College Board sold student data for 47 cents each, lawsuit claims

College Board, the nonprofit that develops and administers SAT and Advanced Placement exams, is being accused of selling more than five million students’ personal information, according to a lawsuit filed in Chicago last week.

The lawsuit, brought against the testing giant by the firm Loevy & Loevy on behalf of a Chicago Public Schools parent, claims that College Board used its Student Search Survey, which connects students with information about educational and financial aid opportunities, to collect and sell student information using “unfair and deceptive means,” and that the organization failed to obtain proper consent for data collection and dissemination.

By opting in to the Student Search Survey, students agree to share data — including name, grade, home address, gender and ethnicity — with colleges and scholarship programs under assurance from the College Board that their participation would assist them in the college application process. However, the complaint claims otherwise.

“College Board’s true purpose in obtaining the personal information was to sell it to third party organizations in order to increase its already substantial revenues. Between September 1, 2016 through the present, Defendant College Board charged between $0.42 and $0.47 per student name sold to a third-party organization,” the complaint states.

This action, if substantiated, could mean the College Board violated several Illinois laws, including the the Illinois School Student Records Act — which largely prohibits the release, transfer, disclosure or dissemination of student school records — and the Children’s Privacy Protection and Parental Empowerment Act — which prevents the sale or purchase of the personal information of a child under 16 years old without parental consent.

College Board claims it does not sell student information, according to its data privacy principles, but its privacy statement does disclose that “qualified colleges, universities, nonprofit scholarship services, and nonprofit educational organizations do pay a license fee to use [student] information.”

But the lawsuit claims College Board engaged in data-collection practices that violated the organization’s own privacy claims and likely confused or misled students.

Although this and similar instances of potential data-privacy violation tend to invigorate the conversation around student data, Linnette Attai, president and founder of PlayWell, a consulting firm that specializes in data-privacy compliance, told EdScoop that while this lawsuit’s outcome will be influential, she wishes it hadn’t come to this.

“There are important conversations that need to happen around privacy,”Attai said. “For schools and districts and even for companies, there is no guidance on any of these laws and we don’t have implementing regulations.”

Although student data privacy laws may have specific provisions prohibiting the sale of data, there are other requirements that are wide open to interpretation, Attai said.

“There are some other nuances that can be tricky and I think that being able to have a conversation about where the laws are and are not clear and get an official interpretation around them would be very helpful,” she said.

As of Monday, College Board has not publicly responded to the lawsuit.