Full privacy evaluation | See all
Thumbnail
Updated April 22, 2018

Formative

  • Intended for children under 13.
  • Collection or use of data is limited to product requirements.
  • Personal information is displayed publicly.
  • Users can interact with trusted users and/or students.
  • Notice is provided in the event of a data breach.
  • Parental consent is required.
Indicates that the product meets all our required privacy safeguards, but more research should be completed prior to use.
Use Responsibly
Full evaluation
66
Overall Scoreinfo-bubble

This overall score represents how the service addressed all our evaluation questions. A higher score (up to 100) means the service provides more transparent and comprehensive policies.

Overview

Formative allows teachers to create assignments for students and receive personalized feedback on learning outcomes in real time. The terms of Formative state they provide certain features that may allow users to share information with other Users. For example, a teacher may choose to populate their profile with their name, school, and the grades and subjects that they teach. The terms of Formative state that collect “personally identifiable information” or “personal data” from users such as their full name, email address, or a photograph that can be used to identify a user. Formative's terms state that to protect users' privacy and security, they take reasonable steps to verify a user's identity before granting them account access or making corrections to their information. Lastly, the terms of Formative state that if a user registers for the service and provides Personal Information, they can update their account and information at any time by reviewing, modifying, or deleting their profile information.

Formative can be accessed through its website. The Privacy Policy and Terms of Use accessed for this evaluation can be found on Formative’s website. This evaluation only considers policies that have been made publicly available prior to an individual using the application or service.

Read the Common Sense standard privacy report (SPR)arrow
The standard privacy report (SPR) displays the most important privacy practices from a product’s polices in a single easy-to-read outline. The report displays an alert when a particular privacy practice is risky, unclear, or not evaluated. This alert indicates more time should be focused on these particular details prior to use.
SafetyPromoting responsible use
arrow
Evaluating safety takes into consideration best practices that protect a user's physical and emotional health. A higher score (up to 100) means the service provides more transparent and comprehensive responses related to safety.
50

The terms of Formative state they provide certain features that may allow users to share information with other Users. For example, a teacher may choose to populate their profile with their name, school, and the grades and subjects that they teach. Or teachers may ask questions that are visible to other users of Formative. The terms specify that Formative contains user generated content, and also may contain message boards, personal web pages, forums or other interactive features. However, the terms state Child Users cannot post to public discussion forums and their profile is not shared publicly, and only the Parent and other permitted Teachers can see the User’s profile. Lastly, the terms state that parents and teachers should be aware that a Child User may enter free-form text which could include Personal Information that would be visible to other Users..

PrivacyProtecting collected information
arrow
Evaluating privacy takes into consideration best practices that protect the disclosure of a user's personal information. A higher score (up to 100) means the service provides more transparent and comprehensive responses related to privacy.
66

The terms of Formative state they collect “personally identifiable information” or “personal data” from users such as their full name, email address, or a photograph that can be used to identify a user. In addition, the terms specify they may collect usage information about use of certain features on the service, such as the number of questions students have attempted, the points students have received, and the academic concepts present in the assignments teachers create. Formative's terms also specify that in order to provide a personalized learning and high-quality experience for their users, they may use various technologies that automatically collect certain non-personal information from their browser or device.

The terms state Formative may work with business partners to improve their services or offerings and may disclose automatically collected and other aggregate non-Personal Information to authorized business partners to conduct research on online education or assist in understanding the usage, viewing, and demographic patterns for certain programs, content, services, promotions, and/or functionality. Parents and Teachers should be aware they may withdraw permission for their child or student's data to be used for research purposes at any time by contacting Formative without discrimination of any benefits or ability to use the service.

Formative's terms also state they will never provide behaviorally targeted ads to students and will not rent or sell Personal Information that they collect from users with third parties. Lastly, Formative's terms state they will not share Personal Information or other non-personal technical information with other third-party organizations for their marketing or promotional use without users' consent or except as part of a specific program or feature for which users will have the ability to opt-in.

SecurityProtecting against unauthorized access
arrow
Evaluating security takes into consideration best practices that protect the integrity and confidentiality of a user's data. A higher score (up to 100) means the service provides more transparent and comprehensive responses related to security.
71

Formative's terms state that to protect users' privacy and security, they take reasonable steps to verify a user's identity before granting them account access or making corrections to their information. In addition, Formative's terms specify they use certain physical, managerial, and technical safeguards designed to preserve the integrity and security of users' Personal Information. Formative's terms state that its employees, agents, and contractors must have a legitimate business reason to access Personal Information users provide and that Formative is operated and managed on servers located within the United States.

The terms also specify when users enter sensitive information, they encrypt the transmission of that information using secure socket layer technology (SSL) or similar technologies, but do not disclose whether users' information is also encrypted while at rest. Formative's terms state that if they learn of a data security incident that compromises or appears to compromise users' Personal Information, then they will attempt to notify users electronically so that they can take appropriate protective steps. In addition, Formative may also post a notice on their service if a data security incident occurs.

Lastly, if Formative needs to share users' data with a research partner, the terms state they will use encrypted files before transfer and adhere to strong password and password transfer procedures. The terms state they will use a Secure Shell (SSH) or secure file transfer protocols (SFTP) to share the data. Upon completion of the research project, Formative's terms state all personally identifiable data will be destroyed by the independent researchers within 60 days. Any publications (infographics, reports, research papers, etc.) that result from research will not identify a user or their school in any way. Results will be reported in aggregate, and researchers will follow federal masking guidelines. Formative's terms state their research partners will never disclose any personally identifiable information to anyone outside of the project.

ComplianceFollowing statutory laws and regulations
arrow
Evaluating compliance takes into consideration best practices of companies that collect personal information from children or students and the legal obligations for the privacy and security of that information. A higher score (up to 100) means the service provides more transparent and comprehensive responses related to compliance.
69

The terms of Formative state that if a user registers for the service and provides Personal Information, they can update their account and information at any time by reviewing, modifying, or deleting their profile information. In addition, the terms state a parent can modify or delete Child User accounts or remove Child Users from view of any Teachers. Formative's terms specify they also take measures to restrict any collection or disclosure of Personal Information from children less than 13 years of age. A child can be registered to use the service through his or her school, or through an integration with the service that is supported by the child’s school, or by teachers, tutors and other similar adults who assist in the educational process (“Teachers”) who have taken steps to obtain parental consent.

In addition, the terms specify that if a Child User attempts to register for the services, Formative will request the email address of that Child User’s Parent in order to seek consent from their Parent. Child Users' information is restricted during their registration attempt, except the Parent email address for purposes of seeking consent. Formative's terms state that in compliance with COPPA and FERPA, parents have the ability to control information about their Child User and can refuse future collection or use of their child’s Personal Information, or they can delete their Child User’s account or contact Formative to do so on their behalf.

About Privacy Evaluations

The privacy evaluations have been designed with the help and support of a consortium of schools and districts across the United States. These evaluations are designed to streamline making an informed decision about the potential privacy implications of educational technology used to support teaching and learning.

Our core evaluation criteria are freely available and will remain freely available. People are encouraged to read the questions we use and the information security primer we released. Vendors are encouraged to use our questions and the information security primer to self-evaluate. You can also learn more about our evaluation process.

Please be in touch with any questions or feedback.