FARO stands for Frontline Record of Online Harms. Technology-related harm usually reaches the public one case at a time: a school in one country, a family in another, each easy to treat as an exception. This directory puts those cases side by side to help grassroots actors see where others face the same issues they do, and to help governments and regulators see the bigger picture of the harms occurring. The directory describes what its records contain. It does not measure how often these harms occur, and a country with few records may simply have little published about it.
How to use this directory: Topics are filterable for FARO reports that have already been created based on these incidents. The harms and response patterns shown are those featured there. To see the incidents used in a country-specific report, choose that country under Country report. Pick a pattern or evidence type to see on the map which countries have matching records. Click a country on the map or in the list to see its records below. Use the filter to search for keywords or specific sources.
Shaded countries have at least one record. Choose a pattern to see where it appears.
Shading shows only that a country has at least one record in this directory that matches your selection, and every shaded country looks the same on purpose. It says nothing about how often these harms occur there. Pattern filters only cover records classified so far, and small countries are easy to miss on a map, so use the list as well.
In the list but not drawn on the map: Multiple countries, Not stated.
A data worker was paid about $8.40 through a payment service with a $50 withdrawal threshold. The service deducted $3 as a tax charge and later took the remaining $5.40 as an annual charge, leaving a zero balance.
Twenty schools in Albania received extensive smart camera deployments with unclear AI capabilities creating surveillance and transparency concerns.
View sourceEBS, South Korea's national educational broadcaster, whose website the Education Ministry recommended during pandemic school closures and which averaged over 2.1 million users a day by April 20, 2020, was found by HRW to have 24 ad trackers that send children's activity on its home page and primary-school page to 15 advertising companies, some of them large data brokers. EBS's privacy policy says personal information is used for marketing and advertising but does not disclose the ad trackers or name these companies. EBS told HRW it does not send information that would identify children.
View sourceSpain's Fiscalía de Menores (Juvenile Prosecutor's Office) opened an investigation into three minors at a school accused of using AI applications to generate sexualized deepfake images and videos from real photographs of 61 people, including 22 minors and several teachers, taken from social media, and distributing this material among students at the school. Police recovered over 100 files as part of the investigation.
View sourceThe Spanish Data Protection Agency (AEPD) fined an educational center €20,000 (reduced to €12,000) for deploying Google Workspace for Education without properly informing families or obtaining lawful consent. An investigation triggered by a parent's complaint revealed that the school processed the personal data of more than 500 students, including minors under 14, without a valid legal basis or a compliant data protection impact assessment regarding international data transfers.
View sourceThe article references an earlier program between approximately 2014 and 2018 in which teachers were reportedly required to obtain laptops through salary deductions. According to the report, many educators later complained that the devices were of poor quality and did not meet expectations, contributing to distrust of subsequent technology procurement initiatives.
View sourceA 16-year-old female student was prevented from completing academic research because of overly restrictive internet filters on her school-issued computer. The strict filters, which were implemented by her school district in response to anti-technology backlash, blocked her from accessing appropriate educational information on topics such as breast cancer.
View sourceA parent discovered that their young son, a school student, had accessed and watched pornographic content on YouTube using his school-issued tablet. The exposure to adult content occurred due to a lack of restrictions on the school device, causing significant parental distress.
View sourceA university student was arrested and detained by police after posting a tweet on Twitter/X that was deemed defamatory to the country's First Lady.
View sourceA video showed teachers allegedly assaulting a student on a school bus. The footage triggered a government investigation and possible criminal proceedings.
View sourceA female student was barred from graduation and threatened regarding her diploma by her school after she made a post on a social media platform coming out as gay. The school had monitored and acted upon her off-campus expression, leading to a legal dispute over the violation of her digital privacy.
View sourceA parent discovered that their child's personal data was made public through a student account configured on a technology company's hardware and software platform. In response, the parent initiated a campaign that ultimately resulted in a national data protection authority issuing an injunction against schools using the platform to collect and process student personal data.
View sourceA student in Washington state, United States was flagged after writing a private suicide-related document. Adults intervened after the software alert. The student reported embarrassment and discomfort from private writings being read by unintended readers and stated the embarrassment lasted for years. This is a personal interview. Source available to SHIELD.
View sourceA student experienced daily, intense headaches after a school year of using and transporting a school-issued laptop for her education. As a result of these persistent physical symptoms and a perceived lack of academic benefit, her parent decided to opt her out of using the school's computer and digital curricula for the subsequent school year.
View sourceA student at an Apple Distinguished School reported that their school requires students to enroll their personally owned iPads in the school's device management system. The student argued that fully managing personal devices is problematic and, in their jurisdiction, may even be legally questionable because it can make the device appear to Apple as school-owned property. They explained that the arrangement created concerns about restrictions and future removal of the management profile, particularly if the IT department lacks expertise. The student contrasted this with a Bring Your Own Device (BYOD) management approach, which allows schools to provide educational apps and content without taking full control of the device and can be removed by the user at any time.
View sourceAn individual purchased a used iPad and discovered it was locked and restricted under a school's mobile device management system. The buyer was unable to use the device normally and had to contact the school's IT department in an attempt to have the restriction removed.
View sourceA high school student in Zimbabwe was targeted in a class WhatsApp group by classmates who created messages mocking the student's spoken Ndebele and calling them derogatory names. The harassment caused the student to experience embarrassment and have a difficult time fitting into the school.
View sourceA Canadian student objected to a school assignment requiring the use of generative AI tools and sought advice online about resisting the requirement. The discussion included concerns about AI's impact on learning, creativity, and ethics, with several commenters encouraging the student to request an alternative assignment or voice concerns to school administrators.
View sourceIn 2019, a public school in Denmark required students to use school-provided laptops and set up public profiles on a video-sharing platform. This resulted in the public exposure of a student's personal details, including their full name, age, school name, and class, without parental consent.
View sourceA teacher remotely activated a student's webcam and observed the student while sleeping and partially undressed. The consequence was a significant invasion of privacy. This is a personal interview. Source available to SHIELD.
View sourceA student was reportedly suspended after a personal Instagram post containing alcohol in the background was detected or acted upon through monitoring practices.
View sourceDuring a university student election campaign, a 21-year-old female student was subjected to weeks of severe online harassment after endorsing a candidate in her class WhatsApp group. Classmates made vulgar comments about her body and verbally attacked her, which caused her to experience depression, retreat to her residence, and withdraw from school and student activities.
View sourceEducators reported discovering students using AI companion systems while parents and staff remained unaware. The consequence described was unsupervised emotional engagement with AI systems. This is a personal interview. Source available to SHIELD.
A school district confiscated and searched a student's personal cell phone, exposing extensive private data, texts, photos, and location history. The student's family filed a legal action, and the school district ultimately paid a financial settlement for exceeding reasonable search limits.
View sourceA school in Andalusia, Spain, restricted students' access to individual tablets, laptops, and the 'Educamos' digital educational platform if their families did not pay an annual ICT fee. As a result, affected students were forced to share devices and rely on physical paper agendas, which lacked the exclusive communication and schoolwork content uploaded to the digital platform. Following complaints from affected families, regional educational authorities launched an investigation into the school.
View sourceDuring November 2024, students at a university campus in Zimbabwe were targeted by an OTP phishing scam where scammers tricked users into sharing their login verification pins to hijack their accounts. As a result, several students were locked out of their WhatsApp accounts, causing them to miss class group chats, lose communication with lecturers regarding dissertations, and experience business disruptions on WhatsApp Business.
View sourceStudents at two schools in a Norwegian municipality were instructed to use the fitness tracking app Strava as part of their school activities. The municipality failed to maintain control over how the students' personal data was processed within the app, violating GDPR. Consequently, the Norwegian Data Protection Authority issued a 50,000 NOK fine to the municipality.
View sourceSchool officials required students to grant access to their personal social media accounts during investigations. This practice violated the students' digital privacy rights and restricted their off-campus freedom of speech.
View sourceNine current and former high school students, including student journalists in Kansas, United States, were subjected to round-the-clock digital surveillance on their accounts and devices by their school district using Gaggle software. The monitoring software allowed school administrators to monitor unpublished journalistic work, caused student files to disappear without explanation, and falsely flagged student artwork as child pornography, causing distress and confusion. In response to these privacy violations and restrictions on free expression, the students filed a federal lawsuit against school officials.
View sourceDaryn Online, an educational website built by a Kazakh startup and recommended by Kazakhstan's Ministry of Education in March 2020, gained 1.5 million new users within days. By April 1, 2020 it was offering advertisers a banner on the login and registration page that students had to pass through to reach their classes, at 70,000 KZT (US$164) a day. Its privacy policy says it may use a child's search history, messages and comments to teachers, classmates or on homework for advertising and sponsorship purposes, and may provide 'anonymous' data to third parties, partners and advertisers.
View sourceNepal's national Learning Portal is listed by HRW among 56 government-built or government-financed educational products found transmitting children's data to advertising technology companies. HRW's table shows it has no privacy policy.
View sourceIn a school district in California, United States, students using school-issued devices for homework research or playing video games were flagged by online monitoring software. School staff involved law enforcement rather than addressing the alerts directly with the students. The students, who are minors, were questioned by police and reported feeling traumatized, criminalized, and distrustful of school staff afterward. This is a personal interview. Source available to SHIELD.
View sourceEach record is a short summary of an incident described in a public source or collected through an interview by SHIELD or its partners. Records are reviewed by people before they appear here. Names and identifying details are removed: where a person appears, a role, age band and gender stand in for the name, and dates and places for minors are generalised. Every record links to its original source and shows the date that link was last checked. Records are classified with shared harm categories. The classification is SHIELD's own, so it can differ from how a source describes the incident.
You are welcome to read, link to and quote individual records with credit to FARO. Please do not copy, scrape or republish the dataset in bulk, or use it to train or test automated systems, without written permission. To ask for permission, use the SHIELD contact form. The original sources keep their own rights, and the link on each record leads to them.
SHIELD-APS. Frontline Record of Online Harms (FARO). DIRECTORY-URL. Accessed [date]. To cite a particular selection, use the web address shown after you set the filters.
When you rely on the facts of an incident, cite the original source it links to. When you rely on the classification, the patterns or the country report, cite FARO. Please describe the records as documented incidents and do not present counts or country coverage as how often these harms happen. A country with few records may simply have little published about it.
If a record is wrong, a link no longer works, or you are described in a record and want it changed or removed, use the SHIELD contact form and include the title of the record. We review each request and update or remove the record where the request is justified.
Know of a documented incident that belongs here? Send it through the incident form. A public source, such as a news report, a court or regulator decision, or a research publication, helps us verify it quickly. Submissions without a public source are kept anonymous and are not tied to named products or companies. Please leave out the names of children and of anyone who has not agreed to be named. Submissions are reviewed before anything is published, and sending one does not guarantee a record.
