School monitoring software: what it can see on a student's device

When we reported in 2016 that schools were monitoring children's internet use, the practice was spreading quickly. Today it is common: many schools issue laptops or tablets, give every student an online account, and use software that filters websites and flags activity for staff to review.

What the software usually covers

Monitoring is tied to what the school manages, which is usually narrower than parents fear and broader than students assume:

• School-issued devices, such as managed Chromebooks or laptops, can be monitored wherever they are used, including at home.
• Activity while signed in to a school account (school email, documents, the school's browser profile) can be logged, often on any device.
• Web filtering blocks categories of sites and keeps a record of what was visited or blocked.
• Some products scan text that students type or store for keywords about self-harm, bullying or violence, and alert a staff member.

A personal phone on mobile data, not signed in to a school account, is generally outside what these tools can see.

The rules that apply

In the United States, FERPA governs access to student education records and COPPA restricts data collection from children under 13. In England, the statutory guidance "Keeping Children Safe in Education" expects schools to have appropriate filtering and monitoring in place. In the EU and UK, data protection law requires schools to explain what they collect, why, and for how long.

Questions parents can ask

• Which devices and accounts are monitored, and is monitoring active outside school hours?
• Who receives alerts, and what happens after one is raised?
• How long are logs and flagged content kept, and who can see them?
• Which company provides the software, and what does it do with the data?
• Can families see what has been recorded about their child?

Schools generally have good reasons to filter and monitor, but they should be able to answer every one of these questions clearly. If they cannot, that is worth raising with the school or its data protection officer.