FTC Targets Edmodo for Unlawful Use of Children’s Data and Delegating Compliance to Schools

Edmodo, an education technology provider, violated the Children's Online Privacy Protection Act Rule (COPPA Rule) by collecting and using children's personal data for advertising purposes without parental consent, according to the FTC. The company outsourced its compliance responsibilities to schools, thereby making them "solely" responsible for COPPA compliance without adequate disclosure. Edmodo is facing a proposed order prohibiting such practices, marking a precedent in the ed tech industry.

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information

Edmodo unlawfully collected children's sensitive personal information (names, emails, dates of birth, phone numbers) without parental consent to serve ads and train models.

Additional risk subdomains

• 6.5 Governance failure: Edmodo failed to comply with COPPA and attempted to unlawfully outsource its legal compliance responsibilities to schools.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The privacy violations and illegal data collection were driven by intentional corporate decisions made by Edmodo's management to bypass COPPA and build commercial models.

EU AI Act risk tier

• Risk tier: 2 High Risk

High Risk: The AI models were developed and deployed within an educational technology platform, which falls under the category of educational and vocational training systems affecting access to education.

AI system and alleged parties

• AI system: None named
• AI purpose: Ad Delivery; Behavioral Modeling
• Behaviour type: unknown
• Alleged developer: Edmodo
• Alleged deployer: Edmodo
• Alleged harmed parties: Schools and teachers who were misinformed and burdened with COPPA compliance responsibilities without adequate disclosure, Children whose data was collected and used for advertising

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Severe. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Severe, indirect Substantial
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Privacy

Reported: Yes, the report explicitly describes widespread privacy violations of children under 13.

Directly caused: Edmodo unlawfully collected children's personal data (names, email addresses, dates of birth, phone numbers, and persistent identifiers) without parental consent for advertising and model training.

Indirectly caused: Schools and teachers were misled into taking on COPPA compliance responsibilities without adequate information, leading to unauthorized data sharing.

Inferred additional harm: Millions of children likely had their personal profiles and behavioral data permanently stored, tracked, and used for commercial profiling without their or their parents' knowledge.

People affected

• Occurrences reported: 1

Potential causes

Management

• Commercialization Over Compliance: Prioritized ad revenue from student profiles over privacy regulations.
• Inadequate Risk Assessment: Failed to assess legal risks of training models on unconsented children data.
• Deficient Privacy Governance: Lack of oversight on data collection and deletion policies before 2020.

Technology

• Algorithmic Training on Illicit Data: Models and algorithms were trained on illegally collected student data.
• Excessive Data Collection Systems: Systems required more personal data than necessary for educational activities.
• Lack of Automated Deletion: Systems lacked automated mechanisms to delete data within reasonable timeframes.

Data Inputs

• Unconsented Children Data: Personal data from children under 13 collected without parental consent.
• Commercial Use of Student Data: Student data was used to serve targeted advertisements instead of education.
• Lack of Data Minimization: Collection of persistent identifiers, emails, and phone numbers from kids.

Human Factors

• Teacher Reliance on Platform: Teachers trusted terms of service without reviewing privacy policies.
• Misleading Compliance Guidance: Platform falsely informed schools they held sole COPPA compliance duty.
• No Parent Verification: Parents were bypassed in the consent process due to school outsourcing.

Process and Methods

• Outsourced Compliance Process: Outsourced legal compliance responsibilities to teachers and schools.
• Inadequate Notice Delivery: Failed to provide teachers with information needed to obtain proper consent.
• Indefinite Data Retention Policy: Retained children's personal information indefinitely without deletion rules.

Regulatory Environment

• COPPA Compliance Violations: Failed to meet COPPA requirements for verifiable parental consent.
• FTC Act Unfair Practices: Violated FTC Act by outsourcing compliance and giving confusing info.

Information quality

• Classification confidence: High
• Reason for confidence: The FTC report provides clear, authoritative legal findings regarding Edmodo's data collection practices, COPPA violations, and the regulatory mandate to delete the developed models. While technical details of the models are absent, the legal and operational facts are highly clear.
• Ambiguities identified: The exact nature, architecture, and function of the 'models or algorithms' developed using the children's data are not specified.
• Missing information: Technical specifications of the models/algorithms developed and the exact number of affected children are missing.

The FTC and DOJ penalized educational technology company Edmodo for unlawfully collecting children's data to train machine learning models. While representing a significant domestic privacy violation and regulatory enforcement action, the incident has negligible implications for national security.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: United States
• Alleged perpetrator: Edmodo, Inc.

Threat characteristics

• Imminence: Long-term. The incident represents a past compliance failure and ongoing regulatory concern rather than an active, immediate threat to national security.
• Autonomy: Human-controlled. The AI models and algorithms were developed as passive tools under human direction, with no autonomous deployment or decision-making.
• Novelty: Established threat. COPPA violations and unauthorized commercial data collection are well-established issues with existing regulatory frameworks.

Impact by dimension

• Physical security: Negligible. The incident involves an educational technology platform and has no connection to physical systems, kinetic threats, or critical infrastructure.
• Information security: Negligible. No national security intelligence was compromised, and there were no state-sponsored information operations or espionage activities.
• Sovereignty: Negligible. The incident is a domestic regulatory enforcement action under COPPA and does not threaten state authority, elections, or core government operations.
• Economic security: Negligible. While a commercial company was penalized and suspended US operations, there was no threat to strategic industries, critical supply chains, or national technological advantages.
• Societal stability: Minor. The unlawful harvesting of children's personal data for commercial profiling represents a minor privacy and civil liberties issue, which was addressed through standard regulatory enforcement.