HRW's analysis of the Edmodo Android app, one of the products endorsed by Romania's government for learning during Covid-19 school closures, found it had the ability to collect advertising IDs, contacts and contacts' photos, phone numbers, call logs, and camera and microphone access. The app is privately developed, apparently designed for children, and had over 10 million installs. It embeds Google Crashlytics, Firebase Analytics and AdMob, plus JW Player and Matomo.

HRW's analysis of the Edmodo Android app, one of the products endorsed by Thailand's government for learning during Covid-19 school closures, found it had the ability to collect advertising IDs, contacts and contacts' photos, phone numbers, call logs, and camera and microphone access. The app is privately developed, apparently designed for children, and had over 10 million installs. It embeds Google Crashlytics, Firebase Analytics and AdMob, plus JW Player and Matomo.

HRW observed ȘcoalaIntuitext sending user data to advertising technology companies through third-party marketing cookies, the Facebook Pixel and Google Analytics' 'remarketing audiences' feature, on pages likely to be accessed by children, including a page titled 'Children' that describes the platform as intended for primary school students (preparatory classes to grade IV). HRW found no evidence that these practices were limited to adults. Softwin, the operator, acknowledged sending data through these tools but said it does so to target adults, and that no children's data is used for advertising or other commercial purposes.

Extramarks, a privately developed learning app apparently designed for children with an estimated 100,000 installs, was found by HRW to have the ability to collect children's precise location (GPS, last known location and Wi-Fi network name), contacts and contacts' photos, call and SMS logs, camera and microphone access, and advertising, Wi-Fi MAC and IMEI identifiers. HRW said the app does not disclose collecting contacts information in its privacy policy, and that this data was neither necessary for the app to function nor of educational benefit. HRW listed it among nine apps potentially engaging in ID bridging, and Extramarks did not respond to HRW's request for comment.

Rumah Belajar, a website and app developed and operated by Indonesia's Ministry of Education and Culture for preschool, primary and secondary students during the pandemic, was observed sending children's Android advertising IDs to Google and Facebook. Its privacy policy says the collected device identifiers may be used to show advertisements and to advertise on third-party websites after a visit, and HRW lists it among four government products that explicitly disclose using student data for behavioral advertising.

Kelas Pintar, a privately developed Indonesian learning app apparently designed for children with an estimated 1 million installs, was found by HRW to have the ability to collect children's advertising IDs, IMEI numbers, contacts and contacts' photos, and camera access. It embeds Google and Facebook analytics SDKs and Adjust. Its privacy policy does not disclose the collection of contacts information, which HRW found neither necessary for the app to function nor of educational benefit. HRW listed it among nine apps potentially engaging in ID bridging, which can bypass privacy controls such as resetting the advertising ID. Kelas Pintar did not respond to HRW's request for comment.

Kenya Education Cloud is listed by HRW among 56 government-built or government-financed educational products found transmitting children's data to advertising technology companies. HRW's table shows it has no privacy policy.

Ruangguru, an app recommended by Indonesia's Ministry of Education and Culture and used by over 10 million students in its free pandemic version, continuously logged what children did in its virtual classrooms and sent that log to Facebook as well as to itself. Its privacy policy says it may collect interaction information such as scrolling, clicks and mouse movement to serve advertisements, and may share data with advertisers and ad networks without naming them.

Forensic analysis for HRW found that Ruangguru collects students' precise location, Android advertising ID, device information and in-app navigation, and transmits them to AppsFlyer and Facebook. The app also has the ability to access call logs, camera and microphone. Its privacy policy says it combines data it holds on students with information from other sources for advertising and other purposes. AppsFlyer told HRW it does not sell or serve ads, build targeting profiles or sell data, and did not address the questions about Ruangguru specifically.

Shad, an app built by Iran's Education Ministry for online learning during the pandemic, reported more than 18 million active users in October 2021. HRW's analysis of its code found it can collect children's precise location, including current and last known location, Wi-Fi network name, IP address, contacts and any saved photos of those contacts. HRW lists Shad as having no privacy policy, and Iran has no data protection law; a draft act pending since 2018 has no specific protections for children.

Children's names and search entries were captured through key logging and transmitted to a third-party advertising company. Even if children decided not to submit their information, the captured data was still sent automatically. Stoodi is a website recommended by the São Paulo Education Ministry and was one of 16 sites HRW found using key logging. Its privacy policy did not disclose the key logging or that the data would go to a third-party company for commercial use.

Taleemabad, a privately developed Pakistani learning app apparently designed for children with an estimated 1 million installs, was found by HRW to have the ability to collect children's precise location (including GPS, last known location and Wi-Fi network name), advertising IDs and IMEI numbers. It embeds Google and Facebook analytics SDKs. HRW listed it among nine apps potentially engaging in ID bridging, and Taleemabad did not respond to HRW's request for comment about it.

A female support teacher at a middle school was arrested in January 2025, accused of taking pupils into a school room under the pretext of tutoring, showing them pornographic videos and sexually abusing one of them, starting in October 2023. When the room was closed, she allegedly continued the abuse through a private social media group, sending sexually explicit messages and threatening the pupils with academic and personal retaliation. Six child victims were interviewed by authorities; charges include sexual violence and corruption of minors.

A national news outlet surveyed approximately 400 Dutch primary schools and found that several schools reported pornographic and extremely violent video material being shared within class-wide chat groups, alongside more common concerns like online bullying and privacy violations. Ninety-three percent of responding schools said children's online behavior caused unrest at school, though pornographic content was one of several concerns cited rather than the majority issue.

A worker says the platform suspended them for a terms violation with no explanation and withheld final pay for over 20 hours of work, close to 400 dollars, because they could not reach their payout screen. They say they followed up for months demanding payment or an explanation and received nothing. BBB lists the complaint as Unanswered by the business.

A worker says the platform suspended their account for a terms violation without warning or explanation and froze their pending payments for completed tasks. They ask for an explanation and for release of the payments. The text has unfilled placeholders, such as the date and membership length, and reads like a template letter; the amount is not stated. BBB lists the complaint as Unanswered by the business.

Lower-grade (primary-school-aged) students in Sweden were found to have viewed pornographic and horror-themed content during class time despite the school having an active content filter in place. This indicates a filter-bypass failure rather than an absence of safeguards, which is a distinct and arguably more concerning technical failure mode than districts with no filtering at all. Multiple students appear to have been involved based on the framing of the report, though exact numbers are not specified.

A father warned that his primary-school-aged child watched violent videos on an iPad during his free time. The father is strongly questioning why the municipality doesn't have internet access protection.

After pornographic images were shared in a school group chat in Switzerland, a parent reported the matter to police, triggering an investigation involving an entire class. Authorities confiscated students' phones, analyzed device data, and interviewed the young people involved to determine who had sent, received, or stored the content. The article explains that Swiss juvenile prosecutors regularly encounter pornography-related cases originating in class and group chats, often following reports from parents, classmates, social media platforms, or discoveries during other investigations. Depending on the circumstances, consequences can range from warnings and mandatory media education courses to community service or more serious penalties.

A data worker in Kenya has a balance of about $0.16 on a task platform that requires $10 to withdraw. Task scarcity has kept the balance from growing, and the worker’s last withdrawal was more than two years ago.

Students at a school in Australia used an AI application to create and circulate deepfake nude images of fellow students, prompting public criticism of the school's response and a wider community inquiry. This is the creation and distribution of non-consensual intimate imagery of minors by other minors, not passive access to existing pornographic content.

An Italian public school published the service hours and recess surveillance shifts of teachers, including an adult teacher, on its public website. Additionally, instead of using a restricted administrative module, the school utilized the public bulletin board function of an electronic register platform to manage teacher absences and substitutions, thereby exposing the teacher's absences to unauthorized colleagues, students, and parents. The Italian Data Protection Authority ruled this was an unlawful communication of personal data and fined the school.

A teacher was forced by their school's vice principal to hand over their personal mobile phone to have a mandatory school emergency application installed. This occurred after the school district mandated that staff members install the tracking app on their personal devices.

A female upper secondary school student took a screenshot of her grade on the register on the day it was given, then noticed the teacher had later lowered it and captured that too. In February 2018, a court in Lombardy, Italy, sentenced the teacher to 13 months' imprisonment for material falsification by a public official (art. 476 of the criminal code) over changes to two of the student's grades. The student first noticed. The response acted on the person responsible. Whether the register or school procedures changed is not stated in source.

A public school teacher was instructed by school administration during a faculty meeting to download a student tracking and attendance application on their personal mobile device for use in emergencies. After voicing concerns about the requirement to use personal property for school duties, the teacher faced professional backlash and received demanding follow-up emails from school administration.

A fifth-grade teacher in Santiago said the Huechuraba education department activated platform accounts for teachers and students and sent teachers only an institutional email. She said teachers were never asked to sign or accept anything, and were not told how the platforms handle privacy.

A teacher in Marivan said the principal called to say that not installing the Shad app would mean being recorded as absent, and that the authorities do not accept teaching in Telegram or WhatsApp. Teachers in Iran told HRW that the government compelled those in public schools to use the app.

A teacher reportedly unintentionally sent an intimate image into a class WhatsApp chat. Students viewed and downloaded it before deletion and parents contacted law enforcement.

A 16-year-old male student in Zimbabwe suffered a severe privacy violation and intense public exposure after a video depicting an inappropriate encounter between him and his teacher was leaked and circulated widely on social media [1.1]. The viral spread of the footage triggered national outcry and public debate regarding the student's conduct, resulting in a child-protection investigation and the arrest of the teacher.

Ten high school students allegedly installed a trojan on a teacher's unattended laptop, obtained the register password and from home deleted absences and raised grades. The head teacher spotted the anomalies and imposed disciplinary sanctions, with some students assigned community work and none failed in June; the regional postal police investigated and a trial before a regional juvenile court was expected on charges including unauthorised access and falsification of public records.

The user states that the wallet company terminated their account while still holding money they worked for. They report that support has not said when it will be released.

A college student in Texas was required by their school to use a proprietary two-factor authentication application, OneLogin Protect, on their personal device to access school systems. Because the app blocked access on jailbroken devices and virtual machines, the student was unable to use their existing hardware. To bypass the restriction and log into their school portal, the student was forced to spend forty dollars out of pocket to purchase a cheap burner phone.

According to a citation collected by an educational technology legal advocacy group, parents in a school district in Texas raised concerns in 2019 after topless images were reportedly accessible through the district's school-issued iPad program.

An algebra teacher in Dallas, Texas, told HRW that her school district initially did not put privacy protections in place, and that teachers were using an online platform she said has no privacy protection. She said 60 to 70 percent of her students had a primary family member who had been deported or was in immigration detention, and called it a dangerous situation for those students.

A six-year-old student at an elementary school in Texas, USA was sexually assaulted by classmates during a class period, with the incident recorded on a school-issued tablet; a school technology staff member discovered the recording while reviewing a device. The FBI opened an investigation, and the family has publicly stated the school's disciplinary and communication response was inadequate.

A data worker reached only $4 after three weeks on a platform requiring $10 for withdrawal.

A teacher in Istanbul told a nine-year-old student and his mother that he had to use online platforms every day to be marked as attending school during Covid-19 closures. HRW concluded that in these countries, children could not give valid, meaningful consent to the processing of their data by government-mandated platforms, because they could not refuse to use them freely without detrimental effect and had no alternative means to access their education.

A mother in Istanbul told HRW that her son's teacher required all of the 8-year-old students in the class to use Facebook, and made her son open an account at age 8 to upload his homework. She said the teacher was now requiring Facebook for tests. Facebook's terms of service prohibit children under 13 from using the service. Her son told HRW his teacher also makes him download BiP and WhatsApp for school.

Eğitim Bilişim Ağı, an app developed by Turkey's Ministry of National Education for preschool, primary and secondary students during Covid-19 school closures, has no privacy policy; its privacy policy link points back to the home page of its website, which also has none. HRW's dynamic analysis detected students' Android advertising IDs sent to Google through googleadservices.com, which is operated by Google Ads, and app-measurement.com. HRW also found the app has the ability to access phone numbers, call logs, camera and microphone.

A mother in Istanbul told HRW that her son's teacher asked her to download BiP, a government-mandated messaging app for government and school use during the pandemic. She refused because she had heard the app was not secure in terms of data privacy, and told the teacher she had no space on her phone. She said the teacher then told her they could not communicate otherwise and blocked all the parents on WhatsApp, and that she has not been able to speak to him since.

A report of an anomaly in an electronic register at a lower secondary school in Italy reached the police cyber-security unit, which checked access logs and IP addresses and confirmed a teacher's account had been breached and many students' grades changed. Two students of the school were identified as the alleged authors and referred to the regional juvenile prosecutor for unauthorised access to a computer system (an allegation).

A teacher at a state professional institute in Italy accidentally published a private academic evaluation and behavioral note regarding a student in the public class 'Agenda' section of the Classeviva electronic register. Because the teacher failed to select the option to restrict the visibility of the note, the message was exposed to all other students in the class and their families. The Italian Data Protection Authority (Garante Privacy) investigated the incident and fined the school for the unlawful communication of a minor's personal data.

An unauthorised person accessed Zoom classes and used obscene language. An FIR was registered.

An instructor at a high school in Italy mistakenly sent three email communications regarding a student's Individualized Education Program (PEI) to all of the student's classmates. As a result of this error, the student's sensitive disability and medical status were exposed to their peers without authorization.

A technical error in the Norwegian identity management system, Feide, resulted in the unauthorized transmission of national identity numbers to external service providers when users logged in. At a major Norwegian university, 15,019 students and staff had their national identity numbers shared, with 7,873 of those individuals having their data stored by third-party service providers without prior agreement. The university reported the incident to the national data protection authority.

A public school in Italy distributed operational meeting schedules via its school register platform. The documents contained the initials of 52 certified students with disabilities, making their sensitive medical-educational status recognizable to unauthorized parents, teachers, and students. As a result, the sensitive health data of these students was exposed to the wider school community, leading the Italian Data Protection Authority to issue a fine of €1,000.

A minor student, along with other student users of the Naviance educational platform, had their confidential and sensitive communications intercepted without consent by integrated third-party analytics and advertising software. This non-consensual tracking and invasion of student privacy led to a class-action lawsuit and subsequent $17.25 million court-supervised settlement.

The Italian Data Protection Authority fined a school district in Italy €4,000 for a privacy breach. The school published a teacher selection circular on its public institutional website that included the initials, class, and references to medical documentation of a minor student who required home-based instruction. This online publication effectively exposed the student's private health status and medical condition to both the public and members of the school community.

The Office of the Data Protection Commissioner of Kenya found a local school liable for multiple data protection violations after the school published photographs and videos of minor pupils on TikTok and Facebook for marketing purposes without obtaining parental consent. The regulator initiated an investigation after a parent filed a complaint regarding the school's stated intention to post student videos on social media despite objections from guardians. As a result of the investigation, the regulator issued an Enforcement Notice against the school.

The Italian Data Protection Authority (GPDP) fined a high school in the Lombardy region of Italy 2,000 after an administrative staff member mistakenly published intermediate exam results, final exam scores, and detailed oral exam schedules containing student names on the school's public website. The data was intended to be restricted to the secure, private electronic register. A female high school student filed a formal complaint regarding the public exposure of her classmates' and her own data, which was subsequently removed by the school.