Brazil: Online Learning Tools Harvesting Children’s Data, Says HRW

Educational websites directed at Brazilian students, including two created by state education secretariats, conducted surveillance on children and harvested their personal data, Human Rights Watch said Monday. The national government should amend Brazil’s data protection law by adding new safeguards to protect children online.

Analysis conducted by Human Rights Watch in November 2022 and reviewed again in January 2023 found that seven educational websites extracted and sent children’s data to third-party companies, using tracking technologies designed for advertising. The websites are: Estude em Casa, Centro de Mídias da Educação de São Paulo, Descomplica, Escola Mais, Explicaê, MangaHigh, and Stoodi. An eighth website, Revisa Enem, sent children’s data to a third-party company, though without using ad-specific trackers.

These websites not only watched children inside of their online classrooms, but followed them across the internet, outside school hours, and deep into their private lives.

“Children and their families in Brazil are being kept in the dark about the data surveillance conducted on children in online classrooms,” said Hye Jung Han, children’s rights and technology researcher and advocate at Human Rights Watch. “Instead of protecting children, state governments have willfully enabled anyone to surveil them and collect their personal information online.”

The Minas Gerais and São Paulo education secretariats originally authorized these websites for children’s use during the Covid-19 pandemic, and they remain in use. Human Rights Watch had reported in May 2022 that these and one other website infringed on children’s privacy. Following that investigation, one website, DragonLearn, was taken down from the internet.

Human Rights Watch found that five websites deployed particularly intrusive tracking techniques to invisibly surveil children in ways that were impossible to avoid or protect against.

Escola Mais’ study guides and videos were endorsed by the São Paulo education secretariat for elementary school students during Covid-19 school closures. The website now advertises technology-driven, in-person classes for elementary and high school students.

Human Rights Watch discovered Escola Mais using session recording, a technique that allows a third party to watch and record a user’s behavior on a webpage. That includes mouse clicks and movements around a webpage; the digital equivalent of logging video surveillance each time a child scratches their nose or grasps their pencil in class.

Typically, the third party would then scrutinize the data on behalf of the website to guess a user’s personality, their preferences, and what they are likely to do next. Escola Mais did not respond to four requests for comment.

Human Rights Watch also found that from 2021 to 2023, educational websites owned and operated by the education secretariats of Minas Gerais and São Paulo sent children’s personal data to advertising technology companies. Both websites continue to be regularly updated with video classes and materials for students.

In response to the investigation, the education secretariat of Minas Gerais promptly removed all ad tracking from its website. This positive development demonstrates that it is possible to build and offer educational services to children that do not compromise their data and their privacy.

The São Paulo education secretariat continues to endorse the use of seven educational websites that improperly harvest children’s personal data, including its own. It did not respond to four requests for comment from Human Rights Watch.

Human Rights Watch also found that four websites tracked children more intensely than the average adult browsing the internet.

With the exception of Revisa Enem, all websites examined by Human Rights Watch harvested vast amounts of children’s data and sent it to companies that specialize in behavioral advertising, which entails analyzing a child’s data to predict what the child might do next, or how they might be influenced. Advertisers might use these insights to target the child with personalized content and ads that follow them across the internet.

Profiling, targeting, and advertising to children in this way impermissibly infringes on their privacy, as it is neither proportionate nor necessary for these websites to function or deliver educational content. It also risks violating children’s other rights if this information is used to guide them toward outcomes that are harmful or not in their best interest. Such practices also play an enormous role in shaping children’s online experiences and determining the information they see, at a time in their lives when their opinions and beliefs are at high risk of manipulative interference.

Children could not meaningfully object to such surveillance during Covid-19 school closures. As these websites that were temporarily offered were free and widely disseminated to schools by the government, many schools adopted their use. It was impossible for many children to opt out of tracking without giving up on formal learning altogether.

Neither the Minas Gerais nor the São Paulo education secretariat appears to have checked whether their online learning endorsements were safe for children to use. Even as schools have reopened, the state governments’ dissemination of these websites during the pandemic paved the way to their continued use by students and schools.

Children continue to be denied the knowledge to challenge or protect themselves against these invasions on their privacy: Neither the state authorities nor the companies have fully disclosed their tracking practices, which are invisible to the user.

Brazil’s data protection authority should stop these assaults on children’s privacy. It should require these companies and state governments to delete children’s data collected since the pandemic, and prevent them from further using children’s data for any purpose unrelated to providing education.

Brazil’s constitution protects the right to privacy. The country has also ratified the UN Convention on the Rights of the Child, which entitles children to special protections that guard their privacy.

While the decision by Miras Gerais’ state government to remove all data surveillance from its educational website is positive, Brazil’s children should not face state-by-state variation in protection, and cannot rely on individual providers to do better. As written, Brazil’s data protection law – the Lei Geral de Proteção de Dados Pessoais, or the General Personal Data Protection Law – does not provide sufficient protections for children. It does not explicitly prohibit actors from exploiting children’s information or require them to provide high levels of safety and security for children.

Lawmakers should amend the law to establish comprehensive child data protection rules, including bans on behavioral advertising and the use of intrusive tracking techniques on children. These rules should also require all actors offering online services to children – including online learning – to provide the highest levels of protection for children’s data and their privacy.

“Children shouldn’t be coerced to give up their privacy in order to learn,” Han said. “The government should urgently adopt data protection safeguards to stop the surveillance of children online.”