Privacy Evaluation for Code.org
Code.org is an online application dedicated to expanding access to computer science learning, and increasing participation by women and underrepresented students of color. Code.org's terms state they allow representatives of school districts and schools, such as teachers, administrators, counselors, and other volunteer mentors to set up classrooms with their students through the Services in order to provide tutorial, educational and similar services. Code.org's terms state they collect personally identifiable information and automatically collected usage information from a user when they create a Code Studio Student or Teacher account. In addition, Code.org's terms state they take the protection of a user’s information very seriously and its officers, directors, employees, agents and contractors must have a legitimate business reason to access a user’s Personal Information and to treat any Personal Information of Code.org users as confidential information. Lastly, Code.org's terms specify they take steps to minimize the collection of personal data from users under the age of 13, and encourage children to get the approval of a parent or legal guardian before creating an account on Code.org.
The terms of Code.org state they are deeply committed to creating a safe and secure learning environment for its students and teachers. Code.org's terms specify they allow representatives of school districts and schools, such as teachers, administrators, counselors, and other volunteer mentors to set up classrooms with their students through the Services in order to provide tutorial, educational and similar services. However, Code.org’s platform does not connect students directly to volunteers or mentors, but instead provides Educators information about potential volunteers.
In addition, Code.org's terms state they have created a tool called the “Internet Simulator” for use in High School classrooms to model how the Internet functions. With this tool, students participating in a teacher-supervised classroom activity can send text-based messages to their teacher and to other students in their specific classroom section. The terms state message contents are visible to the classroom teacher and are not accessed or used by Code.org for any purpose other than an educational tool. All messages are deleted after two hours of class inactivity, or upon a manual reset by the teacher.
Code.org's terms state they collect personally identifiable information and automatically collected usage information from a user when they create a Code Studio Student or Teacher account. However, Code.org's terms state they do not require a user to provide any personal information in order to try the tutorials, many of which are accessible without creating a user account. The terms of Code.org state they will never share a user’s personal information with other third parties without the user’s explicit opt-in consent. In addition, Code.org's terms state they do not rent or sell personal information, persistent identifiers, or any other information that they may collect from users, or exploit it for financial gain. Moreover, Code.org's terms specify they do not display any advertising and do not use student data for any targeted or behavioral advertising, profiling, onward disclosure, or collect a user’s web search history across third-party Internet websites or search engines.
Lastly, the terms of Code.org state that school district partners may provide anonymous or de-identified student academic data to an independent third party evaluator to measure how well their programs perform and how well students are learning from them in select partner school districts. The terms of Code.org state that any student academic data provided by Code.org or by our school district partners we provide to third party third-party evaluators for the purpose of evaluating our courses in meeting our mission will be de-identified per standard industry practice.
Code.org's terms state they take the protection of a user’s information very seriously and its officers, directors, employees, agents and contractors must have a legitimate business reason to access a user’s Personal Information and are required to treat any Personal Information of Code.org users as confidential information. In addition, Code.org's terms state they use certain physical, managerial, and technical safeguards designed to preserve the integrity and security of a user’s Personal Information. The terms state that Code.org encrypts personal information in transit and at rest, and have generally aligned their security practices to the NIST Cybersecurity Framework. To protect a user’s privacy and security, Code.org's terms state they take reasonable steps to verify an individual’s identity before granting them account access or making corrections to their Personal Information. Teachers who create user accounts on behalf of students can reset the “secret word” or “secret picture” for young children who can’t read, as long as the student leaves the teacher in control of the account.
In addition, although a user may provide personal information to Code.org to use the Service, Code.org's terms state they believe that data they do not store cannot be stolen from them. Code.org's terms state they intentionally choose not to store email addresses for Code Studio student accounts, or phone numbers used in the send-to- phone feature. Lastly, if Code.org learns of a data security incident that compromises or appears to compromise a user’s Personal Information, they will attempt to notify affected users electronically so that they can take appropriate protective steps.
Code.org's terms state they take steps to minimize the collection of personal data from users under the age of 13, and encourage children to get the approval of a parent or legal guardian before creating an account on Code.org. If a user is under the age of 13, the terms state they will be able to use the App Lab, Game Lab, and Web Lab tools in the classroom with their teacher’s approval.
he terms state users under 13 can try most tutorials without creating an account, but their learning progress won’t be saved. If Code.org learns that it has inadvertently collected Personal Information or Persistent Identifiers from children under the age of 13 without prior parental or teacher consent, Code.org will take appropriate steps to delete this information. The terms also state when students create accounts on Code Studio, Code.org does not store the email address provided by those Users in a retrievable format. Code.org's terms state they immediately create and store a one-way hashed version of the email address, which cannot be converted back into the original address, and use it only for the purposes of login, account management, and password recovery.
In addition, the terms state Code Studio's learning platform is designed to be used by Users of all ages, including children under the age of 13 with the involvement of and authorization by their school, teacher, parent or legal guardian. A student’s educator or associated educational organization is required have proper permission to register a student for Code.org, and they must have obtained the necessary parental consent for Code.org’s collection of the student’s personal information for the use and benefit of the school and for no other commercial purpose.
What data does it collect?
- Personally identifiable information (PII) is collected.
- The categories of collected personally identifiable information are indicated.
- Collection or use of data is limited to product requirements.
- Geolocation data are not collected.
- Unclear whether this product collects biometric or health data.
- Behavioral data are collected.
- Unclear whether this product collects sensitive data.
- Non-personally identifiable information is collected.
- Opt-in consent is requested from users at the time personal information is collected.
- Personal information of users is collected by a third party.
What data does it share?
- Collected information is shared with third parties.
- The categories of information shared with third parties are indicated.
- The purpose for sharing a user's personal information with third parties is indicated.
- The categories of third parties that receive personal information are indicated.
- Data are shared for analytics.
- Data are shared for research and/or product improvement.
- Data are shared with third-party service providers.
- The roles of third-party service providers are indicated.
- Social or federated login is supported.
- Contractual limits are placed on third-party data use.
How does it secure data?
- A user's identity is verified with additional personal information.
- Account creation is not required.
- Parental controls or managed accounts are available.
- Two-factor account protection is available.
- Third-party contractual security protections are required.
- Industry best practices are used to protect data.
- Employee or physical access to user information is limited.
- All data in transit are encrypted.
- All data at rest are encrypted.
- Notice is provided in the event of a data breach.
What rights do I have to the data?
- Users can create or upload content.
- Users retain ownership of their data.
- Processes to access and review user data are available.
- Processes to modify inaccurate data are available.
- A data-retention policy is available.
- Processes for the school, parents, or students to delete data are available.
- A user's data are deleted upon account cancellation or termination.
- Data are deleted when no longer necessary.
- Permissions, roles, or access controls are available to restrict who has access to data.
- Processes to download user data are available.
Is the data sold?
- Data are not sold or rented to third parties.
- Users can opt out from the disclosure or sale of their data to a third party.
- User information can be transferred to a third party.
- Unclear whether users are notified if their information is transferred to a third party.
- Unclear whether user information can be deleted prior to its transfer to a third party.
- Third-party transfer is contractually required to use the same privacy practices.
- User information is shared in an anonymous or deidentified format.
- The vendor describes their deidentification process of user information.
- Data are shared for research and/or product improvement.
- Contractual limits prohibit third parties from reidentifying deidentified information.
How safe is this product?
- Users can interact with trusted users and/or students.
- Users cannot interact with untrusted users, including strangers and/or adults.
- Profile information is not shared for social interactions.
- Personal information is not displayed publicly.
- Users can control how their data are displayed.
- User-created content is reviewed, screened, or monitored by the vendor.
- User-created content is filtered for personal information before being made publicly visible.
- Social interactions between users are moderated.
- Unclear whether social interactions of users are logged.
- Unclear whether users can report abuse or cyberbullying.
Ads & Tracking
Are there advertisements or tracking?
- Data are not shared for third-party advertising and/or marketing.
- Traditional or contextual advertisements are not displayed.
- Behavioral or targeted advertising is not displayed.
- Data are not collected by third-party advertising or tracking services.
- Data are not used to track and target advertisements on other third-party websites or services.
- Data profiles are not created and used for data enhancement, and/or targeted advertisements.
- The vendor cannot send marketing messages.
- Unclear whether this vendor provides promotional sweepstakes, contests, or surveys.
- Users can opt out of traditional, contextual, or behavioral advertising.
- Users can opt out or unsubscribe from marketing communications.
Can I provide parental consent?
- Intended for children under 13.
- Personal information from children under 13 years of age is collected online.
- Intended for parents or guardians.
- Vendor does have actual knowledge that personal information from users under 13 years of age is collected.
- Children's privacy is applicable.
- Parental consent is required.
- Parental consent is limited with respect to third parties.
- Parents can withdraw consent for the further collection of their child's information.
- Children's personal information is deleted if collected without parental consent.
- Parental consent notice and method for submission are provided.
Is the product intended for school?
- Intended for students.
- Personal information or education records are collected from preK-12 students.
- Intended for teachers.
- Product is primarily used by, designed for, and marketed toward students in grades preK–12.
- Product does create education records.
- Notification of a contract or additional rights is provided.
- Vendor is designated as a school official.
- Parental consent obligations are transferred to the school or district.
- Unclear whether the vendor indicates FERPA parental consent exceptions.
- Unclear whether this product discloses directory information.