EdTech Child Data Retention Audit Register

PROBLEM: An education platform used by schools can quietly collect and keep children's personal information for years and use it for advertising. The DOJ and FTC announced in May 2023 that Edmodo, LLC agreed to a permanent injunction and a $6 million civil penalty (suspended for inability to pay) for violations of the Children's Online Privacy Protection Act: until about September 2022 it collected the personal information of children under 13 — names, email addresses, phone numbers, device information, and IP addresses — without parental notice or authorization, used it to enable third parties to display targeted advertising to students between 2018 and September 2022, and retained data on about 36 million student accounts as of March 2020, of which only about one million were actively using the platform.

SOLUTION: Add a child-data retention audit register to Storage Copy Data Management that records every data element an edtech platform collects from a child, the parental consent or school authorization behind it, the retention schedule for each element, and the deletion date, and automatically purges any record whose consent is missing or whose retention period has expired.

EVIDENCE BASIS: DOCUMENTED — DOJ/FTC, May–June 2023: Edmodo, LLC agreed to a permanent injunction and a $6M civil penalty (suspended for inability to pay) for COPPA violations — collecting under-13 children's personal information without parental consent and using it for targeted advertising, 2018–Sept. 2022; ~36M student accounts retained as of Mar. 2020. Source: DOJ (N.D. Cal.) / FTC, May–June 2023.