FARO stands for Frontline Record of Online Harms. Technology-related harm usually reaches the public one case at a time: a school in one country, a family in another, each easy to treat as an exception. This directory puts those cases side by side to help grassroots actors see where others face the same issues they do, and to help governments and regulators see the bigger picture of the harms occurring. The directory describes what its records contain. It does not measure how often these harms occur, and a country with few records may simply have little published about it.
How to use this directory: Topics are filterable for FARO reports that have already been created based on these incidents. The harms and response patterns shown are those featured there. To see the incidents used in a country-specific report, choose that country under Country report. Pick a pattern or evidence type to see on the map which countries have matching records. Click a country on the map or in the list to see its records below. Use the filter to search for keywords or specific sources.
Shaded countries have at least one record. Choose a pattern to see where it appears.
Shading shows only that a country has at least one record in this directory that matches your selection, and every shaded country looks the same on purpose. It says nothing about how often these harms occur there. Pattern filters only cover records classified so far, and small countries are easy to miss on a map, so use the list as well.
In the list but not drawn on the map: Multiple countries, Not stated.
A parent reported that pornographic and violent video content appeared on their first grade boy's school-issued tablet, finding that the tablet had no restrictions or content filters.
View sourceA report describes pornographic content appearing on a school-issued tablet used by a child in Norway
View sourceThe Norwegian Data Protection Authority (Datatilsynet) issued warnings of reprimand to three Norwegian municipalities for GDPR violations associated with their school-wide deployments of Google Chromebook and G Suite for Education. The regulator determined that the municipalities failed to perform adequate risk and privacy impact assessments, failed to establish a proper legal basis for data processing, and did not sufficiently inform students and parents about how their data would be processed and profiled.
View sourceManipulated nude images of two students created with the Bikinioff app were circulated among schoolmates. Police seized phones and a juvenile inquiry was opened.
View sourceDuring an online class at a government school in India, in September 2025, a student allegedly played an obscene clip. The mother of a female student in the class complained to the school administration; she alleged no action followed and that her teenage daughter was harassed at school after she raised it, leading her to file a police complaint. The school's disciplinary committee was unable to identify who was responsible, and the cyber cell is investigating.
View sourceParents of a 12-year-old reported in May 2026 that the child's online tutor exposed his bare lower body during a session, and police obtained a recording of it, according to the New Castle County Police Department. The tutor, a contractor with the platform since 2014, was charged with indecent exposure and sexual abuse of a child by a person of trust. The platform suspended him and gave police further recordings allegedly showing similar behaviour with other students.
View sourceA contributor on an AI training platform had their account suspended in November 2024 for alleged guideline violations, which they denied. Following the suspension, the platform refused to release $525 in earnings owed to the contributor for completed services and left their support inquiries unanswered.
View sourceA parent was quoted €640 with a 12‑month plan for a mandatory school device. Choosing the payment plan increased the total to €786.99 and extended payments to 36 months.
View sourceParents who financed Lido Learning subscriptions through the company's lending partners continued paying EMIs after classes stopped, according to the report. One parent was warned by the financing partner that non-payment could hurt their credit score and bring loan recovery agents to the house, and said the family shelved plans to buy a house. The child's age is not stated.
View sourceA single mother in West Bengal, India paid Rs 36,000 in instalments for a two-year Lido Learning subscription for her fifth-grade child, but regular classes stopped in March 2022, and she said she lost Rs 18,000 outright. The company filed for insolvency with the National Company Law Tribunal in September 2022 without refunding fees, according to the report. She said she could not teach her child herself and did not think she could afford another tutor.
View sourceA parent struggled to unlock a device after sixth year and was told it had been rented rather than purchased.
View sourceA parent reported continued disclosure of personal information despite attempts to limit location sharing and digital footprint creation. This is a personal interview. Source available to SHIELD.
A parent reported that a school application required identity numbers, phone numbers, and payment information without providing a clear privacy policy. This is a personal interview. Source available to SHIELD.
A parent reported that during the COVID-19 period government education applications collected extensive information about students and parents including names phone numbers locations and school details. The applications later disappeared and it was unclear what happened to the data. This is a personal interview. Source available to SHIELD.
A data worker described PayPal accounts being flagged and funds locked for 180 days after larger payments arrived.
A female high school senior in Pennsylvania struggled to concentrate and experienced falling grades due to sustained, daily use of school-issued laptops since kindergarten. She found it difficult to focus when learning from screens, leading her to secretly watch streaming services during class. Although her mother requested that the school district confiscate the laptop, the district refused because the devices are integrated into the curriculum.
View sourceA data worker was paid $0.015 per image-sorting task on a platform with a $50 withdrawal threshold, making withdrawal effectively unreachable.
Peru's Aprendo en Casa is listed by HRW among 56 government-built or government-financed educational products found transmitting children's data to advertising technology companies. HRW's table shows it has no privacy policy.
View sourceThe platform reportedly helped trainers recover unpaid earnings but not the broader worker population.
A worker says their balance was in the multiple four-figure range when the platform locked the account on the seventh day and asked them to justify submitted tasks. They say they supplied proof, and after two weeks there was still no reply to emails or social media messages. The account stayed under review and the earned balance was out of reach.
View sourceA female graduate of a state polytechnic in Nigeria discovered that an impersonator had used her personal credentials and matriculation number to register on the National Youth Service Corps (NYSC) online registration portal. Her institution attributed the issue to a database breach by a hacker who manipulated mobilization records. As a result of this incident, the graduate was blocked from completing her mandatory national service, causing her severe distress and delaying her from obtaining a required employment certificate.
View sourceIn January 2021, intruders joined an online open day for a primary school in Italy, which was accessed via a public link, and broadcast a pornographic video and blasphemous audio to teachers and prospective families. Organizers could not remove the intruders, so everyone left the meeting. The female head teacher reported the incident to the postal police to trace those responsible. The response acted on the persons responsible via a police complaint.
View sourceResearchers proposed recording preschool classrooms to train AI systems. Parent objections regarding monitoring and consent resulted in cancellation of the project.
View sourceA primary school student in Scotland was left traumatized after being exposed to explicit content on a school-issued laptop. The exposure occurred when classmates searched for a medical term on their Chromebooks, bypassing the school's safety filtering system while connected to the school Wi-Fi. The child's parent reported that multiple children were exposed to the material, causing them distress and confusion.
View sourceA primary school teacher in the Mashonaland West region of Zimbabwe was sentenced to 12 months in jail for multiple counts of indecent assault against pupils in his class. Among these counts, the teacher showed pornographic material on his mobile phone to an 11-year-old female student during lesson time. The student and other class victims experienced trauma and subsequently reported the incidents, leading to the teacher's arrest and prosecution.
View sourceA municipality in Agder, Norway deployed the digital mapping tool Spekter at local schools to track bullying and class environments. The tool collected non-anonymous peer-reported details identifying specific students as bullies, victims, or class disruptors, which was done without proper legal basis, transparency, or the ability for named students to access or correct the allegations. The Norwegian Data Protection Authority and the Privacy Appeals Board (Personvernnemnda) ruled the data processing unlawful, ordering the municipality to delete all collected data.
View sourceA female private maths tutor tutored a teenage boy online and then arranged to meet him at her home, where she had sexual contact with him while aware he was under the age of consent. The boy's mother found inappropriate WhatsApp messages on his phone in May 2023. The tutor pleaded guilty and was jailed for six years at a court in the United Kingdom in August 2024; police said the abuse had a significant impact on the boy and his family.
View sourceA private school in Kenya shared the name and exam results of a minor student with a national media group, which published them in an advertising feature of a newspaper in August 2025. This disclosure occurred without the consent of the minor's parent, who had previously objected in 2023 to such publications and received assurances from the school. Following a complaint, Kenya's Office of the Data Protection Commissioner found the school liable for unlawfully processing the minor's data for commercial purposes and violating the parent's right to object, ordering the school to pay KES 637,500 in compensation.
View sourceA ransomware-infected laptop was connected to the school network of five educational institutions in Denmark. This allowed unauthorized third parties to compromise the network and publish the private personal data of over 10,000 students on the dark web.
View sourceAxios Italia, supplier to about 40% of Italian schools, reported a ransomware attack starting 3 April 2021 that left many schools without their register as in-person lessons resumed. The company told teachers and staff to use an emergency register, said it expected to restore service, and said its checks so far showed no data stolen. The company first noticed and reported it.
View sourceA worker says they were flagged for spam on every review in a rating job without warning or explanation, and that their pay was withheld. They say they were not told which standard they broke and that support replies are slow and unhelpful. The complaint text is cut off and no amount is stated. BBB lists the complaint as Unanswered by the business.
View sourceA worker recruited through LinkedIn says they were paid 0.29 dollars at first, received a reduced incentive payment, and were not paid for about 9.33 hours at 54 dollars an hour. They say an automated Slack message then removed them from communication. BBB lists the complaint as Unanswered by the business.
View sourceEach record is a short summary of an incident described in a public source or collected through an interview by SHIELD or its partners. Records are reviewed by people before they appear here. Names and identifying details are removed: where a person appears, a role, age band and gender stand in for the name, and dates and places for minors are generalised. Every record links to its original source and shows the date that link was last checked. Records are classified with shared harm categories. The classification is SHIELD's own, so it can differ from how a source describes the incident.
You are welcome to read, link to and quote individual records with credit to FARO. Please do not copy, scrape or republish the dataset in bulk, or use it to train or test automated systems, without written permission. To ask for permission, use the SHIELD contact form. The original sources keep their own rights, and the link on each record leads to them.
SHIELD-APS. Frontline Record of Online Harms (FARO). DIRECTORY-URL. Accessed [date]. To cite a particular selection, use the web address shown after you set the filters.
When you rely on the facts of an incident, cite the original source it links to. When you rely on the classification, the patterns or the country report, cite FARO. Please describe the records as documented incidents and do not present counts or country coverage as how often these harms happen. A country with few records may simply have little published about it.
If a record is wrong, a link no longer works, or you are described in a record and want it changed or removed, use the SHIELD contact form and include the title of the record. We review each request and update or remove the record where the request is justified.
Know of a documented incident that belongs here? Send it through the incident form. A public source, such as a news report, a court or regulator decision, or a research publication, helps us verify it quickly. Submissions without a public source are kept anonymous and are not tied to named products or companies. Please leave out the names of children and of anyone who has not agreed to be named. Submissions are reviewed before anything is published, and sending one does not guarantee a record.
