Parents who financed Lido Learning subscriptions through the company's lending partners continued paying EMIs after classes stopped, according to the report. One parent was warned by the financing partner that non-payment could hurt their credit score and bring loan recovery agents to the house, and said the family shelved plans to buy a house. The child's age is not stated.

A single mother in West Bengal, India paid Rs 36,000 in instalments for a two-year Lido Learning subscription for her fifth-grade child, but regular classes stopped in March 2022, and she said she lost Rs 18,000 outright. The company filed for insolvency with the National Company Law Tribunal in September 2022 without refunding fees, according to the report. She said she could not teach her child herself and did not think she could afford another tutor.

A parent struggled to unlock a device after sixth year and was told it had been rented rather than purchased.

A parent reported continued disclosure of personal information despite attempts to limit location sharing and digital footprint creation. This is a personal interview. Source available to SHIELD.

A parent reported that a school application required identity numbers, phone numbers, and payment information without providing a clear privacy policy. This is a personal interview. Source available to SHIELD.

A parent reported that during the COVID-19 period government education applications collected extensive information about students and parents including names phone numbers locations and school details. The applications later disappeared and it was unclear what happened to the data. This is a personal interview. Source available to SHIELD.

A data worker described PayPal accounts being flagged and funds locked for 180 days after larger payments arrived.

A female high school senior in Pennsylvania struggled to concentrate and experienced falling grades due to sustained, daily use of school-issued laptops since kindergarten. She found it difficult to focus when learning from screens, leading her to secretly watch streaming services during class. Although her mother requested that the school district confiscate the laptop, the district refused because the devices are integrated into the curriculum.

A data worker was paid $0.015 per image-sorting task on a platform with a $50 withdrawal threshold, making withdrawal effectively unreachable.

Peru's Aprendo en Casa is listed by HRW among 56 government-built or government-financed educational products found transmitting children's data to advertising technology companies. HRW's table shows it has no privacy policy.

The platform reportedly helped trainers recover unpaid earnings but not the broader worker population.

A worker says their balance was in the multiple four-figure range when the platform locked the account on the seventh day and asked them to justify submitted tasks. They say they supplied proof, and after two weeks there was still no reply to emails or social media messages. The account stayed under review and the earned balance was out of reach.

A female graduate of a state polytechnic in Nigeria discovered that an impersonator had used her personal credentials and matriculation number to register on the National Youth Service Corps (NYSC) online registration portal. Her institution attributed the issue to a database breach by a hacker who manipulated mobilization records. As a result of this incident, the graduate was blocked from completing her mandatory national service, causing her severe distress and delaying her from obtaining a required employment certificate.

In January 2021, intruders joined an online open day for a primary school in Italy, which was accessed via a public link, and broadcast a pornographic video and blasphemous audio to teachers and prospective families. Organizers could not remove the intruders, so everyone left the meeting. The female head teacher reported the incident to the postal police to trace those responsible. The response acted on the persons responsible via a police complaint.

Researchers proposed recording preschool classrooms to train AI systems. Parent objections regarding monitoring and consent resulted in cancellation of the project.

A primary school student in Scotland was left traumatized after being exposed to explicit content on a school-issued laptop. The exposure occurred when classmates searched for a medical term on their Chromebooks, bypassing the school's safety filtering system while connected to the school Wi-Fi. The child's parent reported that multiple children were exposed to the material, causing them distress and confusion.

A primary school teacher in the Mashonaland West region of Zimbabwe was sentenced to 12 months in jail for multiple counts of indecent assault against pupils in his class. Among these counts, the teacher showed pornographic material on his mobile phone to an 11-year-old female student during lesson time. The student and other class victims experienced trauma and subsequently reported the incidents, leading to the teacher's arrest and prosecution.

A municipality in Agder, Norway deployed the digital mapping tool Spekter at local schools to track bullying and class environments. The tool collected non-anonymous peer-reported details identifying specific students as bullies, victims, or class disruptors, which was done without proper legal basis, transparency, or the ability for named students to access or correct the allegations. The Norwegian Data Protection Authority and the Privacy Appeals Board (Personvernnemnda) ruled the data processing unlawful, ordering the municipality to delete all collected data.

A female private maths tutor tutored a teenage boy online and then arranged to meet him at her home, where she had sexual contact with him while aware he was under the age of consent. The boy's mother found inappropriate WhatsApp messages on his phone in May 2023. The tutor pleaded guilty and was jailed for six years at a court in the United Kingdom in August 2024; police said the abuse had a significant impact on the boy and his family.

A private school in Kenya shared the name and exam results of a minor student with a national media group, which published them in an advertising feature of a newspaper in August 2025. This disclosure occurred without the consent of the minor's parent, who had previously objected in 2023 to such publications and received assurances from the school. Following a complaint, Kenya's Office of the Data Protection Commissioner found the school liable for unlawfully processing the minor's data for commercial purposes and violating the parent's right to object, ordering the school to pay KES 637,500 in compensation.

A ransomware-infected laptop was connected to the school network of five educational institutions in Denmark. This allowed unauthorized third parties to compromise the network and publish the private personal data of over 10,000 students on the dark web.

Axios Italia, supplier to about 40% of Italian schools, reported a ransomware attack starting 3 April 2021 that left many schools without their register as in-person lessons resumed. The company told teachers and staff to use an emergency register, said it expected to restore service, and said its checks so far showed no data stolen. The company first noticed and reported it.

A worker says they were flagged for spam on every review in a rating job without warning or explanation, and that their pay was withheld. They say they were not told which standard they broke and that support replies are slow and unhelpful. The complaint text is cut off and no amount is stated. BBB lists the complaint as Unanswered by the business.

A worker recruited through LinkedIn says they were paid 0.29 dollars at first, received a reduced incentive payment, and were not paid for about 9.33 hours at 54 dollars an hour. They say an automated Slack message then removed them from communication. BBB lists the complaint as Unanswered by the business.

After an upper secondary school student obtained the password to the school's electronic register, the password spread quickly through student chat groups. Approximately 40 students used the access to modify their school entry times and absence justifications. The students faced potential suspension and potential criminal complaints for unauthorized access to the school's system. It is not stated in the source who first noticed the breach. The school's response was directed at the students; the source does not state whether the password or access controls were updated.

A remote contractor located in Texas, USA, received their platform earnings on a digital payment platform but was blocked from withdrawing or utilizing the funds in any way. The contractor was left unable to access their earned money and sought help from other users online to resolve the issue.

A remote worker was permanently suspended without explanation from an AI training platform where they had worked for two months. Following the suspension, the platform attempted to withdraw approximately $2,000 from the worker's connected payment account, which the worker had to dispute through their financial provider to recover. Additionally, the platform withheld payment for the worker's final completed tasks.

An applicant was prompted by a remote work platform to purchase a paid subscription to a third-party generative AI service under the promise of accessing more tasks. Despite purchasing the subscription, they were never assigned any jobs and were compensated only three dollars after completing eight hours of testing.

A supplier initially refused repair without insurance despite the device warranty and support plan, later reversing the decision.

Anonymous intruders repeatedly entered online lessons at an upper secondary school in Tuscany, Italy, talking over the teacher and showing extremely violent films and pornographic videos; students disconnected on teachers' instructions, and smaller episodes occurred in other regional schools. The school head informed local postal police and law enforcement, and wrote twice to parents, the second time after a further intrusion in March, warning that the intruders needed a student to share the lesson link and that students who did so risked a criminal complaint.

A report by InternetLab documented expansion of facial recognition technologies across state and municipal schools raising privacy and surveillance concerns for school communities.

ȘcoalaIntuitext, a Romanian learning platform recommended by Romania's Education Ministry, says in its privacy policy that it installs 23 marketing cookies to target its students with behavioral advertising across the internet. The cookies excerpted in the report come from Meta, Google (AdSense and DoubleClick), Hotjar and Zendesk. Its operator, Softwin, told HRW the product is dedicated first to teachers and educators and only in a subsidiary way to children or their parents.

Digital Lessons, a Russian educational website built and operated by the government, was one of eight websites HRW found using canvas fingerprinting, which assigns a unique number to a user's device to track activity across the internet and is virtually impossible for users to block. None of the eight disclosed its use. HRW also lists Digital Lessons among websites using Yandex session recording and key logging.

My School is Online, a Russian government educational website, was found by HRW to use Yandex session recording and key logging. Session recording lets a third party watch and record a user's behavior on a page, and Yandex describes its tool as recording clicks, scrolls, keystrokes and mouse movements. HRW's table of government-built products lists it as having no privacy policy.

Sensitive personal and special-category safeguarding information relating to four individuals including three children was disclosed in a classroom environment through school systems. Children were exposed to confidential information not intended for them resulting in a personal data breach.

At a school in Italy, two teachers filed separate union complaints about class assignments on the same day, and the school answered both with a single document sent in one certified email. The document contained health information about one teacher.

A parent discovered that a school-provided application used for communication, homework, and school information also included games and direct links to YouTube videos. The parent reported being unaware these features existed within the student's version of the app. The consequence was unexpected exposure to non-educational content and lack of parental awareness regarding the child's digital environment. This is a personal interview. Source available to SHIELD.

A senior pupil was filmed assaulting a junior pupil while other students recorded the incident. The video circulated online leading to disciplinary proceedings.

School officials implemented an AI tool to scan students' school-issued accounts, documents, emails, and chats for concerning language. Students filed a lawsuit alleging that the constant automated monitoring created an environment of continuous surveillance and chilled their personal expression.

A support teacher at a school in Italy mistakenly configured the visibility settings on the school's electronic register while uploading an Individualized Education Plan (PEI). This error made a minor student's sensitive educational and disability records visible to all parents of the classroom for approximately 22 minutes. During this window, another parent saw the notification, took a screenshot, and shared it in a class messaging group. The student's parents subsequently retained an attorney and filed a formal complaint with the Italian Data Protection Authority, which issued an official reprimand to the school.

Parents complained through a lawyer that the school sent a vaccination-compliance reminder to about 37 families with all addresses visible, revealing which children were not in order. The school notified a data breach, retrained staff, and asked the software house that supplies its email program to add a warning whenever several recipients are entered. The Italian Data Protection Authority (Garante) found an unlawful communication of health data and fined the school EUR 1,000. The family first noticed. Responses acted on the school and, through its request, the vendor's tool. Whether the vendor added the warning is not stated in source.

An employee of a school in Italy had their highly sensitive medical information and labor dispute details exposed to 14 coworkers. The incident occurred when an administrative worker mistakenly uploaded the employee's court documents onto the ordinary registry of the school's document management software instead of the restricted, reserved protocol. Consequently, the employee filed a formal warning demanding the removal of the files and lodged a complaint with the Italian Data Protection Authority, which resulted in a regulatory fine of €1,000 for the school.

An audit at a Nigerian university found that hundreds of students had paid tuition fees into a former employee's personal account instead of official university accounts. The university alleged that many students participated because they were offered discounted fees or commissions and referred the students to disciplinary proceedings as part of a wider fraud investigation involving more than ₦457 million.

An IT professional analyzed a first-grade student's school iPad and found that approximately 20 to 24 percent of its traffic was associated with advertising networks. According to the account, the traffic appeared focused on behavioral tracking. The reported consequence was collection of children's data without their consent.

A lyceum published a circular with a code revealing disability-law benefits usage by staff and leading to a EUR 4,000 fine.

Female teachers at a school in Chhattisgarh, India, discovered a mobile phone hidden in the women's restroom set to record video. A subsequent police complaint revealed that the school principal had been placing his phone there for two months to record the staff, leaving the female teachers distressed and fearful.

A parent reported removing digital devices from their child for mental health reasons, after which the child's school continued to rely on online-only homework systems and was unwilling or unable to provide equivalent paper-based work. The parent cited the incident as an example of increasing dependence on digital platforms in schools.

Hackers accessed surveillance cameras at several schools and livestreamed video feeds online. Students captured on the cameras experienced a privacy breach. This is a personal interview. Source available to SHIELD.

School officials in a Pennsylvania school district utilized remote activation software on school-issued laptops to covertly capture images of students inside their homes. This surveillance violated the students' privacy rights, leading to legal action and a subsequent financial settlement.

A high school student in Zimbabwe had intimate, naked photographs shared to a school WhatsApp group by a former boyfriend. As a result, the student experienced severe fear, stopped attending school, and contemplated suicide.