FARO stands for Frontline Record of Online Harms. Technology-related harm usually reaches the public one case at a time: a school in one country, a family in another, each easy to treat as an exception. This directory puts those cases side by side to help grassroots actors see where others face the same issues they do, and to help governments and regulators see the bigger picture of the harms occurring. The directory describes what its records contain. It does not measure how often these harms occur, and a country with few records may simply have little published about it.
How to use this directory: Topics are filterable for FARO reports that have already been created based on these incidents. The harms and response patterns shown are those featured there. To see the incidents used in a country-specific report, choose that country under Country report. Pick a pattern or evidence type to see on the map which countries have matching records. Click a country on the map or in the list to see its records below. Use the filter to search for keywords or specific sources.
Shaded countries have at least one record. Choose a pattern to see where it appears.
Shading shows only that a country has at least one record in this directory that matches your selection, and every shaded country looks the same on purpose. It says nothing about how often these harms occur there. Pattern filters only cover records classified so far, and small countries are easy to miss on a map, so use the list as well.
In the list but not drawn on the map: Multiple countries, Not stated.
Children received devices with visible login credentials attached via stickers. This is a personal interview. Source available to SHIELD.
MUSE, an app for kindergarten to fifth grade built by SABAQ Learning Systems and recommended by Pakistan's federal education ministry, was found by HRW to send children's data to Facebook and Google through six embedded SDKs. HRW said the app sends more data about children to Facebook and Google than it sends to itself, and that Facebook's SDKs log students' activity in the virtual classroom and send it with the child's advertising ID, Android ID and device information, which allows Facebook to tie the data together. MUSE's privacy policy does not disclose the practices HRW observed. MUSE told HRW it does not collect children-specific data and that the Google and Facebook SDKs gather usage data as data points, not about specific users.
View sourceHRW found 30 educational websites sending their users' data to Facebook through the Facebook Pixel, which collects information about what students and teachers do on the sites and sends it back to Facebook. Twenty-seven of the 30 are designed specifically for children, and all were recommended by governments for online learning. The report says Facebook could use such data to profile children and target behavioral advertisements at them.
View sourceHRW's forensic testing found that MUSE notified Facebook the moment the app was installed, and sent the child's advertising ID and device information to Facebook before the child had opened the app for the first time. This happens whether or not the child is logged into Facebook or has an account. HRW also conclusively found MUSE collecting and sending bridged identifiers (advertising ID with Wi-Fi MAC address) to Facebook, which bypasses privacy controls such as resetting the advertising ID.
View sourceNotesmaster, listed by HRW among 56 government-built or government-financed educational products found transmitting children's data to advertising technology companies, sent its students' data to Oracle's BlueKai through ad trackers and cookies, both before and after BlueKai's reported 2020 data breach, which reportedly exposed billions of people's personal data. HRW also found key logging on the site, sending data to youtube.com.
View sourceA class action lawsuit was filed on behalf of K-12 students, including a minor student plaintiff, alleging that Curriculum Associates generated, collected, used, and shared their personal information without consent through its i-Ready products. The complaint claims these practices violated federal and state privacy laws, including the Federal Wiretap Act, the California Invasion of Privacy Act, and the Massachusetts Right to Privacy Act [1.1].
View sourceA WhatsApp class chat at a secondary school in Italy was used to post pornographic videos, extremist content and insulting videos of teachers. Six students were reported and suspended.
View sourceAn adult male platform user says he received 3,828.73 dollars from a client through a wallet platform on 23 July 2026 and withdrew 2,472.22 dollars. The platform blocked his account the next day without explanation, leaving the remaining balance inaccessible. Two weeks later, support had given no meaningful response.
View sourceParents objected to a circular stating that students without an iPad should continue their studies at another school, with devices required from the third grade of primary and the first year of lower secondary school. The female school principal defended the policy, citing the national digital school plan's "Bring Your Own Device" action, and stated that the school lends devices to foreign and lower-income families. Whether the requirement changed is not stated in the source.
View sourceA compulsory device costing nearly €1,000 repeatedly failed and stopped working before the first school year ended; no refund was provided.
View sourceA father of two school-age sons bought a Byju's online course in November 2022 by taking a Rs 1,00,000 loan. In August 2023, an agent told him the sons had been selected for an add-on premium course under a scholarship programme, said to be offline and ICSE-aligned, and collected Rs 42,000; the course was CBSE-based and online. Byju's approved a refund but did not pay it; the commission found deficiency in service and unfair trade practice and ordered a refund with 9 percent interest, Rs 10,000 compensation and Rs 10,000 costs.
View sourceA mother paid Rs 85,000 in August 2023 for a Byju's college entrance exam preparation course for her adolescent son, taking a personal loan with a monthly EMI of Rs 6,084. According to the report, no study material or promised laptop arrived, and after being promised a full refund within 30 days she received Rs 1. A regional Consumer Disputes Redressal Commission in Telangana, India ordered a refund of Rs 84,999 with 12 percent interest and Rs 10,000 compensation.
View sourceA parent enrolled her teenage son in a three-year Byju's foundation course for secondary school students in October 2023, paying a portion of the fee by credit card with the remainder scheduled as installments. She alleged classes did not start for weeks, recorded content was presented as live classes, the tablet arrived late, and promised payment terms were not met. A district consumer commission in Telangana, India ordered a refund and compensation.
View sourceA father purchased a Byju's learning programme for his daughter, paying Rs 5,000 upfront and financing the remaining Rs 60,000 through a loan from a private finance company that, according to the consumer commission's order, was arranged by a Byju's authorised representative. After deciding within the promised 15-day trial period that his daughter was dissatisfied with the learning app, he requested cancellation and paid an additional Rs 9,498 cancellation charge. Despite assurances that no further payments would be deducted, EMI deductions reportedly continued. In September 2023, the Hooghly District Consumer Disputes Redressal Commission found indications of unfair trade practices, ordered Byju's to refund the course amount and cancellation fee, and awarded Rs 5,000 in compensation for harassment and mental agony.
View sourceAn adult content creator who has received monthly royalty payouts from a stock-image service and a social video platform for over four years says his withdrawable balance dropped to zero after annual fee deductions. He says a royalty payout was then rejected by the payment platform and bounced back to the sender. Support closed his ticket as resolved without investigating, and he cannot reach his money.
View sourceA contractor says their Outlier account was deactivated by an automated flag and that 127.65 dollars in earnings for about 17 hours of work is being withheld. They report scripted support replies described as final. BBB lists the complaint as Unanswered by the business.
View sourceA contractor says their account was deactivated without a stated reason and that 300 dollars in pending earnings was not processed. No response to their support contacts is described. BBB lists the complaint as Unanswered by the business.
View sourceA contractor says the platform disabled their account for alleged GPT usage although they handwrite their work, and that the platform is now withholding their payouts. The amount is not stated. BBB lists the complaint as Unanswered by the business.
View sourceA contractor says they have unpaid invoices of over 2,000 dollars for completed work on the old platform and were locked out of it before being paid. They now have access only to the new platform, which shows none of their past work or invoices, and several approaches to support brought no resolution. The platform replied that someone would reach out, the complainant answered that no one had, and the platform later said it had emailed the complainant.
View sourceA contractor recruited in February 2024 says that after more than 14 months they have not been fully paid for 82 hours of work plus mission bonuses, which they put at 2,506.52 dollars. They say they received 866.90 dollars for the hours and 345 dollars in bonuses, paid through a payment wallet, and they attach screenshots to support the claim. BBB lists the complaint as Unanswered by the business.
View sourceAn independent contractor says they are owed 3,240 dollars for 18 tasks at 180 dollars each. They say they were removed from all projects of that type on 7 May 2026 after the project was paused, and received no reply to 12 quality questions. BBB lists the complaint as Unanswered by the business.
View sourceA contractor says they passed their language and generalist assessments and logged about 4 hours of work, then were removed from the project under an automated claim of not meeting quality criteria, with no feedback or warning. They say they have not been paid for those 4 hours and ask for full compensation. BBB lists the complaint as Unanswered by the business.
View sourceA worker says a data annotation platform suspended his account days after a time-reporting mistake that support had told him was not a problem. He says over 1000 dollars of earned pay could not be withdrawn, representing 40 to 50 hours of work. Months of emails to the platform and attempts to contact authorities produced no response.
View sourceA contractor says they are owed 2,103.13 dollars for completed work but cannot reach their payment account because the platform has not updated the phone number used to verify their identity. They were told more than two months earlier that the update was in progress, and report several tickets and emails with minimal or no action. The platform replied on 5 May that someone would reach out.
View sourceA contractor says they have not received 2,440.15 dollars for completed work because a name spelling error blocked their tax identity verification and the platform has not reopened the tax compliance portal after correcting it. They say this has lasted over six months and that numerous tickets and escalation requests drew little or no response. The platform replied on 5 May that someone would reach out.
View sourceA contractor hired through a freelance marketplace says the platform sent several emails stating a 10,000 dollar payment had been released to their account, and that it then refused to pay for the work they did on that basis. They say neither company responds, they cannot contact the platform directly, and the marketplace says it does not control payments. They report holding emails and screenshots and ask for the payment or a written explanation. BBB lists the complaint as Unanswered by the business.
View sourceA contractor says they were not paid for Hubstaff-tracked hours from the first two weeks of March, about 160 hours at 41 dollars an hour, after their agreement ended on 25 April. They say they lost support access during the platform's migration to another platform. BBB lists the complaint as Unanswered by the business.
View sourceA contractor says they worked for the platform from April to August 2024 and have not received the corresponding payment. They ask for a link to connect a new payout account. The platform replied that its finance team would reach out with details. The amount is not stated.
View sourceA contractor says they worked from May to September 2024 and have not been paid, that their efforts to contact the platform failed, and that it is not answering emails. They ask for a link to connect a payout account so the invoice can be paid. The platform replied on 14 April that someone would reach out. The amount is not stated.
View sourceA contractor reported being unpaid for their most recent month of work. The contractor attempted to reach the platform's US and Australian offices, finding no working contact numbers and receiving no response. The Better Business Bureau (BBB) lists the complaint as unanswered by the business. The exact amount unpaid was not specified.
View sourceA contractor says they are owed 223.16 dollars that the platform states it processed on 24 June 2026 to a bank account number the contractor had entered with two digits transposed. They first contacted support on 30 June, were told trace information would arrive within 12 weeks, and say that period passed with no trace number and their original ticket closed unresolved. They ask for the trace result or a reissued payment to the corrected account. BBB lists the complaint as Unanswered by the business.
View sourceA contractor says their account was closed or flagged and that pending earnings for approved work were not paid. They ask for an explanation and payment. The amount is not stated. BBB lists the complaint as Unanswered by the business.
View sourceEach record is a short summary of an incident described in a public source or collected through an interview by SHIELD or its partners. Records are reviewed by people before they appear here. Names and identifying details are removed: where a person appears, a role, age band and gender stand in for the name, and dates and places for minors are generalised. Every record links to its original source and shows the date that link was last checked. Records are classified with shared harm categories. The classification is SHIELD's own, so it can differ from how a source describes the incident.
You are welcome to read, link to and quote individual records with credit to FARO. Please do not copy, scrape or republish the dataset in bulk, or use it to train or test automated systems, without written permission. To ask for permission, use the SHIELD contact form. The original sources keep their own rights, and the link on each record leads to them.
SHIELD-APS. Frontline Record of Online Harms (FARO). DIRECTORY-URL. Accessed [date]. To cite a particular selection, use the web address shown after you set the filters.
When you rely on the facts of an incident, cite the original source it links to. When you rely on the classification, the patterns or the country report, cite FARO. Please describe the records as documented incidents and do not present counts or country coverage as how often these harms happen. A country with few records may simply have little published about it.
If a record is wrong, a link no longer works, or you are described in a record and want it changed or removed, use the SHIELD contact form and include the title of the record. We review each request and update or remove the record where the request is justified.
Know of a documented incident that belongs here? Send it through the incident form. A public source, such as a news report, a court or regulator decision, or a research publication, helps us verify it quickly. Submissions without a public source are kept anonymous and are not tied to named products or companies. Please leave out the names of children and of anyone who has not agreed to be named. Submissions are reviewed before anything is published, and sending one does not guarantee a record.
