AU. All article rights belong to the original publisher. Click through to read the full piece on www.educationreview.com.au.