This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
The FTC obtained an order against Edmodo for violating the Children's Online Privacy Protection Act (COPPA) by collecting children's personal data for advertising without parental consent and improperly delegating compliance responsibilities to schools. The company was found to have retained data indefinitely and used it to develop algorithms without proper authorization. As part of the settlement, Edmodo is required to delete any models or algorithms developed using data collected in violation of these rules.
Edmodo, an education technology provider, violated the Children's Online Privacy Protection Act Rule (COPPA Rule) by collecting and using children's personal data for advertising purposes without parental consent, according to the FTC. The company outsourced its compliance responsibilities to schools, thereby making them "solely" responsible for COPPA compliance without adequate disclosure. Edmodo is facing a proposed order prohibiting such practices, marking a precedent in the ed tech industry.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized sharing of data and information can compromise user expectation of privacy, assist identity theft, or cause loss of confidential intellectual property.
Also classified as
Edmodo failed to comply with COPPA and attempted to unlawfully outsource its legal compliance responsibilities to schools.
Edmodo unlawfully collected children's sensitive personal information (names, emails, dates of birth, phone numbers) without parental consent to serve ads and train models.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The privacy violations and illegal data collection were driven by intentional corporate decisions made by Edmodo's management to bypass COPPA and build commercial models.
The FTC and DOJ penalized educational technology company Edmodo for unlawfully collecting children's data to train machine learning models. While representing a significant domestic privacy violation and regulatory enforcement action, the incident has negligible implications for national security.
The report mentions 'models or algorithms developed using personal information' but does not describe the specific behavior, deployment mode, or operational characteristics of these models.
High Risk: The AI models were developed and deployed within an educational technology platform, which falls under the category of educational and vocational training systems affecting access to education.
The data was collected to serve advertising and build user profiles, which indicates the models/algorithms were likely used for ad targeting and behavioral profiling of students.
The FTC report provides clear, authoritative legal findings regarding Edmodo's data collection practices, COPPA violations, and the regulatory mandate to delete the developed models. While technical details of the models are absent, the legal and operational facts are highly clear.
None
Technical specifications of the models/algorithms developed and the exact number of affected children are missing.
Technology
Algorithmic Training on Illicit Data
Models and algorithms were trained on illegally collected student data.
Excessive Data Collection Systems
Systems required more personal data than necessary for educational activities.
Lack of Automated Deletion
Systems lacked automated mechanisms to delete data within reasonable timeframes.
Data Inputs
Unconsented Children Data
Personal data from children under 13 collected without parental consent.
Commercial Use of Student Data
Student data was used to serve targeted advertisements instead of education.
Lack of Data Minimization
Collection of persistent identifiers, emails, and phone numbers from kids.
Human Factors
Teacher Reliance on Platform
Teachers trusted terms of service without reviewing privacy policies.
Misleading Compliance Guidance
Platform falsely informed schools they held sole COPPA compliance duty.
No Parent Verification
Parents were bypassed in the consent process due to school outsourcing.
Process and Methods
Outsourced Compliance Process
Outsourced legal compliance responsibilities to teachers and schools.
Inadequate Notice Delivery
Failed to provide teachers with information needed to obtain proper consent.
Indefinite Data Retention Policy
Retained children's personal information indefinitely without deletion rules.
Management
Commercialization Over Compliance
Prioritized ad revenue from student profiles over privacy regulations.
Inadequate Risk Assessment
Failed to assess legal risks of training models on unconsented children data.
Deficient Privacy Governance
Lack of oversight on data collection and deletion policies before 2020.
Regulatory Environment
COPPA Compliance Violations
Failed to meet COPPA requirements for verifiable parental consent.
FTC Act Unfair Practices
Violated FTC Act by outsourcing compliance and giving confusing info.
