A female secondary school student's mandatory learning iPad developed a technical fault and was sent to the vendor for repair. While the vendor delayed resolving the issue and the device remained missing in transit, the student was repeatedly penalized with demerits and detentions by her school for not having the device in class. The issue was only resolved after the student's parent filed a formal complaint with the vendor's CEO and posted about the situation on LinkedIn.

A male secondary school student in the United Kingdom received a school detention for failing to complete his homework through a mandatory reading application. The school required all reading to be logged through the software, which strictly limits book selection, controls reading speed, and requires completing AI-generated quizzes. The student ultimately chose to accept recurring weekly detentions instead of using the application, which his parents argued ruined his enjoyment of reading.

A parent reported that a secondary school teacher required class communication through WhatsApp. After Meta AI was integrated into the platform, the child (a secondary school student) gained access to an AI chatbot that could not be deactivated or restricted. The parent reported being unable to prevent their child's access to the AI tool while maintaining necessary participation in school-mandated communications. This is a personal interview. Source available to SHIELD.

A state education board issued a directive requiring secondary-school teaching and non-teaching staff to either purchase ICT tablets or enroll in a salary-deduction scheme through a private vendor. The directive reportedly stated that failure to comply could affect eligibility for promotion, prompting criticism that educators were being required to personally fund workplace technology despite low salaries

A group of teenage girls as young as 14 in New Mexico were targeted on Snapchat by a high school coach. The coach utilized the platform's communication features to extort and coerce the girls into sending sexual videos of themselves.

A father discovered that his two secondary-school-aged children could access video content bordering on soft pornography via the Dailymotion platform on their school-issued Personal Learning Devices (PLDs), despite device management applications intended to block undesirable content. He reported the issue to Singapore's Ministry of Education in March 2026, and the ministry confirmed it blocked the Dailymotion website in response within days. The Ministry stated it takes proactive and reactive action to review and block undesirable sites and offered to meet directly with the parent. This case is notably well-documented and government-confirmed, with a clear, fast institutional response following a single parent's report.

A data worker was paid about $8.40 through a payment service with a $50 withdrawal threshold. The service deducted $3 as a tax charge and later took the remaining $5.40 as an annual charge, leaving a zero balance.

Twenty schools in Albania received extensive smart camera deployments with unclear AI capabilities creating surveillance and transparency concerns.

EBS, South Korea's national educational broadcaster, whose website the Education Ministry recommended during pandemic school closures and which averaged over 2.1 million users a day by April 20, 2020, was found by HRW to have 24 ad trackers that send children's activity on its home page and primary-school page to 15 advertising companies, some of them large data brokers. EBS's privacy policy says personal information is used for marketing and advertising but does not disclose the ad trackers or name these companies. EBS told HRW it does not send information that would identify children.

Spain's Fiscalía de Menores (Juvenile Prosecutor's Office) opened an investigation into three minors at a school accused of using AI applications to generate sexualized deepfake images and videos from real photographs of 61 people, including 22 minors and several teachers, taken from social media, and distributing this material among students at the school. Police recovered over 100 files as part of the investigation.

The Spanish Data Protection Agency (AEPD) fined an educational center €20,000 (reduced to €12,000) for deploying Google Workspace for Education without properly informing families or obtaining lawful consent. An investigation triggered by a parent's complaint revealed that the school processed the personal data of more than 500 students, including minors under 14, without a valid legal basis or a compliant data protection impact assessment regarding international data transfers.

The article references an earlier program between approximately 2014 and 2018 in which teachers were reportedly required to obtain laptops through salary deductions. According to the report, many educators later complained that the devices were of poor quality and did not meet expectations, contributing to distrust of subsequent technology procurement initiatives.

A 16-year-old female student was prevented from completing academic research because of overly restrictive internet filters on her school-issued computer. The strict filters, which were implemented by her school district in response to anti-technology backlash, blocked her from accessing appropriate educational information on topics such as breast cancer.

A parent discovered that their young son, a school student, had accessed and watched pornographic content on YouTube using his school-issued tablet. The exposure to adult content occurred due to a lack of restrictions on the school device, causing significant parental distress.

A university student was arrested and detained by police after posting a tweet on Twitter/X that was deemed defamatory to the country's First Lady.

A video showed teachers allegedly assaulting a student on a school bus. The footage triggered a government investigation and possible criminal proceedings.

A female student was barred from graduation and threatened regarding her diploma by her school after she made a post on a social media platform coming out as gay. The school had monitored and acted upon her off-campus expression, leading to a legal dispute over the violation of her digital privacy.

A parent discovered that their child's personal data was made public through a student account configured on a technology company's hardware and software platform. In response, the parent initiated a campaign that ultimately resulted in a national data protection authority issuing an injunction against schools using the platform to collect and process student personal data.

A student in Washington state, United States was flagged after writing a private suicide-related document. Adults intervened after the software alert. The student reported embarrassment and discomfort from private writings being read by unintended readers and stated the embarrassment lasted for years. This is a personal interview. Source available to SHIELD.

A student experienced daily, intense headaches after a school year of using and transporting a school-issued laptop for her education. As a result of these persistent physical symptoms and a perceived lack of academic benefit, her parent decided to opt her out of using the school's computer and digital curricula for the subsequent school year.

A student at an Apple Distinguished School reported that their school requires students to enroll their personally owned iPads in the school's device management system. The student argued that fully managing personal devices is problematic and, in their jurisdiction, may even be legally questionable because it can make the device appear to Apple as school-owned property. They explained that the arrangement created concerns about restrictions and future removal of the management profile, particularly if the IT department lacks expertise. The student contrasted this with a Bring Your Own Device (BYOD) management approach, which allows schools to provide educational apps and content without taking full control of the device and can be removed by the user at any time.

An individual purchased a used iPad and discovered it was locked and restricted under a school's mobile device management system. The buyer was unable to use the device normally and had to contact the school's IT department in an attempt to have the restriction removed.

A high school student in Zimbabwe was targeted in a class WhatsApp group by classmates who created messages mocking the student's spoken Ndebele and calling them derogatory names. The harassment caused the student to experience embarrassment and have a difficult time fitting into the school.

A Canadian student objected to a school assignment requiring the use of generative AI tools and sought advice online about resisting the requirement. The discussion included concerns about AI's impact on learning, creativity, and ethics, with several commenters encouraging the student to request an alternative assignment or voice concerns to school administrators.

In 2019, a public school in Denmark required students to use school-provided laptops and set up public profiles on a video-sharing platform. This resulted in the public exposure of a student's personal details, including their full name, age, school name, and class, without parental consent.

A teacher remotely activated a student's webcam and observed the student while sleeping and partially undressed. The consequence was a significant invasion of privacy. This is a personal interview. Source available to SHIELD.

A student was reportedly suspended after a personal Instagram post containing alcohol in the background was detected or acted upon through monitoring practices.

During a university student election campaign, a 21-year-old female student was subjected to weeks of severe online harassment after endorsing a candidate in her class WhatsApp group. Classmates made vulgar comments about her body and verbally attacked her, which caused her to experience depression, retreat to her residence, and withdraw from school and student activities.

Educators reported discovering students using AI companion systems while parents and staff remained unaware. The consequence described was unsupervised emotional engagement with AI systems. This is a personal interview. Source available to SHIELD.

A school district confiscated and searched a student's personal cell phone, exposing extensive private data, texts, photos, and location history. The student's family filed a legal action, and the school district ultimately paid a financial settlement for exceeding reasonable search limits.

A school in Andalusia, Spain, restricted students' access to individual tablets, laptops, and the 'Educamos' digital educational platform if their families did not pay an annual ICT fee. As a result, affected students were forced to share devices and rely on physical paper agendas, which lacked the exclusive communication and schoolwork content uploaded to the digital platform. Following complaints from affected families, regional educational authorities launched an investigation into the school.

During November 2024, students at a university campus in Zimbabwe were targeted by an OTP phishing scam where scammers tricked users into sharing their login verification pins to hijack their accounts. As a result, several students were locked out of their WhatsApp accounts, causing them to miss class group chats, lose communication with lecturers regarding dissertations, and experience business disruptions on WhatsApp Business.

Students at two schools in a Norwegian municipality were instructed to use the fitness tracking app Strava as part of their school activities. The municipality failed to maintain control over how the students' personal data was processed within the app, violating GDPR. Consequently, the Norwegian Data Protection Authority issued a 50,000 NOK fine to the municipality.

School officials required students to grant access to their personal social media accounts during investigations. This practice violated the students' digital privacy rights and restricted their off-campus freedom of speech.

Nine current and former high school students, including student journalists in Kansas, United States, were subjected to round-the-clock digital surveillance on their accounts and devices by their school district using Gaggle software. The monitoring software allowed school administrators to monitor unpublished journalistic work, caused student files to disappear without explanation, and falsely flagged student artwork as child pornography, causing distress and confusion. In response to these privacy violations and restrictions on free expression, the students filed a federal lawsuit against school officials.

Daryn Online, an educational website built by a Kazakh startup and recommended by Kazakhstan's Ministry of Education in March 2020, gained 1.5 million new users within days. By April 1, 2020 it was offering advertisers a banner on the login and registration page that students had to pass through to reach their classes, at 70,000 KZT (US$164) a day. Its privacy policy says it may use a child's search history, messages and comments to teachers, classmates or on homework for advertising and sponsorship purposes, and may provide 'anonymous' data to third parties, partners and advertisers.

Nepal's national Learning Portal is listed by HRW among 56 government-built or government-financed educational products found transmitting children's data to advertising technology companies. HRW's table shows it has no privacy policy.

In a school district in California, United States, students using school-issued devices for homework research or playing video games were flagged by online monitoring software. School staff involved law enforcement rather than addressing the alerts directly with the students. The students, who are minors, were questioned by police and reported feeling traumatized, criminalized, and distrustful of school staff afterward. This is a personal interview. Source available to SHIELD.

A high school in the United Kingdom introduced facial recognition technology for student catering services. Students were processed under an opt-out consent model and no DPIA was completed before deployment. The ICO found that students were deprived of the ability to properly exercise their rights and freedoms in relation to the processing between March and November 2023.

Students reportedly submitted AI-generated assignments through copy-and-paste methods and were unable to explain the work. The consequence described was plagiarism and reduced learning outcomes. This is a personal interview. Source available to SHIELD.

100Ballov, a website endorsed by Kazakhstan's Education Ministry and adopted by schools as the 'educational portal for schoolchildren and students,' was found to send information about its students to AddThis, a marketing company owned by Oracle, through six cookies that in turn loaded four more trackers from AddThis's advertising partners (two DoubleClick, two Tapad). The site has no privacy policy; its 'Privacy Policy' link points back to the homepage. Oracle said any receipt of children's data through AddThis would violate its policies but did not say whether it received data from 100Ballov. 100Ballov did not respond to HRW.

HRW found seven Russian educational websites using Yandex session recording: Russian Electronic School, My Achievements, Moscow Electronic School, Sirius, My School is Online, Digital Lessons and SberClass. Yandex describes the tool as recording clicks, scrolls, keystrokes and mouse movements in a single replayable recording. All seven are apparently designed for children's educational use.

@prende 2.0 (the report's spelling) is listed by HRW among 56 government-built or government-financed educational products found transmitting children's data to advertising technology companies. HRW's table shows it has a privacy policy.

HRW found Daryn Online using Yandex session recording, which Yandex describes as recording clicks, scrolls, keystrokes and mouse movements, and detected key logging on the site as well. HRW also detected the website transmitting children's personal data to Google, CloudFlare, Yandex and Facebook. Daryn Online was one of 23 educational websites endorsed by eight governments that HRW found using session recorders, and it did not respond to HRW's request for comment.

DELIMa is listed by HRW among 56 government-built or government-financed educational products found transmitting children's data to advertising technology companies. HRW's table shows it has no privacy policy.

HRW listed EBS Online Classes, a South Korean educational website, among 16 websites it found using key logging, which captures what users type into forms, such as names, usernames and passwords, before they press submit. All but one of the 16 are marketed for children's educational use. EBS told HRW that its EBS Online Class site does not share users' data with third-party companies.

HRW's analysis of the Edmodo Android app, one of the products endorsed by Nigeria's government for learning during Covid-19 school closures, found it had the ability to collect advertising IDs, contacts and contacts' photos, phone numbers, call logs, and camera and microphone access. The app is privately developed, apparently designed for children, and had over 10 million installs. It embeds Google Crashlytics, Firebase Analytics and AdMob, plus JW Player and Matomo.

HRW's analysis of the Edmodo Android app, one of the products endorsed by Colombia's government for learning during Covid-19 school closures, found it had the ability to collect advertising IDs, contacts and contacts' photos, phone numbers, call logs, and camera and microphone access. The app is privately developed, apparently designed for children, and had over 10 million installs. It embeds Google Crashlytics, Firebase Analytics and AdMob, plus JW Player and Matomo.

HRW's analysis of the Edmodo Android app, one of the products endorsed by Egypt's government for learning during Covid-19 school closures, found it had the ability to collect advertising IDs, contacts and contacts' photos, phone numbers, call logs, and camera and microphone access. The app is privately developed, apparently designed for children, and had over 10 million installs. It embeds Google Crashlytics, Firebase Analytics and AdMob, plus JW Player and Matomo.

HRW's analysis of the Edmodo Android app, one of the products endorsed by Ghana's government for learning during Covid-19 school closures, found it had the ability to collect advertising IDs, contacts and contacts' photos, phone numbers, call logs, and camera and microphone access. The app is privately developed, apparently designed for children, and had over 10 million installs. It embeds Google Crashlytics, Firebase Analytics and AdMob, plus JW Player and Matomo.