FARO stands for Frontline Record of Online Harms. Technology-related harm usually reaches the public one case at a time: a school in one country, a family in another, each easy to treat as an exception. This directory puts those cases side by side to help grassroots actors see where others face the same issues they do, and to help governments and regulators see the bigger picture of the harms occurring. The directory describes what its records contain. It does not measure how often these harms occur, and a country with few records may simply have little published about it.
How to use this directory: Topics are filterable for FARO reports that have already been created based on these incidents. The harms and response patterns shown are those featured there. To see the incidents used in a country-specific report, choose that country under Country report. Pick a pattern or evidence type to see on the map which countries have matching records. Click a country on the map or in the list to see its records below. Use the filter to search for keywords or specific sources.
Shaded countries have at least one record. Choose a pattern to see where it appears.
Shading shows only that a country has at least one record in this directory that matches your selection, and every shaded country looks the same on purpose. It says nothing about how often these harms occur there. Pattern filters only cover records classified so far, and small countries are easy to miss on a map, so use the list as well.
In the list but not drawn on the map: Multiple countries, Not stated.
A group of data workers completed accepted tasks but received no payment after a project owner withdrew.
A data worker withdrew earnings through a Nigerian payment platform using local agents and experienced a delayed payout.
A contributor says that after working on a project, their account was terminated near the payment period, and they were left chasing payment between a project manager and payment support who ignored emails. The platform replied publicly that completed and approved work is owed regardless of account status and asked for a ticket reference.
View sourceA WhatsApp group used by high school students reportedly became a venue for cyberbullying and exposure to sexual content. Participants allegedly mocked and body-shamed a 16-year-old girl after she shared a photograph of herself, and adult men who had joined the group distributed sexually explicit videos that were viewed by underage students. The account was later shared by an adult reflecting on the broader risks faced by children in online spaces.
View sourceA male freelance data worker in Kenya lost access to his accumulated earnings when his account was permanently closed by his crowdsourcing platform and his funds were frozen by the platform's associated payment processor. Consequently, he was left with no funds to pay for his sick child's medical bills.
View sourceA female freelance data worker in Kenya had her earnings taken away when her crowdsourcing platform closed her account and its connected payment processor froze her funds. This loss of income completely wiped out the savings she had been actively building up to support her newborn baby.
View sourceA freelance data worker in Kenya lost access to his earnings and had his account permanently closed when the crowdsourcing platform he worked for shut down operations and its associated digital payment processor froze his funds. As a result of this sudden loss of income, he was unable to pay his rent, was forced to seek shelter with a friend, and had to rely on others to survive.
View sourceWorkers were required to use platform-selected payout methods instead of preferred local options.
A data worker upgraded to a trainer role had funds locked for about 60 days until an appeal about the source of the higher income than usual succeeded.
In 2013, the Kenyan government launched an ambitious initiative to provide digital devices to young primary school students as part of a national digital literacy effort. However, the program faced major implementation challenges, including inadequate infrastructure, limited access to electricity, insufficient teacher training, lack of technical support, and schools unprepared to integrate the devices into learning. Reports indicated that some devices remained unused or stored away, and the project was ultimately discontinued after failing to achieve its intended impact.
View sourceWorkers seeking help for held payouts received only automated replies.
A female Kenyan data worker had her online earnings frozen and her account permanently closed after her employer and a digital payment provider blocked transactions. As a consequence, she saw her savings for her newborn baby taken away.
View sourceData workers reported being unable to access PayPal balances and receiving no explanation for holds.
An adult male Kenyan data worker had his online earnings frozen and his account permanently closed after a payment service provider and his employer blocked transactions. As a result, he was unable to afford his rent, was forced to seek shelter with a friend, and had to depend on others to survive.
View sourceAn educator reported students receiving inaccurate or culturally inappropriate information from AI systems during educational activities. The consequence described was misleading educational content. This is a personal interview. Source available to SHIELD.
A parent reported that a school application required identity numbers, phone numbers, and payment information without providing a clear privacy policy. This is a personal interview. Source available to SHIELD.
A parent reported that during the COVID-19 period government education applications collected extensive information about students and parents including names phone numbers locations and school details. The applications later disappeared and it was unclear what happened to the data. This is a personal interview. Source available to SHIELD.
A data worker described PayPal accounts being flagged and funds locked for 180 days after larger payments arrived.
A data worker was paid $0.015 per image-sorting task on a platform with a $50 withdrawal threshold, making withdrawal effectively unreachable.
The platform reportedly helped trainers recover unpaid earnings but not the broader worker population.
A private school in Kenya shared the name and exam results of a minor student with a national media group, which published them in an advertising feature of a newspaper in August 2025. This disclosure occurred without the consent of the minor's parent, who had previously objected in 2023 to such publications and received assurances from the school. Following a complaint, Kenya's Office of the Data Protection Commissioner found the school liable for unlawfully processing the minor's data for commercial purposes and violating the parent's right to object, ordering the school to pay KES 637,500 in compensation.
View sourceA data worker was paid about $8.40 through a payment service with a $50 withdrawal threshold. The service deducted $3 as a tax charge and later took the remaining $5.40 as an annual charge, leaving a zero balance.
During a university student election campaign, a 21-year-old female student was subjected to weeks of severe online harassment after endorsing a candidate in her class WhatsApp group. Classmates made vulgar comments about her body and verbally attacked her, which caused her to experience depression, retreat to her residence, and withdraw from school and student activities.
View sourceStudents reportedly submitted AI-generated assignments through copy-and-paste methods and were unable to explain the work. The consequence described was plagiarism and reduced learning outcomes. This is a personal interview. Source available to SHIELD.
Kenya Education Cloud is listed by HRW among 56 government-built or government-financed educational products found transmitting children's data to advertising technology companies. HRW's table shows it has no privacy policy.
View sourceA data worker in Kenya has a balance of about $0.16 on a task platform that requires $10 to withdraw. Task scarcity has kept the balance from growing, and the worker’s last withdrawal was more than two years ago.
The user states that the wallet company terminated their account while still holding money they worked for. They report that support has not said when it will be released.
View sourceA data worker reached only $4 after three weeks on a platform requiring $10 for withdrawal.
The Office of the Data Protection Commissioner of Kenya found a local school liable for multiple data protection violations after the school published photographs and videos of minor pupils on TikTok and Facebook for marketing purposes without obtaining parental consent. The regulator initiated an investigation after a parent filed a complaint regarding the school's stated intention to post student videos on social media despite objections from guardians. As a result of the investigation, the regulator issued an Enforcement Notice against the school.
View sourceA worker reported payout deductions that were not disclosed in advance.
A data worker said earnings returned from PayPal to the work platform could not be recovered.
A data worker objected in a group discussion that payouts were routed through a payment service the worker had never signed a contract with, and that the service taxed them. Individual assignments rarely paid more than $10, which made the service minimum withdrawal hard to reach.
Each record is a short summary of an incident described in a public source or collected through an interview by SHIELD or its partners. Records are reviewed by people before they appear here. Names and identifying details are removed: where a person appears, a role, age band and gender stand in for the name, and dates and places for minors are generalised. Every record links to its original source and shows the date that link was last checked. Records are classified with shared harm categories. The classification is SHIELD's own, so it can differ from how a source describes the incident.
You are welcome to read, link to and quote individual records with credit to FARO. Please do not copy, scrape or republish the dataset in bulk, or use it to train or test automated systems, without written permission. To ask for permission, use the SHIELD contact form. The original sources keep their own rights, and the link on each record leads to them.
SHIELD-APS. Frontline Record of Online Harms (FARO). DIRECTORY-URL. Accessed [date]. To cite a particular selection, use the web address shown after you set the filters.
When you rely on the facts of an incident, cite the original source it links to. When you rely on the classification, the patterns or the country report, cite FARO. Please describe the records as documented incidents and do not present counts or country coverage as how often these harms happen. A country with few records may simply have little published about it.
If a record is wrong, a link no longer works, or you are described in a record and want it changed or removed, use the SHIELD contact form and include the title of the record. We review each request and update or remove the record where the request is justified.
Know of a documented incident that belongs here? Send it through the incident form. A public source, such as a news report, a court or regulator decision, or a research publication, helps us verify it quickly. Submissions without a public source are kept anonymous and are not tied to named products or companies. Please leave out the names of children and of anyone who has not agreed to be named. Submissions are reviewed before anything is published, and sending one does not guarantee a record.
