Web Sites Worry Privacy Watchdogs

Dennis T. Doose, the technology director of Holy Cross High School in San Antonio, has high hopes for a new commercial service that will link his school with students’ homes over the Internet.

Called HiFusion, the McLean, Va.-based company offers families free Internet service, educational content in both English and Spanish, shopping links, and an online space where students can chat with their classmates, teachers can post homework assignments, and administrators can publish a calendar of school events.

“I expect great things from it,” said Mr. Doose, who has sent home a HiFusion computer disk with each of the school’s 530 7th through 12th graders. “If a parent wants to be up to date [on school information], go to HiFusion. That’s the way it’s going to be.”

But some privacy watchdogs characterize the free services offered by companies such as HiFusion as Trojan horses. More than just exposing students to advertising—an issue that most administrators are aware of and, to varying degrees, are willing to accept—such arrangements also give companies an opportunity to gather from children detailed personal information, such as their names, addresses, and buying preferences, those critics say.

They urge school officials to become more sophisticated in discerning what such deals involve before they sign up and to inform parents about how to protect their privacy.

“With all due respect, the schools are clueless,” said Jeff A. Chester, the executive director of the Washington-based Center for Media Education. “We certainly believe that parents should be alarmed. Schools get an F when it comes to knowledge of data collection.”

Two-Way Exchange

Educational Web sites like HiFusion, ZapMe!, ThinkWave.com, and numerous others that offer school-related content for students and, in many cases, parents and teachers are usually free to users but supported financially by companies that advertise on their sites. Privacy concerns generally result from the natural desire of those companies to learn as much as possible about their potential customers.

With a traditional advertising medium such as television or radio, “you blast your name out there to as many people as you can,” said Kevin L. Mabley, the vice president of Cyber Dialogue Inc., a New York City company that advises Internet businesses on managing customer relationships. “What’s new in the Internet is a two-way information exchange.”

Using computer records known as “cookies,” for example, which greatly simplify many aspects of surfing the World Wide Web, online companies can track an individual’s traffic on the Internet without his ever knowing it. Or, companies can encourage users to respond to surveys about their socioeconomic status or consumer preferences. They can then use the information to tailor their marketing efforts.

Mr. Mabley said he advises companies to be upfront about what information they collect and why, particularly when dealing with children.

“If it’s to support a piece of software that’s going to help parents and teachers and students interact better, that’s terrific,” Mr. Mabley said. “But if behind the scenes it’s a ploy to capture information about students so they can sell more software to them—and the next step is to sell that information to a third party—that’s when they cross the line.”

Under new federal regulations—required by the 1998 Children’s Online Privacy Protection Act—that went into effect at the end of April, companies that run Web sites for a general audience or those targeting children must spell out in privacy policies what kinds of personal information they collect from children under the age of 13 and how they will use it. The companies also must get permission from parents to collect such information. There are no such restrictions for minors 13 and older.

But parents and children rarely bother reading privacy policies, experts say. And even if they do, it’s often hard to interpret them, said Jason A. Catlett, the president of Junkbusters Corp., a Web site that advises people on how to protect their privacy. “In order to keep up with the data-collection practices of many of these companies, you need a degree in marketing and computer science,” Mr. Catlett said.

“Talk is really cheap in this business,” added Larry A. Ponemon, a partner with Price Waterhouse Coopers in New York City, who audits the privacy policies of Internet companies. “It’s going to be tough for the parents to get the facts.”

Mr. Ponemon is particularly concerned about companies that compile marketing profiles of children, through both online and offline information, that could follow them through life. “If that information isn’t controlled and secured, ... five or 10 years from now, as technology evolves, it could be very damaging for the child,” he said. “We can’t even imagine how click-through information will be used in the future.”

Marketing to Children

No one can point to any online educational companies that are collecting the names of students while they’re on school premises.

ZapMe! Corp., a San Ramon, Calif.-based company that provides free computers and Internet service at school in exchange for exposing students to advertising, has offended the sensibilities of some parents by collecting personal information such as age, gender, and school ZIP codes from students. But the information is linked to pseudonyms, so the company is never provided with the students’ identities.

What’s more disturbing to privacy advocates is the growing number of Web sites that encourage students and parents to log on for school-related information at home, where there are fewer built-in protections against potential violations of privacy.

Those advocates say school officials need to be aware that their endorsement of such sites can enable companies to collect personal information from their students, even if it doesn’t occur on school grounds.

HiFusion, for example, which was launched in April and bills itself as “the first free online service for kids and teens, parents and teachers,” was created primarily to provide a link between home and school. “When your school signs up, HiFusion becomes an even more powerful tool for you,” the Web site tells student readers. “Your teachers can post homework assignments, Web links, and other homework help, and they can even create chat rooms where you and other students can meet. Let your teachers know about HiFusion. Tell them to join.”

HiFusion differs from most other companies providing home-and-school Web spaces because it also offers a free Internet connection—a feature that company officials tout as a way to bring online access to families that otherwise couldn’t afford it. The company needs to collect some personal information from families that accept this offer, such as the name and address of the adult who registers for the service, that it wouldn’t necessarily require if it were simply running a Web site.

But some Internet-privacy watchers say they’re disturbed by the long list of other personal information that HiFusion says in its privacy policy that it may collect from children under age 13. Such information includes the child’s name, address, date of birth, sex, grade level, school name and location, parents’ credit card information, computer/Internet/videogame preferences and habits, hobbies, interests, and household demographics.

While the privacy statement says the information could be shared with advertisers only in the aggregate—not in a way that could be traced back to an individual child—it can still be used to market “directly to the child.”

This policy troubles Nancy E. Willard, a research associate at the Center for Advanced Technology in Education at the University of Oregon. “It’s unconscionable for schools to set up a partnership so that the only way you can participate in a school’s online learning is to make your child available for online marketing,” Ms. Willard said.

Joseph Turow, a professor of communication at the University of Pennsylvania’s Annenberg School for Communication, contended that such policies also have a harmful effect on children’s developing sense of information privacy. In May, Mr. Turow published a study showing that many minors age 13 and older are willing to volunteer a wide range of personal information over the Internet.

“The school is setting a model for what parents and kids should think is correct about information privacy,” Mr. Turow said. “And the use of personal information as currency for exchange is not an appropriate model for kids under age 13.”

But Anita L. Allen, a professor of law and philosophy at the University of Pennsylvania who has written a textbook on privacy law, has a different viewpoint. She reviewed the privacy statement at the request of HiFusion and, after the company incorporated some of her suggestions, said she considers it “excellent,” precisely because it is so explicit.

“HiFusion is extremely frank about its intentions of the use of information,” Ms. Allen said. “That is a great advance over past Internet businesses that intended to do all kinds of things with your information that they didn’t tell you.”

In addition, she praised HiFusion for applying for a stamp of approval on its privacy policy from TRUSTe, a nonprofit organization sponsored by the Internet industry to regulate itself that she said has rigorous standards for privacy.

Schools’ Role

Ira Fishman, HiFusion’s chief executive officer, said his critics’ concerns are unfounded. While the privacy statement says the company may market directly to the child, the company intends to do so only in “highly aggregated” groups, such as by age or gender, he said.

The reason the company needs each child’s name, he said, is so that it can set up a feature in which parents log on to their own home page and click immediately on information from teachers pertaining to their own children, such as their homework assignments.

“We’re not doing anything with [the personal information],” Mr. Fishman said. “We’re not giving it to marketers, we’re not selling it, we’ve got it protected by three firewalls. The only thing we’re collecting is the stuff we need to make the service work for them.”

But, in an indication of how quickly this market area is changing—and how sensitive companies are to parental concerns about privacy—Mr. Fishman clarified the company’s policy after a night’s reflection.

He called Education Week back and said that if a school was wary of signing up with HiFusion because of privacy issues, the company would permit parents to register their children using pseudonyms, as long as participating schools were willing to manage the lists for which pseudonym matched which child.

Mr. Doose, the Holy Cross High School technology director, said he knows HiFusion may collect personal information from children, but added that “it’s not supposed to be used in any way that’s detrimental.”

He trusts HiFusion, he said, because he is well-acquainted with the salesman in his area who is promoting it and has confidence in Mr. Fishman, who formerly directed the federal E-rate program, which offers discounts on Internet connections and other telecommunications equipment for schools and libraries.

Mr. Doose said he didn’t remember reading in the policy that personal information from children is used for marketing directly to them, but he doesn’t view it as a problem.

“I feel that parents can refuse [HiFusion], and that’s their option,” he said. “You’re not going to keep everyone happy. No one’s going to do this for nothing. You have to give up something.”

But some experts advise school officials that they bear some responsibility in investigating the privacy provisions of companies, because parents may take their endorsements as a sign that the online services are safe.

“Schools are one of the big nurturers and protectors of children,” said Loren G. Thompson, a lawyer in the advertising-practices division at the Federal Trade Commission, which wrote the rules for the new federal act on children’s privacy and is responsible for enforcing them. “They really should look closely at what the programs will do with the information they collect. Schools need to think about what their parents like and don’t like and what will benefit everyone.”

Ms. Thompson said the implementation of the rules had raised awareness of privacy issues among school administrators, although some are confused about it.

“We’ve had a lot of questions about how this works: ‘We want to use the Internet in our classrooms, but it will be difficult to get parental consent for everything we do.’ We get those kinds of questions all the time,” Ms. Thompson said.

The FTC, in conjunction with the U.S. Department of Education, plans to publish guidelines this summer on what the rules means for schools, she said.