Student desks in a classroom.
  • The College Board is tracking students and sending information about their activity to advertising platforms at companies such as Facebook and Google.
  • Our researchers found ads on other websites that appeared to use tracking from the College Board website.
  • These practices seem to contradict the College Board’s explicit promises to consumers. The company may be sharing students’ information without consent.
For millions of students, the College Board is the gatekeeper to higher education. And according to a Consumer Reports investigation, the organization uses that role to collect and share information on those students—despite apparent promises to the contrary.
 
The nonprofit company owns and operates the SAT test. It also administers the Advanced Placement exams high school students take to earn college credit and strengthen their applications. And when you create an account on collegeboard.org to register for the SAT, sign up for an AP test, or research colleges and scholarships, the College Board sends details about your activity to at least seven tech companies that profit from advertising.

The list includes Adobe, Facebook, Google, Microsoft, Snapchat, Yahoo, and an advertising network called AdMedia.

The personal information was relayed to these companies in a manner that appears to violate specific privacy promises made by the College Board. In some cases, it also appeared to be linked to ads for products and services beyond the organization’s scope. 

More on Privacy

After we contacted the College Board with our findings, the company made some tweaks to its site, but the underlying problem remains.

“The data sharing we observed would allow for a broad range of profiling,” says Bill Fitzgerald, the privacy researcher who conducted the tests for the Consumer Reports Digital Lab.

Once student data is passed to third parties, he notes, it’s more likely to be used for purposes that don’t reflect a pupil’s best interests.

“The risk starts when the data are shared,” he says.

According to Fitzgerald and other experts on student privacy, there's a whole industry that extracts value from student data. You'll find companies that market tutoring and test prep services, and companies that promote long-odds scholarship contests where personal information is the cost of entry. The data can be used to pitch predatory student loans and credit card offers, and to push students to apply to colleges they have no chance of getting into in a bid to drive down admittance rates and drive up application fees.

Parents we spoke to said they’ve come to expect pervasive data collection on the internet, but they were still surprised to find the College Board exposing their children to the digital ad ecosystem.

“Part of me views this as par for the course, knowing a little bit about how these companies operate,” says Brett Ashton, a parent from San Jose, Calif., whose daughter—an incoming freshman at Atlanta’s Spelman College—spent the past few years navigating the College Board’s services. “I underestimated how much the data operation is core to what the College Board is doing.”

“I don’t think it’s what I signed up for,” Ashton says. “I certainly don’t like the thought that it’s being used to sell stuff to us that may not even be college-related.” 

How the Student Data Was Shared

The College Board’s privacy policy makes explicit claims about sharing user data. The document defines a username as personal information, then goes on to say that “no personally identifiable information is shared” with third parties that perform advertising services, specifically citing Facebook.

But what we observed contradicts that promise. (For the detailed report, click here.)

We created accounts for three imaginary students on the College Board’s website. By monitoring traffic between the site and our students’ browsers, we saw in our initial analysis that when sign up was complete, the College Board sent the username and a unique ID number to Adobe, AdMedia, Facebook, Google, Microsoft, Snapchat, and Yahoo.

“An individual piece of information might not seem like much on its own, but when it’s stored with hundreds of thousands of data points from other sources, it starts to take on a larger meaning,” CR’s Fitzgerald says. “Computers are incredibly efficient at linking all of these unique identifiers and information together. That’s really valuable for building profiles about consumers.”

We used the College Board’s site to look for test centers, start registering for a test, and create a list of schools of interest, and the company informed the tech companies of our activities at every turn. In response to the data from the College Board, our traffic logs showed that each tech company placed a cookie in our students’ web browsers, providing a unique tag that could be used to track other activity across the web.

Web traffic logs show Facebook received IDs, usernames, and details on student activity, and then set a corresponding cookie. (Image edited for privacy.)

In the Student Privacy Pledge, a voluntary agreement between education technology companies, the College Board has also promised not to use student data for behavioral targeted advertising, but our analysis indicates that could be happening, too.

“It speaks to either gross negligence or willful flaunting of their own policies,” says Douglas Levin, founder and president of EdTech Strategies, a consulting firm that focuses on the intersection of education, technology, and public policy.

When we went to other websites that feature advertising, we discovered ads that referenced cookies Google and Yahoo had set on the College Board site, including ads for Grammarly, Zenni Optical, the supermarket chain Grocery Outlet, and Cashay, a financial website with advice for students and others that's owned by Verizon, which also owns Yahoo. (The advertisers either declined to comment or didn’t respond to our questions.)

It’s troubling to think that students' information is being monetized, says Tara Miller, a college counselor at Stephen F. Austin High School in Austin, Texas. “These aren't adults, these are impressionable young people,” she explains. In many cases, a student’s first interaction with the College Board is in ninth grade, at 13 or 14 years old, she adds.

The ad tracking we saw on the College Board’s site isn’t unusual. Most websites, including CR.org, collect user data using similar tools. (You can get the details in our privacy policy.) The difference, Fitzgerald says, is that most websites don’t handle sensitive information about students. And the College Board has a unique responsibility, because many students are forced to use its services if they want to use the site for things such as registering for a test or sharing their scores. If the organization doesn’t adhere to its own privacy policy, students can’t make informed decisions about using the service.

Do you have information on student data misuse? We'd love to hear from you. Contact reporter Thomas Germain at thomas.germain@consumer.org or use this page to submit a news tip.

Broken Promises, Open Questions

We sent a series of questions about our findings to the College Board, but even after a back and forth with the company, not all were addressed.

“Like other not-for-profit organizations, we use certain third-party platforms to share information with students," the company said in an emailed statement. "The data we share with third-party platforms is encrypted and hashed, and is used by those platforms to deliver our messages to our users. We are not paid by any of those platforms.” The company says the data sharing we saw has an impact only on those visitors who have registered for accounts on the website.

In the Student Privacy Pledge, the College Board says it's committed to “not use or disclose student information” for behavioral targeting of advertisements to students. The College Board told us it “strongly supports” the principles of the Student Privacy Pledge. But the company didn’t comment on why its practices seem to contradict those principles, or provide any details about ads that appeared to result from the tracking on its website.

The Future of Privacy Forum, an industry-funded group that organized the Pledge, tells Consumer Reports it's looking into our findings to ensure that the College Board is living up to its promises.

This isn’t the first time the College Board has been called out for privacy issues. In 2018, a year in which the organization generated over a billion dollars in tax-exempt revenue, a New York Times investigation found it was one of several education vendors that sold access to student survey data. In 2019, a Wall Street Journal article reported that the College Board had sold the names of SAT test takers to colleges for 47 cents apiece. The information was allegedly used by some colleges to pursue applications from students who had little or no chance of earning admission.

In this case, however, there’s no evidence to suggest the College Board is selling the data we saw changing hands. The tech companies that corresponded with us confirmed that.

The companies that received data from the College Board all support targeted advertising and analytics, which help a service measure its performance. Adobe, Snapchat, and Google all tell Consumer Reports that’s why we saw student data relayed to them from the College Board. Google’s response was typical: “Third-party cookies have a variety of uses, from enabling basic site functions to serving and measuring advertising,” a spokesperson said.

Facebook declined to comment but shared the terms of service for its Business Tools. A Microsoft spokesperson said the company has “processes in place to ensure that we do not collect, store or use any personally identifiable information or usernames” from the tools used by the College Board, but left most of our questions unanswered.

AdMedia and Verizon—which owns Yahoo—never responded to our questions.

The College Board didn’t answer our questions about its apparent privacy policy violations, but the company did say it will make some technical changes to how usernames are shared.

After we reached out to the College Board, we reran tests on its website. The company had stopped sharing usernames and unique ID numbers with most of the tech companies, but Adobe was still getting that data. And the College Board was still updating all the same companies about user behavior, and allowing them to track students with cookies. Fitzgerald says that response doesn't address the underlying privacy problem.

“The College Board's change is good, but it isn’t substantial, and as long as they’re sharing usernames with anyone, it seems they’re violating their privacy policy,” Fitzgerald says. “And even if they fixed that, they’d still be sharing sensitive information about student activity with third parties.”