Definitions for Privacy Evaluation Questions

This guide provides the meaning of key terms used in the privacy evaluation questions in the context of edtech privacy and security.

  • abuse: cruelty, violence, or insulting or offensive behavior directed at individuals or groups
  • actual knowledge: a particular fact a vendor knows or has reason to know -- for example, when a user enters a birth date showing their age
  • alternate dispute resolution (ADR): arbitration, mediation, or another method of resolving a dispute between parties other than filing a lawsuit
  • analytics: computation or use of data or statistics
  • anonymous: indicates that no personally identifying data is associated -- for example, name, address, or other data that could be used to reidentify or deanonymize
  • application: software or a program written for a mobile device or computer that may or may not require login authentication
  • assistive technology: tools designed to assist a user with one or more life functions -- for example, a tool that allows users with visual impairment to access larger fonts or one that allows users with hearing impairment to access read-aloud text
  • audit: a third-party company review of the practices of a vendor
  • authorized individual/user: a user who is permitted by a vendor to use a product, including a student, parent, guardian, or school official
  • behavioral advertising: commercial messages displayed to a user by a vendor or third party based on data collected from that user's online activities
  • behavioral data: information about a user's activities -- for example, how long the user has looked at a webpage or which webpages they have looked at
  • biometric data: health and physical information from human bodies -- for example, fingerprints
  • changelog: a record of changes made to a project, program, or policy
  • class action lawsuit: a legal action brought by one or more individuals on behalf of a larger group of similarly situated individuals
  • collection: as defined here, first-party collection of data or information from a user
  • compliance: legal and/or regulatory rules and standards being followed
  • consent: a user or responsible individual giving written or electronic agreement to an action -- for example, a user allowing collection of their information
  • contextual advertising: commercial messages displayed to a user based on the surrounding content
  • control: legal or physical power over an action
  • cookie: message given to a web browser by a web server to facilitate the storage of information about a user
  • persistent cookie: a cookie that stores information on a user's computer for longer periods, even after a user closes their web browser. This type of cookie remains on a user's hard drive until it reaches its expiration date or is deleted by the user
  • session cookie: a cookie that is stored temporarily on a user's computer and lasts only as long as the web browser is open 
  • COPPA: the Children's Online Privacy Protection Act, a law created to protect the privacy of children under age 13
  • COPPA Safe Harbor Program: a self-regulatory compliance program approved by a regulatory agency
  • copyright license: permission given to use another's content
  • cyberbullying: bullying that takes place over the internet on devices like phones, tablets, and computers. It can happen in social media, texts, or online games, where people can view, participate in, or share content. It typically includes sending, posting, or sharing negative or harmful content about someone else on purpose. It can include sharing private information about someone else to cause embarrassment or humiliation.
  • data: raw unprocessed facts -- for example, that Tim is six feet tall
  • data at rest: information stored or not in transit between software and/or devices  
  • data breach: unauthorized disclosure of information to a third party, voluntarily or involuntarily
  • data controller: principal party for responsibilities such as collecting consent, managing consent-revoking, enabling right to access, securing, etc.
  • data enhancement: adding information to existing data to improve, augment, or correct it
  • data processor: person who processes or analyzes information on behalf of a data controller
  • data-protection officer: person in a privacy and/or security leadership role at a company
  • data-retention policy: a vendor's rules for how long user information is kept in its storage facility before it is deleted permanently
  • data sunset: the phasing out, terminating, or deleting of information
  • data transfer: any change of control of data, including a change of ownership of data
  • de-identification: the processing of data to remove information that can directly or indirectly be used to identify an individual person
  • direct control: legal and physical access -- to, for example, education information collected by a school or third party
  • directory information: school lists of students, faculty, and/or parents that show names and/or addresses. This includes information contained in the education records of a student as defined under FERPA.
  • disclosure practices: a vendor's activities relating to the public display or availability of user information
  • Do Not Track: a policy used to indicate that, upon request of a user's web browser agent, a company should not monitor that user's behavior on websites or should stop monitoring them
  • education record: information directly related to an individual K–12 student and maintained by their educational institution or by a third party acting as a school official on behalf of the educational institution
  • educator: a teacher at an educational institution who uses curriculum to instruct students
  • encryption: the process of encoding data or information to prevent unauthorized or unintended access
  • federated identity: information provided to a vendor from another vendor's sign-in process that is used to authorize a user and provide for the exchange of information about that user among companies
  • federated login: a process that allows user access to a product or application via another vendor's sign-in process
  • FERPA: the Family Educational Rights and Privacy Act of 1974, a federal law that, among other things, protects the privacy of student education records
  • filtered: processed (as of data or information) so that only a subset of the original data or information is included
  • free/reduced lunch status: indicates a government program providing free or subsidized meals for lower-income students that also serves as a proxy for estimating the poverty level of students' families, which then is used to determine school district funding
  • FTC: the Federal Trade Commission, a government agency responsible for regulating commerce and unfair and deceptive trade practices
  • GDPR: the General Data Protection Regulation, effective as of May 2018, which is European laws protecting the privacy and security of personal information
  • geolocation data: information related to the physical location of a user
  • government request: indicates a federal, state, or local agency asking for information
  • home page: the first page a user can view when linking to a company (includes App Store purchase page and landing pages for websites)
  • HTTP: hypertext transfer protocol, the underlying instruction system used by the web to communicate information.
  • HTTPS: a secure version of HTTP (hypertext transfer protocol secure)
  • hyperlink: a connection to another website, usually accessed when clicking on a word that is underlined
  • in-app purchase: the buying of something with real currency while logged into an application
  • indexing: processing data in order to identify it, label it, or make it easier to search
  • information: as defined here, data that has been processed, organized, or otherwise structured
  • intellectual property: generally, creative work produced and owned by an individual or company, covered by copyright, trademark, or patent law
  • interaction: social communication by text or posting, or information being passed from an individual to another individual or a group of individuals
  • internal operations: operations used for the function of a company, not for disclosure or use outside the company
  • IP address: internet protocol address, which identifies a computer or device's location on the internet
  • jurisdiction: location where a legal action may be brought
  • legacy contact: individual to whom an account may be assigned if that account becomes inactive
  • legal request: a request for information from a court or attorney as part of a legal action or in preparation for a legal action
  • logged: recorded electronically
  • login page: a webpage where a user can input authentication information, often a username and password, to access a product
  • machine crawling: programmed, automatic electronic searching for data or information
  • markup length: character length of the HTML markup used to deliver a website or privacy policy
  • material change: a change that affects a user's rights or responsibilities
  • mobile device: standalone or hand-held electronic technology that can connect to a cellular telephone network and/or the internet
  • moderate: to monitor and review information (as of by human or machine) for the purposes of controlling or filtering the content that is available to users
  • monitored: indicates when content or communications channels are reviewed, watched, or listened to
  • non-personally identifiable information: information that cannot be associated with an individual without the association of additional information or analysis
  • notice: communication from a vendor to a user for the purpose of informing the user
  • offline: not connected to the internet
  • opt-in: when the user affirmatively indicates they agree to something before it is allowed to occur
  • opt-out: when the user indicates they do not agree to something to continue to occur
  • parent: parent or legal guardian of a minor child under the age of 18, or 13 with respect to COPPA regulation
  • parental consent: a parent verifiably communicating to a vendor that they agree to a certain action performed by the vendor with respect to the parent's child
  • password: a series of letters, numbers, phrases, or symbols allowing access to an account or other restricted materials
  • persistent identifier: a unique electronic number used to identify a user or device on more than one application or website that allows tracking of an individual across multiple devices or sessions
  • personal information: characteristics that are associated with a unique individual
  • personally identifiable information (PII): characteristics associated with a unique individual that allow someone to identify that individual
  • physical access controls: controls that grant or restrict individual access to facilities -- for example, doors, gates, or pass cards
  • privacy certification: awarded when a vendor follows certain rules or affirms certain privacy practices in its privacy policy to receive approval from a government or privacy standards organization
  • privacy pledge: pledge by which a vendor affirms it will agree to uphold certain privacy industry standards
  • privacy policy: a document a vendor publicly posts explaining its data collection and use and disclosure practices associated with its protection of personal information
  • privacy shield: indicates that a vendor follows a set of privacy principles from an agreement between the United States and the European Union to meet the EU's regulatory standards
  • product: as defined here, an application or service offered by a vendor to the public for use
  • profile: a set of information about a single individual that can be used for identification
  • prohibited activities: actions that are not allowed in relation to a product or contract between vendor and user
  • protective order: a court-issued document that requires that certain information remain secret
  • reidentification: the taking of information that has been made anonymous and analyzing it or adding information so it can be associated with a particular individual
  • safe interaction: communication with trusted users only
  • screen reader: assistive technology used to aid in understanding the textual content of a page
  • school: as defined here, an educational institution offering full or partial instruction from pre-K through 12th grade
  • school district: a regional group of pre-K–12 schools under a central administration or authority
  • school official: an individual with a legitimate educational interest in, and under direct control of, a school (in this context, regarding the use and maintenance of education records)
  • security: as defined here, the practice of keeping personal data and information from discovery, disclosure, or use by unauthorized individuals
  • sensitive information/sensitive personal information: information that contains categories that have been given strong legal protections; categories vary by region
  • service: indicates an offering by a vendor to the public for use through a website that may or may not require login authentication
  • sharing: affirmative allowing of access to information, including its selling, giving, and disclosing
  • shouting index: amount of capital-letter text used to convey information relative to that of non-capitalized text
  • signal-to-noise ratio: the amount of plaintext policy information (signal) relative to the markup length (noise). This can be used as an indication of how much extraneous detail is on a policy page
  • social advertising: commercial activities designed to sell products or services using social media
  • social login: the use of a username and/or password from a social media account to gain access to another product and to share information with that product
  • student: a user enrolled in a level of school from pre-K to 12th grade
  • successor vendor: a new vendor that purchases or acquires a named vendor
  • teacher: a certified individual employed in pre-K–12 education
  • terms of service: a legal document describing both a vendor's and a user's rights and responsibilities
  • terms of use: a legal document describing a vendor's restrictions on a user's interactions with the product or service
  • third party: an entity or person other than the vendor, specifically excluding a user's parent if the user is a minor and/or that user's teacher if the user is a student using a product for school
  • third-party access: the allowing of third parties to access data on their own without it being affirmatively shared
  • third-party affiliate: company associated with a vendor not involved in providing the primary service
  • third-party subsidiary: legal business entity of a vendor not involved in providing the primary service
  • tracking: the practice of observing and recording a user's activities on one or more products
  • traditional advertising: advertising that is not generated by any particular user's data and is not targeted to an individual
  • transit: the transference of data from one electronic device to another
  • tracker: a cookie or other electronic mechanism used to observe and record user activities on one or more websites
  • trusted user: an individual who has provided credentials to use a product on behalf of themselves or another user
  • unauthorized user: an individual without credentials or permission to use a product on behalf of themselves or another user
  • unique device ID: a number/letter/symbol code to point to a particular piece of electronics, often used to track that device and therefore a user
  • URL: uniform resource locator, a location on the internet for a website
  • user: an individual who engages or attempts to engage with a vendor's product
  • user-created content: textual, visual, or audio information originating with an individual user rather than a vendor that may be uploaded or posted using the vendor's product
  • username: a word that identifies an individual user and that may be used for login and identification
  • vendor: a company that offers a product to the public, either for sale or free use
  • verifiable parental consent: a method that is reasonably designed in light of available technology to ensure that the person giving consent is the child's parent
  • waiver: an agreement to forgo a certain right
  • web: connection of human-readable pages of information on the internet