- Educational websites directed at Brazilian students, including two created by state education secretariats, surveilled children and harvested their personal data.
- These websites not only watched children in their online classrooms, but followed them across the internet, outside school hours, and deep into their private lives.
- Brazil should require companies and governments to stop their data surveillance of children, and set up legal safeguards to protect children online.
(São Paulo) – Educational websites directed at Brazilian students, including two created by state education secretariats, conducted surveillance on children and harvested their personal data, Human Rights Watch said today. The national government should amend Brazil’s data protection law by adding new safeguards to protect children online.
Analysis conducted by Human Rights Watch in November 2022 and reviewed again in January 2023 found that seven educational websites extracted and sent children’s data to third-party companies, using tracking technologies designed for advertising. The websites are: Estude em Casa, Centro de Mídias da Educação de São Paulo, Descomplica, Escola Mais, Explicaê, MangaHigh, and Stoodi. An eighth website, Revisa Enem, sent children’s data to a third-party company, though without using ad-specific trackers.
These websites not only watched children inside of their online classrooms, but followed them across the internet, outside school hours, and deep into their private lives.
“Children and their families in Brazil are being kept in the dark about the data surveillance conducted on children in online classrooms,” said Hye Jung Han, children’s rights and technology researcher and advocate at Human Rights Watch. “Instead of protecting children, state governments have willfully enabled anyone to surveil them and collect their personal information online.”
The Minas Gerais and São Paulo education secretariats originally authorized these websites for children’s use during the Covid-19 pandemic, and they remain in use. Human Rights Watch had reported in May 2022 that these and one other website infringed on children’s privacy. Following that investigation, one website, DragonLearn, was taken down from the internet.
Human Rights Watch found that five websites deployed particularly intrusive tracking techniques to invisibly surveil children in ways that were impossible to avoid or protect against.
Escola Mais’ study guides and videos were endorsed by the São Paulo education secretariat for elementary school students during Covid-19 school closures. The website now advertises technology-driven, in-person classes for elementary and high school students.
Human Rights Watch discovered Escola Mais using session recording, a technique that allows a third party to watch and record a user’s behavior on a webpage. That includes mouse clicks and movements around a webpage; the digital equivalent of logging video surveillance each time a child scratches their nose or grasps their pencil in class.
Typically, the third party would then scrutinize the data on behalf of the website to guess a user’s personality, their preferences, and what they are likely to do next. Escola Mais did not respond to four requests for comment.
Human Rights Watch also found that from 2021 to 2023, educational websites owned and operated by the education secretariats of Minas Gerais and São Paulo sent children’s personal data to advertising technology companies. Both websites continue to be regularly updated with video classes and materials for students.
In response to the investigation, the education secretariat of Minas Gerais promptly removed all ad tracking from its website. This positive development demonstrates that it is possible to build and offer educational services to children that do not compromise their data and their privacy.
The São Paulo education secretariat continues to endorse the use of seven educational websites that improperly harvest children’s personal data, including its own. It did not respond to four requests for comment from Human Rights Watch.
Human Rights Watch also found that four websites tracked children more intensely than the average adult browsing the internet.
With the exception of Revisa Enem, all websites examined by Human Rights Watch harvested vast amounts of children’s data and sent it to companies that specialize in behavioral advertising, which entails analyzing a child’s data to predict what the child might do next, or how they might be influenced. Advertisers might use these insights to target the child with personalized content and ads that follow them across the internet.
Profiling, targeting, and advertising to children in this way impermissibly infringes on their privacy, as it is neither proportionate nor necessary for these websites to function or deliver educational content. It also risks violating children’s other rights if this information is used to guide them toward outcomes that are harmful or not in their best interest. Such practices also play an enormous role in shaping children’s online experiences and determining the information they see, at a time in their lives when their opinions and beliefs are at high risk of manipulative interference.
Children could not meaningfully object to such surveillance during Covid-19 school closures. As these websites that were temporarily offered were free and widely disseminated to schools by the government, many schools adopted their use. It was impossible for many children to opt out of tracking without giving up on formal learning altogether.
Neither the Minas Gerais nor the São Paulo education secretariat appears to have checked whether their online learning endorsements were safe for children to use. Even as schools have reopened, the state governments’ dissemination of these websites during the pandemic paved the way to their continued use by students and schools.
Children continue to be denied the knowledge to challenge or protect themselves against these invasions on their privacy: Neither the state authorities nor the companies have fully disclosed their tracking practices, which are invisible to the user.
Brazil’s data protection authority should stop these assaults on children’s privacy. It should require these companies and state governments to delete children’s data collected since the pandemic, and prevent them from further using children’s data for any purpose unrelated to providing education.
Brazil’s constitution protects the right to privacy. The country has also ratified the UN Convention on the Rights of the Child, which entitles children to special protections that guard their privacy.
While the decision by Miras Gerais’ state government to remove all data surveillance from its educational website is positive, Brazil’s children should not face state-by-state variation in protection, and cannot rely on individual providers to do better. As written, Brazil’s data protection law – the Lei Geral de Proteção de Dados Pessoais, or the General Personal Data Protection Law – does not provide sufficient protections for children. It does not explicitly prohibit actors from exploiting children’s information or require them to provide high levels of safety and security for children.
Lawmakers should amend the law to establish comprehensive child data protection rules, including bans on behavioral advertising and the use of intrusive tracking techniques on children. These rules should also require all actors offering online services to children – including online learning – to provide the highest levels of protection for children’s data and their privacy.
“Children shouldn’t be coerced to give up their privacy in order to learn,” Han said. “The government should urgently adopt data protection safeguards to stop the surveillance of children online.”
For additional details on each educational website, please see below.
Methodology
Brazil delegates significant decision-making authority to its state-level education authorities. During pandemic-related school closures, this included decisions about what online learning products to endorse or procure for school use. Human Rights Watch selected the two most populous states – São Paulo and Minas Gerais – and conducted technical analysis on the nine Edtech products that they had endorsed using a customized version of Blacklight, a real-time website privacy inspector built by Surya Mattu, former senior data engineer and investigative data journalist at The Markup.
It is not possible for Human Rights Watch to definitively determine the intent of a tracking technology or how the collected data is used, beyond reporting on what can be determined from the data, and the companies’ and governments’ own statements. For example, a product can include third-party computer code that collects data that may be useful to monitor the product’s performance. This data may also be used with other third-party code for advertising purposes.
To reduce ambiguity, Human Rights Watch reviewed the companies that received children’s data and those that owned the tracking technologies found in an online learning product.
The Human Rights Watch May 2022 investigation on the online learning products endorsed by 49 countries, and its full methodology, can be found here. All results and technical analysis from that investigation can be found here.
Human Rights Watch shared its findings and technical evidence with the companies and the two state education secretariats, and gave them multiple opportunities to respond. Human Rights Watch offered the education secretariats a final opportunity to respond in March 2023, prior to publication. All responses are described below.
When contacted for comment, Google did not acknowledge that they received data from these websites, and did not answer whether they had used this data for advertising. Google’s advertising policies prohibit targeting children under 13 with behavioral advertising.
Estude em Casa
Estude em Casa is a website that was built by Minas Gerais’ education secretariat to deliver free learning to children during Covid-19 school closures, and continues to be regularly updated with video classes and materials. The education secretariat said it was developed to help children “learn safely at home in this period of social isolation.”
In May 2022, Human Rights Watch reported that Estude em Casa sent its users’ data to one third-party company and its advertising division. It did so by using four ad trackers, three third-party cookies, and Google Analytics’ “remarketing audiences” tool, allowing the website to potentially target users with ads across the internet.
When contacted for comment in April 2022, the education secretariat stated that “Estude em Casa does not collect data for advertising or any commercial purpose,” and that it “does not use or collect student data, as it does not require any type of login to access the platform,” but acknowledged using Google Analytics “for tracking and monitoring purposes.”
In November 2022 and again in January 2023, Human Rights Watch found that Estude em Casa continued to send user data to the same third-party company and its advertising division, through three ad trackers, three third-party cookies, and Google Analytics’ “remarketing audiences” tool.
After being notified by Human Rights Watch, the education secretariat promptly removed all ad tracking from Estude em Casa on March 24, 2023.
Centro de Mídias da Educação de São Paulo
Centro de Mídias da Educação de São Paulo is a website and app developed and used by São Paulo’s education secretariat to provide free classes during Covid-19 school closures, and continues to be regularly updated with video classes and materials.
In May and November 2022 and again in January 2023, Human Rights Watch found that the product sent users’ data to two third-party companies through four ad trackers, including a tracking script that could enable advertising.
The São Paulo education secretariat did not respond to four requests for comment, the latest sent to the new administration in January and in March of this year. It did not respond to Human Rights Watch’s offer in March 2023 to discuss these findings prior to publication.
Descomplica
Descomplica is a website and app developed by the Brazilian company Descomplica Cursos Livres Via Web, and is marketed at students taking the Enem and Vestibular admissions exams for Brazilian universities. Descomplica claims that it is the country’s largest online teaching platform and authorized by the national Education Ministry.
On March 26, 2020, the São Paulo education secretariat endorsed its use for high school students preparing for these exams during Covid-19 school closures. It was free for use until December 2020.
In May 2022, Human Rights Watch reported that Descomplica sent its users’ data to 20 companies. It did so by using 30 ad trackers and 19 third-party cookies that tracked users across the internet. Most of these companies specialized in using this kind of information to target people with behavioral advertising.
Children using Descomplica to study were tracked more intensely than the average adult browsing a website. By comparison, The Markup has found that the world’s most popular 80,000 websites – a list that includes global e-commerce giants that deploy extensive advertising – load a median of three third-party cookies and seven ad trackers.
Descomplica also used session recording to record what users did on its website, including clicks and movements around the page, and sent the recording to a third-party company. It also used Facebook Pixel and Google Analytics’ “remarketing audiences,” two tools that allowed it to potentially target users with ads across the internet.
In November 2022 and again in January 2023, Human Rights Watch found that Descomplica sent users’ data to 26 companies, using 37 ad trackers and 39 third-party cookies. It continued to use session recording, Facebook Pixel, and Google Analytics’ “remarketing audiences” tool.
Descomplica did not respond to four requests for comment.
DragonLearn
DragonLearn was a website built by a Brazilian company of the same name. On March 26, 2020, the São Paulo education secretariat endorsed its use for elementary school students during Covid-19 school closures, and the website was free for use until December 2020.
In May 2022, Human Rights Watch reported that DragonLearn sent its users’ data to six companies. It did so by using eight ad trackers and three third-party cookies that tracked users across the internet. DragonLearn also used session recording to record what users did on its website, including clicks and movements around the page, and sent the recording to a third-party company. It also used Facebook Pixel and Google Analytics’ ‘remarketing audiences,’ two tools that allowed it to potentially target users with ads across the internet.
DragonLearn was taken down from the internet after Human Rights Watch’s May investigation and subsequent media reporting.
DragonLearn did not respond to three requests for comment.
Escola Mais
Escola Mais is a website built by a Brazilian company of the same name, which advertises in-person classes for elementary and high school students. On March 26, 2020, the São Paulo education secretariat endorsed the use of Escola Mais’ study guides and videos for elementary school students to use during Covid-19 school closures, and the website was free for use until January 2021.
In May 2022, Human Rights Watch reported that Escola Mais sent its users’ data to six companies. It did so by using 11 ad trackers and 6 third-party cookies that tracked users across the internet. The website also sent users’ data through Facebook Pixel and Google Analytics’ “remarketing audiences,” two tools that allowed it to potentially target users with ads across the internet.
In November 2022 and again in January 2023, Human Rights Watch found that Escola Mais had sent its users’ data to 37 companies, using 34 ad trackers and 53 third-party cookies. Escola Mais continued to use Facebook Pixel and Google Analytics’ “remarketing audiences.”
Human Rights Watch also found that Escola Mais had begun using session recording, a technique that allows a third party to watch and record a user’s behavior on a webpage. Escola Mais had also begun using key logging, an invasive procedure that surreptitiously captures personal information that people enter on forms, like names, phone numbers, and passwords, before they hit submit. Companies have used this technique for many purposes, including identifying anonymous web users by matching them to postal addresses and real names, before they can consent.
Escola Mais did not respond to four requests for comment.
Explicaê
Explicaê is a website built by the Brazilian company Explicaê Conteudo e Educacao Digital. On March 26, 2020, the São Paulo education secretariat endorsed its use for high school students preparing for Brazil’s Enem and Vestibular university admissions exams during Covid-19 school closures, and it was free for use until January 2021.
In May 2022, Human Rights Watch reported that Explicaê had sent its users’ data to five companies. It did so by using seven ad trackers and one third-party cookie that tracked users across the internet. The website also sent users’ data through Facebook Pixel and Google Analytics’ “remarketing audiences,” two tools that allowed it to potentially target users with ads across the internet.
In November 2022 and again in January 2023, Human Rights Watch found that Explicaê had sent its users’ data to 9 companies, using 12 ad trackers and 10 third-party cookies. Explicaê also continued to use Facebook Pixel and Google Analytics’ “remarketing audiences.”
Explicaê did not respond to four requests for comment.
MangaHigh
MangaHigh is a website built by the UK company Blue Duck Education Limited and offers educational math games for pre-primary, elementary, and high school students. On March 26, 2020, the São Paulo education secretariat endorsed its use for elementary school students during Covid-19 school closures, and it was free for use until December 2021.
In May 2022, Human Rights Watch reported that MangaHigh had sent its users’ data to 4 companies, by using 11 ad trackers. The website also sent users’ data through Facebook Pixel and Google Analytics’ “remarketing audiences,” two tools that allowed it to potentially target users with ads across the internet. MangaHigh also used session recording to record what users did on this website, including clicks and mouse movements around the page, and sent the recording to a third-party company. It also used key logging to capture text typed by users before they hit send.
In November 2022 and again in January 2023, Human Rights Watch found that MangaHigh sent its users’ data to three companies, using four ad trackers and one third-party cookie. The website no longer used session recording or Facebook Pixel, but continued to use key logging and Google Analytics’ “remarketing audiences.”
When contacted in December 2022, MangaHigh requested details of the new technical analysis. Human Rights Watch provided a full copy of the evidence and results. MangaHigh did not respond.
Revisa Enem
Revisa Enem is a website built by a Brazilian company of the same name. On March 26, 2020, the São Paulo education secretariat endorsed its use during Covid-19 school closures for high school students preparing for Brazil’s Enem and Vestibular university admissions exams, and it was free for use until December 2021.
In May 2022, Human Rights Watch found that Revisa Enem sent its users’ data to one third-party company, using one ad tracker.
In November 2022 and again in January 2023, Human Rights Watch found that Revisa Enem sent its users’ data to one third-party company, using two ad trackers.
Revisa Enem did not respond to multiple requests for comment.
Stoodi
Stoodi is a website built by a Brazilian company of the same name. On March 26, 2020, the São Paulo education secretariat endorsed its use during Covid-19 school closures for high school students preparing for Brazil’s Enem and Vestibular university admissions exams, and it was free for use until February 2021.
In May 2022, Human Rights Watch found that Stoodi sent its users’ data to 18 companies, using 24 ad trackers and 21 third-party cookies that tracked users across the internet. The website also sent users’ data through Facebook Pixel and Google Analytics’ “remarketing audiences,” two tools that allowed it to potentially target users with ads across the internet.
Stoodi was also detected using session recording to record what users did on this website, including clicks and movements around the page, and sent the recording to an advertising company, Ve Global. It also used key logging to capture text typed by users before they hit send.
When contacted in March 2022, Ve Global acknowledged that Stoodi was a former client, and confirmed that Stoodi’s website was still using Ve Global’s tracking tags. Ve Global confirmed that it had subsequently disabled and made the tag unusable for Stoodi to continue sending user data to Ve Global.
In November 2022 and again in January 2023, Human Rights Watch found that Stoodi sent users’ data to 16 companies, using 20 ad trackers and 19 third-party cookies. It continued to use Facebook Pixel, Google Analytics’ “remarketing audiences,” session recording, and key logging.
When contacted in December 2022, Stoodi acknowledged the Human Rights Watch findings and said that its data practices were to improve user experience and for “advertising Stoodi to potential customers and enabling CRM [customer relationship management] commercial actions.” Stoodi said that its users were age 16 or older, that it did not sell personal data to third parties, and that it had not held an active contract with a public educational institution since 2021.
Upon Stoodi’s request, Human Rights Watch provided it with a full copy of its technical evidence and results. Stoodi did not respond.
