May 30th, 2011
SAT Test Demanding Teen Information Prompts Regulator Query
U.S. Representatives Ed Markey and Joe Barton asked the College Board, owner of the SAT college entrance exam, to explain how it collects and stores data from students as the government seeks to bolster teen privacy laws.
Markey, a Massachusetts Democrat, and Barton, a Republican from Texas, requested the same information from College Board competitor ACT Inc., including disclosure and privacy policies, in letters to the nonprofit organizations today. Copies of the letters were posted on Markey’s website.
Both companies collect data from millions of teenagers annually as they register for SAT and ACT tests and then sell their names and personal information to colleges, which use them in direct marketing to potential applicants. While Markey and Barton introduced a bill this month to expand a children’s online privacy law to teenagers, the proposal doesn’t cover nonprofit companies, such as the College Board and ACT.
“There should be some kind of regulatory control over what even a nonprofit can be culling from students,” said Pam Dixon, executive director of the World Privacy Forum, a nonprofit public interest research group in Cardiff by the Sea, California.
The letters include 12 groups of questions and asked for a response by June 16. The College Board and ACT were asked whether they make students aware that the information collected doesn’t affect the chances of getting into college and about how secure the data storage is. The congressmen also ask about the sale of the information and who is buying the data.
“ACT has the greatest respect for students and we follow industry standard security measures to protect their privacy,” Scott Gomer, a company spokesman, said in an e-mail.
“Protecting the privacy and security of the students who participate in College Board programs has always been a top priority for our organization,” Kathleen Steinberg, a spokeswoman for the College Board, said yesterday. She declined to make further comment today.
‘Less Than Voluntary’
The College Board’s database of student names includes about 5.1 million with e-mail addresses. The New York-based company had $63 million in revenue from its business that includes name-selling in the year ended June 2010. Iowa City, Iowa-based ACT took in $7.5 million in revenue from its Educational Opportunity Service for the most recent year, which ended in August, the company said. It has a database of 2.4 million names of high school sophomores, juniors and seniors.
“Given the kids’ ages and the setting in which the data is collected, there are elements that read as less than voluntary because these tests are usually required to get into college,” said Dixon. In 2009, she testified before a joint congressional subcommittee about data collection.
Markey and Barton’s proposed bill would establish new protections for 13- to 17-year-olds. Among the safeguards, the legislation would prohibit online commercial companies from using personal information of teens for targeted marketing purposes, as well as limit collection of their personal and geographic information.
The Federal Trade Commission’s 1998 Children’s Online Privacy Protection Act prohibits personal information of children 12 and under from being collected online without “verifiable parental consent.” The proposed legislation ought to include new authority for the FTC to regulate data-collection practices of nonprofit groups that target teens for commercial- like purposes, such as selling names to colleges, said Jeff Chester, executive director of the Center for Digital Democracy, a nonprofit consumer-protection advocacy group in Washington.
“The Markey-Barton bill is focused on commercial businesses, even though many of these same disturbing practices are being conducted in a widespread fashion by nonprofit organizations,” Chester said. “Nonprofit organizations operate under a golden halo effect.”
The Education Department is trying to change its own privacy regulations under the Family Educational Rights and Privacy Act, known as FERPA, to expand sharing of educational records of kindergarten to 12th graders. The testing companies’ data collection isn’t covered under FERPA.
33 Cents a Name
More than 90 percent of students who take the SAT register online, said the College Board’s Steinberg. The same percentage register online for ACT tests, said Ed Colby, a spokesman for that company. Students are asked to “opt in” to the search service to let schools and scholarship programs provide materials. They can also opt out. Students aren’t told their names will be sold and their parents aren’t asked for permission.
The College Board and ACT sell student names and information to colleges at 33 cents a name, according to the companies. About 1,100 colleges and universities use the College Board’s Student Search Service, Jennifer Topiel, another College Board spokeswoman, said in an e-mail.
Colleges perform searches based on bands of test scores to create lists of prospective applicants. They can search on criteria such as self-reported grades, ethnicity and religion, generated by the survey questions asked of the students.
‘Deer in the Headlights’
Universities buy names from the College Board and ACT because they cannot obtain academic records directly from high schools without student and parental consent, said Joel Reidenberg, a law professor who directs the Center on Law and Information Policy at Fordham University in New York.
“The College Board and ACT exploit their role as gatekeepers to college access and use that role to obtain consent from minors to sell their information,” Reidenberg said. “High schoolers are like deer in the headlights against a very sophisticated marketing industry. Parents have no idea and the law does not protect the students’ privacy. It should.”
While the College Board’s 39-year-old Student Search Service has increased its volume by about 20 percent over the past decade, it doesn’t release the total number of names sold annually, spokeswoman Topiel said. ACT didn’t disclose how many names it sells annually from its service, which started in 1970.
Both companies have public charity status because they typically get more than a third of their support from membership fees, contributions and gross receipts from activities related to their exempt functions, according to tax filings.