The Opt Out: School devices are sharing your family’s data, but you can stop them

You are more than a data point. The Opt Out is here to help you take your privacy back.

A 6-YEAR-OLD arrives home from school with a board-of-education-provided iPad—and its more than 300 apps. One of those, a free math game, rewards speedy problem solving with virtual gems that unlock higher levels. But collecting these jewels requires an in-app purchase. “Dad, please buy it for me. My friend has it,” the child begs. Dad does, of course, perhaps not realizing his kid’s personal information, including device details and location, now feeds the $130 billion surveillance-based advertising industry that powers the internet.

To be fair to Dad (and the millions of other parents and caregivers facing similar appeals) it’s hard to fully understand the pervasiveness of online surveillance. The corporations that run the web amass personal information that is snatched up by data brokers in places as far away as Russia and China, according to a recent report by the Irish Council for Civil Liberties. And although kids have to navigate the internet as part of their schooling, little has been done to prevent the commercialization of kids’ sensitive data.

Many parents also don’t have the time to read endless privacy policies and study the complexities of the internet to keep children safe online. “I shouldn’t have to dig so deep to protect my kids’ privacy,” says Gretchen Shanahan, a mother of two in Shawnee Mission, Kansas, recalling her steep learning curve when her twins brought home their first iPads from kindergarten. These challenges are widespread: Google’s Chromebooks account for more than half of the 13 million mobile devices in K-12 schools, followed by Apple and Microsoft devices. In the last decade, the number of kids logging into Google education apps has grown to at least 30 million.

As important as it is for lawmakers to take action on data privacy, parents like Shanahan, teens, and privacy experts have learned much in their efforts to protect kids from online surveillance. In fact, tapping built-in controls and third-party apps can help make school devices minimally safe.

The grip of surveillance advertising

Behavioral—or personalized—advertising is supported by tracking technologies that follow a person’s online activity across apps and devices, collecting data that will, theoretically, help companies target them with more-enticing ads. Ad tech platforms, mainly run by Google, Meta, and Amazon, employ embedded code to pull this information from the apps and websites connected to their networks. Powered by additional user data gathered from their other web services—search engines, maps, streaming video repositories, and so on—these tech giants use this hoard of data to enhance their ability to define highly specific audiences for advertisers. It all works as part of an auction system that connects ad space buyers with suppliers, helping those three hulking platforms reap more than 70 percent of digital ad spending globally.

As it pertains to young ones, all of this happens under the watch of existing—but minimal—privacy protections. Although the Children’s Online Privacy Protection Act (COPPA), for example, has existed since 1998 to safeguard kids, many companies bypass it. In 2019, for instance, the Federal Trade Commission found that YouTube violated COPPA and made about $50 million from ads targeting children by collecting their information without parental consent—and pretending they did not know they catered to minors. Serge Egelman, director of the Berkeley Laboratory for Usable and Experimental Security, also found that more than half of child-focused apps send advertisers sensitive data from those younger than 13.

Data brokers, who collect and sell personal info, compound the problem. These parties have unregulated access to this data to build and sell profiles to whoever is willing to pay, including scammers and other criminal groups. That’s a big reason why Girard Kelly, director of the privacy program at Common Sense, a nonprofit that reviews the privacy practices of tech vendors that target kids, believes the data brokerage market should be eliminated.

All is not lost

Unlike many millennials at the same age, today’s teenagers discuss social media’s faults, including what it does to users’ mental and physical health. Take Zamaan Qureshi, a 19-year-old college student and member of the advocacy group The Real Facebook Oversight Board: He has spent at least four years calling for tech accountability and says social media companies used his generation as “guinea pigs” to grow their businesses.

This increased attention appears to be moving the privacy rights needle, but it’s just a start. In Congress, the Children and Teens’ Online Privacy Protection Act (COPPA 2.0) and the Kids Online Safety Act (KOSA) are ready for a full vote in the Senate. The first one extends COPPA’s original protections to kids up to 17 years old and bans the use of data for behavioral advertising toward kids, and the second requires social media platforms to create more safeguards to protect young users from online harassment or self-harm content.

Know the difference between payment plans 

Overall, though, being an informed consumer also goes a long way. In the app world, that means being aware of pay structure—and what that can mean for data access. A free app that nudges you for upgrades is a developer’s easiest path to a steady flow of income, Kelly says of software that costs nothing to download but has in-app purchases. He warns that even though paid apps are not all free from surveillance, they tend to be more transparent about the type of content kids and parents can expect. For example, menus within apps that cost, say, $1.99 off the bat will usually display all available features and content, while apps built around in-app purchases won’t unlock all content until you upgrade.

Since all apps come with fine print, privacy-focused reviews can help you decide if they’re safe to download. Common Sense’s ratings tool is the oldest and most trusted source in the market for evaluating game or educational apps for your child. For example, you will find that Doodle Buddy, a popular drawing app among kids, carries a Common Sense warning label for practices such as profiling users to hit them with personalized ads inside the app, and a lack of clarity on whether users’ personal data helps advertisers target them with ads on other apps and services.

Limit screen time

The less time kids are in front of a screen, the lower the odds that strangers get their hands on little ones’ personal data. If your family is entrenched in the Apple ecosystem, the company’s built-in Screen Time tool can help you monitor a child’s device. On an iPad, for example, set this up by going to Settings > Screen Time > This is My Child’s iPad, and following the prompts. You can limit hours for particular apps and dictate when it’s time to put the screen down. Whenever your kid hits their time limit, a pop-up will warn them to just let it go. They won’t be able to make changes and override this barrier unless you tell them the password to unlock the settings. Other popular operating systems and devices have similar settings.

Disable targeted advertising options on school devices

Users can also opt out of personal advertising, but companies don’t make those options easy to find. For Android devices and Chromebooks, go to your kid’s Google account page, find Privacy and Personalization, and click Ad Settings. After that, go back to the Privacy and Personalization screen, where you can further disable the option of saving web and app activity, including location and YouTube history, and set up autodeletion timeframes between three and 18 months. All iPads running iPadOS 14.5 or later will prompt you to accept or reject apps tracking you across the web for personalized ads. To set it up as the default choice, go to Settings > Privacy > Tracking, and tap the toggle to deny all apps’ requests to track you.

Buy a kid-focused phone

If the little ones are too young for a smartphone, a good starter device might be a Gabb Wireless phone. Launched in 2018, these gadgets don’t support WiFi, social media, or games, but they allow kids to communicate with their parents and specific contacts. Cosmo Technologies, launched in 2020, plans to release a similar phone in 2023.

Familiarize yourself with parental control apps

If a child insists on a smartphone, because life happens, parental control apps can help you navigate its use. The ad-free app OurPact, available for about $10 a month, allows parents to manage how much texting their kid can do in a day, filter websites across different browsers, and get alerts when the phone arrives at specific locations (like school, the playground, or a friend’s house).

Keep alert

The FTC is starting to explore what new actions it can take to crack down on surveillance and its harm to kids. California just adopted a sweeping Age-Appropriate Design Code Act that will ban profiling of users until they’re 18 years old, and that was publicly supported by teens. “Once we understand this [addiction] is by design, the conversation changes,” says Qureshi. But because consensus on federal solutions takes time to build, staying on top of what you can do with existing tools can help tilt the balance of power.

Read more PopSci+ stories.