Anyone who has ever downloaded a new app, opened up a new account or even visited a website has probably seen a popup prompting you to read and accept that company’s privacy policy. But like most internet users, we lazily skim through it or blindly click “I agree” so we could move on without having to spend 30 minutes reading something we may not even understand. Even in popular media, South Park creators dedicated an entire episode poking fun at those who fail to read the fine print. But understanding just how much personal data a company collects from your app usage and subsequently shares with third parties can be eye-opening.
While lounging on my couch after work earlier this week, I saw an email in my inbox alerting me that a new module had been uploaded to Blackboard. I read the summary of the week provided in the email and was excited about the topic as it was relevant to the Facebook whistleblower story and Apple’s recent privacy announcement.
Interested to see more about what was in store for the week, I clicked on my Blackboard app on my iPhone to find a popup after signing in. It was Blackboard’s Privacy, Cookies and Terms of Use page. While most mobile apps offer users a chance to opt in or out of providing data for either required or advertising cookies, Blackboard’s only option was “OK,” giving the mobile app access to my personal information, cookies and agreeing completely to their Terms of Use with no preferences to pick from.
This meant that if I wanted to proceed to this week’s assignment, I had three options:
- Option one: Read the policy, agree, then proceed
- Option two: Not read the policy and proceed; or
- Option three: Read the policy, disagree, but not be able to access my assignments
Like 97 percent of mobile users my age, I went with option two and thus began my research for this week’s assignment in irony.
What is Blackboard
Blackboard Learn is a web-based virtual learning management system that features course management and technology services. As of July 2014, Blackboard serves about 17,000 schools and organizations, and holds the highest share of the education market with more than half of K-12 districts in the US, plus 75 percent of colleges and universities, one of which includes our very own Quinnipiac University.
With more than 100 million users, I thought it would be important to look into this app to learn about what kind of personal data students and professors are unknowingly providing this company.
What I found
Last updated on December 11, 2020, Blackboard’s Privacy Policy reads a lot like most other policies that are written by lawyers for lawyers to protect the company. Thoroughly organized, the page beings with a summary of the policy with bulleted topics so you can quickly find what you’re looking for.
Blackboard goes on to disclose its privacy statement, which starts like most others do: “We care about privacy.”
“We believe that privacy is a fundamental right for all individuals. Our clients entrust us with the personal information of their employees and their users, who are often students. We take the obligations that are attached to this information very seriously. We therefore have a dedicated data privacy program with privacy by design at heart.
Our business model is different from that of companies that collect your personal information to monetize such data. We collect and use personal information to allow us to provide our products and services to our clients and end users. In most cases, we do this at the direction of our clients. We do not and will not sell or rent your data to third parties unless this is required in the context of changes to our business structure such as a merger or acquisition.”
Quote taken from Blackboard’s Privacy Policy
There is a lot to unpack in these two paragraphs alone. What quickly stood out was their comprehension that students are the majority of those using this platform, which means they have access to private information of younger users. In the second paragraph, they state they’re different from most companies that collect personal data to monetize it, but by even mentioning that, they’re telling users their information is being sold.
What data is collected?
Blackboard collects personal information, device and usage from users. Personal information collected includes: a person’s first/last name, email address, student ID, account credentials, courses a student is enrolled in, credentials, audio and video recordings and any other personal information users provide.
Blackboard’s terms also state they may collect data about student responses to quizzes, assignments and other course work and files they submit or upload, as well as their activity and actions within Blackboard.
They are sure to clarify that their collection, use and sharing of student data is governed by their contracts with the educational institutions, the provisions of FERPA, the Children’s Online Privacy Protection Act and any other law that relates to the collection and use of personal information of students.
Data sharing
“How we use your information depends on your relationship with us. What personal information we collect and how we use it will depend on your relationship with us.”
Quote taken from Blackboard’s Privacy Policy
Blackboard’s policy has a section titled “Vendors, partners & other types of disclosures” that provides information about how they engage with vendors, how they share information with partners and in which other scenarios they may share personal information with third parties.
Their terms specify that they may use third-party cookies from services like Google AdWords, Facebook Business, LinkedIn Campaign Manager and Twitter Ads to show users relevant ads. Blackboard uses and allows these third-parties to access users’ personal information so they see relevant ads and campaigns on other websites.
Additional takeaways
While they don’t provide any information about whether they keep information if a person’s account is deleted or what happens to it after a student graduate, they do note that users can email their team at privacy@blackboard.com or contact them here if anyone has any questions or concerns about their privacy statement or their data privacy practices.
When digging deep into Blackboard’s policy, I also discovered a website called Common Sense Privacy Program that evaluates privacy policies for learning tools used by teachers and parents so they can be aware of what their students and children are using in the classroom. In their Privacy Evaluation for Blackboard dated August 30, 2021, they gave the platform a score of 78 percent and labeled it as “Warning: Does not meet our recommendations for privacy and security practices.” Their analysis was extremely interesting to read after reading Blackboard’s policy straight from their website.
Conclusion
For a website millions of students and educators use on a daily basis that’s required for their success in school, it was pretty shocking how much personal data Blackboard collects, what they do with it and how many third-parties they share it with. Their privacy statement was lengthy and inundated with legalese and phrasing that isn’t easily digestible for most people. While the company made sure to add sections on understanding your own rights and children’s privacy, it wasn’t mentioned until near the end of the policy and you still discover that they can share that personal information.
This is a company so many of us are required to use, so I never thought there would be any reasons not to trust it. After reading their policy, however, I feel more inclined to question their privacy practices as I’m sure others would too. Blackboard can definitely benefit from trying harder to win their user’s trust when it comes to protecting their privacy.