FARO stands for Frontline Record of Online Harms. Technology-related harm usually reaches the public one case at a time: a school in one country, a family in another, each easy to treat as an exception. This directory puts those cases side by side to help grassroots actors see where others face the same issues they do, and to help governments and regulators see the bigger picture of the harms occurring. The directory describes what its records contain. It does not measure how often these harms occur, and a country with few records may simply have little published about it.
How to use this directory: Topics are filterable for FARO reports that have already been created based on these incidents. The harms and response patterns shown are those featured there. To see the incidents used in a country-specific report, choose that country under Country report. Pick a pattern or evidence type to see on the map which countries have matching records. Click a country on the map or in the list to see its records below. Use the filter to search for keywords or specific sources.
Shaded countries have at least one record. Choose a pattern to see where it appears.
At least one matching recordNo matching recordSelected country
Shading shows only that a country has at least one record in this directory that matches your selection, and every shaded country looks the same on purpose. It says nothing about how often these harms occur there. Pattern filters only cover records classified so far, and small countries are easy to miss on a map, so use the list as well.
Tasmania, Australia – AI-generated deepfake nude images of students
Students at a school in Australia used an AI application to create and circulate deepfake nude images of fellow students, prompting public criticism of the school's response and a wider community inquiry. This is the creation and distribution of non-consensual intimate imagery of minors by other minors, not passive access to existing pornographic content.
Teacher Absences and Schedules Unlawfully Exposed on Public Website and Electronic Register
An Italian public school published the service hours and recess surveillance shifts of teachers, including an adult teacher, on its public website. Additionally, instead of using a restricted administrative module, the school utilized the public bulletin board function of an electronic register platform to manage teacher absences and substitutions, thereby exposing the teacher's absences to unauthorized colleagues, students, and parents. The Italian Data Protection Authority ruled this was an unlawful communication of personal data and fined the school.
Source: Garante per la protezione dei dati personali
Teacher Coerced by Administrator to Hand Over Personal Phone for App Installation
A teacher was forced by their school's vice principal to hand over their personal mobile phone to have a mandatory school emergency application installed. This occurred after the school district mandated that staff members install the tracking app on their personal devices.
Teacher convicted for lowering two grades already recorded on the electronic register, Lombardy, Italy
A female upper secondary school student took a screenshot of her grade on the register on the day it was given, then noticed the teacher had later lowered it and captured that too. In February 2018, a court in Lombardy, Italy, sentenced the teacher to 13 months' imprisonment for material falsification by a public official (art. 476 of the criminal code) over changes to two of the student's grades. The student first noticed. The response acted on the person responsible. Whether the register or school procedures changed is not stated in source.
Teacher Experiences Administrative Backlash After Questioning Mandatory Personal Phone App Installation
A public school teacher was instructed by school administration during a faculty meeting to download a student tracking and attendance application on their personal mobile device for use in emergencies. After voicing concerns about the requirement to use personal property for school duties, the teacher faced professional backlash and received demanding follow-up emails from school administration.
Teacher in Chile had educational platform accounts activated without informed consent
A fifth-grade teacher in Santiago said the Huechuraba education department activated platform accounts for teachers and students and sent teachers only an institutional email. She said teachers were never asked to sign or accept anything, and were not told how the platforms handle privacy.
Teacher in Iran compelled to use government educational platform or be marked absent
A teacher in Marivan said the principal called to say that not installing the Shad app would mean being recorded as absent, and that the authorities do not accept teaching in Telegram or WhatsApp. Teachers in Iran told HRW that the government compelled those in public schools to use the app.
Teacher’s intimate image sent to WhatsApp class chat and seen by students including minors
A teacher reportedly unintentionally sent an intimate image into a class WhatsApp chat. Students viewed and downloaded it before deletion and parents contacted law enforcement.
Teenage Male Student Subjected to Public Scrutiny After Inappropriate Video With Teacher Goes Viral on Social Media
A 16-year-old male student in Zimbabwe suffered a severe privacy violation and intense public exposure after a video depicting an inappropriate encounter between him and his teacher was leaked and circulated widely on social media [1.1]. The viral spread of the footage triggered national outcry and public debate regarding the student's conduct, resulting in a child-protection investigation and the arrest of the teacher.
Ten high school students allegedly planted a trojan on a teacher’s laptop to alter grades and absences on the register, Tuscany, Italy
Ten high school students allegedly installed a trojan on a teacher's unattended laptop, obtained the register password and from home deleted absences and raised grades. The head teacher spotted the anomalies and imposed disciplinary sanctions, with some students assigned community work and none failed in June; the regional postal police investigated and a trial before a regional juvenile court was expected on charges including unauthorised access and falsification of public records.
Terminated wallet account still holding money the user worked for
The user states that the wallet company terminated their account while still holding money they worked for. They report that support has not said when it will be released.
Texas college student forced to purchase burner phone due to mandatory proprietary 2FA app
A college student in Texas was required by their school to use a proprietary two-factor authentication application, OneLogin Protect, on their personal device to access school systems. Because the app blocked access on jailbroken devices and virtual machines, the student was unable to use their existing hardware. To bypass the restriction and log into their school portal, the student was forced to spend forty dollars out of pocket to purchase a cheap burner phone.
Texas School District – topless images reported on school iPad program
According to a citation collected by an educational technology legal advocacy group, parents in a school district in Texas raised concerns in 2019 after topless images were reportedly accessible through the district's school-issued iPad program.
Texas students exposed to privacy risks through inadequately protected remote learning system
An algebra teacher in Dallas, Texas, told HRW that her school district initially did not put privacy protections in place, and that teachers were using an online platform she said has no privacy protection. She said 60 to 70 percent of her students had a primary family member who had been deported or was in immigration detention, and called it a dangerous situation for those students.
Texas, USA – recorded child sexual abuse on school tablet
A six-year-old student at an elementary school in Texas, USA was sexually assaulted by classmates during a class period, with the incident recorded on a school-issued tablet; a school technology staff member discovered the recording while reviewing a device. The FBI opened an investigation, and the family has publicly stated the school's disciplinary and communication response was inadequate.
Three weeks of work reached only $4 against a $10 threshold, with further fees
A data worker reached only $4 after three weeks on a platform requiring $10 for withdrawal.
Source: Data Labelers Association
Date source link verified: 22/10/2026
Technology in Education
TurkeyAcademic research
Turkey – Students using government educational platforms were denied meaningful ability to opt out of surveillance
A teacher in Istanbul told a nine-year-old student and his mother that he had to use online platforms every day to be marked as attending school during Covid-19 closures. HRW concluded that in these countries, children could not give valid, meaningful consent to the processing of their data by government-mandated platforms, because they could not refuse to use them freely without detrimental effect and had no alternative means to access their education.
Turkish child required to create social media account for schoolwork despite age restrictions
A mother in Istanbul told HRW that her son's teacher required all of the 8-year-old students in the class to use Facebook, and made her son open an account at age 8 to upload his homework. She said the teacher was now requiring Facebook for tests. Facebook's terms of service prohibit children under 13 from using the service. Her son told HRW his teacher also makes him download BiP and WhatsApp for school.
Turkish educational application gathered location data without providing a privacy policy
Eğitim Bilişim Ağı, an app developed by Turkey's Ministry of National Education for preschool, primary and secondary students during Covid-19 school closures, has no privacy policy; its privacy policy link points back to the home page of its website, which also has none. HRW's dynamic analysis detected students' Android advertising IDs sent to Google through googleadservices.com, which is operated by Google Ads, and app-measurement.com. HRW also found the app has the ability to access phone numbers, call logs, camera and microphone.
Turkish parent lost ability to communicate with teacher after refusing government messaging application
A mother in Istanbul told HRW that her son's teacher asked her to download BiP, a government-mandated messaging app for government and school use during the pandemic. She refused because she had heard the app was not secure in terms of data privacy, and told the teacher she had no space on her phone. She said the teacher then told her they could not communicate otherwise and blocked all the parents on WhatsApp, and that she has not been able to speak to him since.
Two middle-school students allegedly hacked a teacher’s register account and changed classmates’ grades, Italy
A report of an anomaly in an electronic register at a lower secondary school in Italy reached the police cyber-security unit, which checked access logs and IP addresses and confirmed a teacher's account had been breached and many students' grades changed. Two students of the school were identified as the alleged authors and referred to the regional juvenile prosecutor for unauthorised access to a computer system (an allegation).
Unauthorised Disclosure of Student’s Educational Evaluation on Classeviva Electronic Register
A teacher at a state professional institute in Italy accidentally published a private academic evaluation and behavioral note regarding a student in the public class 'Agenda' section of the Classeviva electronic register. Because the teacher failed to select the option to restrict the visibility of the note, the message was exposed to all other students in the class and their families. The Italian Data Protection Authority (Garante Privacy) investigated the incident and fined the school for the unlawful communication of a minor's personal data.
Source: Garante per la protezione dei dati personali
Unauthorized Disclosure of Student’s Disability Status via School Email
An instructor at a high school in Italy mistakenly sent three email communications regarding a student's Individualized Education Program (PEI) to all of the student's classmates. As a result of this error, the student's sensitive disability and medical status were exposed to their peers without authorization.
Source: Garante per la protezione dei dati personali
Unauthorized Exposure of National Identity Numbers of Norwegian University Students and Staff via Feide
A technical error in the Norwegian identity management system, Feide, resulted in the unauthorized transmission of national identity numbers to external service providers when users logged in. At a major Norwegian university, 15,019 students and staff had their national identity numbers shared, with 7,873 of those individuals having their data stored by third-party service providers without prior agreement. The university reported the incident to the national data protection authority.
Unauthorized Exposure of Special Education Students’ Status via School Register Platform
A public school in Italy distributed operational meeting schedules via its school register platform. The documents contained the initials of 52 certified students with disabilities, making their sensitive medical-educational status recognizable to unauthorized parents, teachers, and students. As a result, the sensitive health data of these students was exposed to the wider school community, leading the Italian Data Protection Authority to issue a fine of €1,000.
Source: Garante per la protezione dei dati personali
Unauthorized Interception of Student Communications on the Naviance Platform
A minor student, along with other student users of the Naviance educational platform, had their confidential and sensitive communications intercepted without consent by integrated third-party analytics and advertising software. This non-consensual tracking and invasion of student privacy led to a class-action lawsuit and subsequent $17.25 million court-supervised settlement.
Source: United States District Court for the Northern District of Illinois
Unauthorized Online Disclosure of Minor Student’s Medical Information by Italian School District
The Italian Data Protection Authority fined a school district in Italy €4,000 for a privacy breach. The school published a teacher selection circular on its public institutional website that included the initials, class, and references to medical documentation of a minor student who required home-based instruction. This online publication effectively exposed the student's private health status and medical condition to both the public and members of the school community.
Source: Garante per la protezione dei dati personali
Unauthorized Posting of Minors’ Images on TikTok and Facebook by a School in Kenya
The Office of the Data Protection Commissioner of Kenya found a local school liable for multiple data protection violations after the school published photographs and videos of minor pupils on TikTok and Facebook for marketing purposes without obtaining parental consent. The regulator initiated an investigation after a parent filed a complaint regarding the school's stated intention to post student videos on social media despite objections from guardians. As a result of the investigation, the regulator issued an Enforcement Notice against the school.
Source: Office of the Data Protection Commissioner
Unauthorized Public Exposure of High School Exam Results and Schedules on School Website
The Italian Data Protection Authority (GPDP) fined a high school in the Lombardy region of Italy 2,000 after an administrative staff member mistakenly published intermediate exam results, final exam scores, and detailed oral exam schedules containing student names on the school's public website. The data was intended to be restricted to the secure, private electronic register. A female high school student filed a formal complaint regarding the public exposure of her classmates' and her own data, which was subsequently removed by the school.
Source: Garante per la protezione dei dati personali
Unconsented student data collection via school iPads
School officials provided students with iPads pre-installed with content tracking and blocking software that was not fully tested. The software compromised the students' digital privacy by collecting their personal information without consent, putting their data at risk.
Undisclosed deductions taken from data worker payouts
A worker reported payout deductions that were not disclosed in advance.
Source: Data Labelers Association
Date source link verified: 22/10/2026
About the records
Each record is a short summary of an incident described in a public source or collected through an interview by SHIELD or its partners. Records are reviewed by people before they appear here. Names and identifying details are removed: where a person appears, a role, age band and gender stand in for the name, and dates and places for minors are generalised. Every record links to its original source and shows the date that link was last checked. Records are classified with shared harm categories. The classification is SHIELD's own, so it can differ from how a source describes the incident.
Using the directory
You are welcome to read, link to and quote individual records with credit to FARO. Please do not copy, scrape or republish the dataset in bulk, or use it to train or test automated systems, without written permission. To ask for permission, use the SHIELD contact form. The original sources keep their own rights, and the link on each record leads to them.
How to cite
SHIELD-APS. Frontline Record of Online Harms (FARO). DIRECTORY-URL. Accessed [date]. To cite a particular selection, use the web address shown after you set the filters.
When you rely on the facts of an incident, cite the original source it links to. When you rely on the classification, the patterns or the country report, cite FARO. Please describe the records as documented incidents and do not present counts or country coverage as how often these harms happen. A country with few records may simply have little published about it.
Corrections and removals
If a record is wrong, a link no longer works, or you are described in a record and want it changed or removed, use the SHIELD contact form and include the title of the record. We review each request and update or remove the record where the request is justified.
Report an incident
Know of a documented incident that belongs here? Send it through the incident form. A public source, such as a news report, a court or regulator decision, or a research publication, helps us verify it quickly. Submissions without a public source are kept anonymous and are not tied to named products or companies. Please leave out the names of children and of anyone who has not agreed to be named. Submissions are reviewed before anything is published, and sending one does not guarantee a record.
Manage Consent
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
