Defunct online education company Edmodo LLC collected and retained the private information of some 36 million children without their parents' permission and used it to allow companies to target them with advertisements, according to federal regulators.
The San Mateo company's actions violated federal law, the U.S. Justice Department said in a press release last week and in a lawsuit filed against the company in May in the U.S. District Court for Northern California. Edmodo agreed to pay $6 million to settle the suit and to accept a permanent injunction restricting its ability to collect and retain children's data, according to the press release.
"Children do not lose their privacy protections when they use the internet," U.S. Attorney Ismail J. Ramsey said in the press release.
Susan Kim, who was CEO of Edmodo during part of the period in which it allegedly violated student-users' privacy, did not respond to a request for comment.
Founded in 2008, according to PitchBook Data, Edmodo operated a service that allowed teachers to connect with students online in virtual classrooms, assign schoolwork to them, administer quizzes and provide them their grades. As part of that, Edmodo collected students' names, email addresses, phone numbers, device information and IP addresses, according to the Justice Department. Many of the students who used its service were under the age of 13 and thus covered by federal privacy laws meant to protect children.
The company offered a free version of its service as well as selling paid subscriptions to schools across the nation. Edmodo collected student data submitted through both its free and paid offerings, according to the Justice Department.
In violation of federal laws and regulations, Edmodo didn't notify parents it was collecting such information nor secure their consent, the Justice Department said in the press release. Additionally in violation of federal law, it held on to the data of millions of students long after they stopped using the service, the Justice Department said. In March 2020, Edmodo held the data of 36 million students; at the time, just 1 million were using actively using it, according to the press release.
Edmodo allegedly violated children' privacy laws
From 2018 until it shut down in September, Edmodo used the students' personal information for advertising purposes without their parents' consent or even, in some cases, knowledge, the Justice Department said. The company's actions violated the Children's Online Privacy Protection Act, the Children's Online Privacy Protection Rule and the Federal Trade Commission Act, the agency asserted.
The settlement bars Edmodo from collecting student data in a way that violates COPPA, from collecting more information from students than it needs for them to use its service and from retaining such information longer than "reasonably necessary." In addition to the fine and the injunction, Edmodo's settlement requires it to destroy any "improperly collected" personal data from students younger than 13.
It's unclear how much of an effect the settlement will have. The Justice Department suspended the fine because of Edmodo's "inability to pay," the agency said. Meanwhile, because Edmodo is no longer operating its service, it's ostensibly not collecting additional data nor running any more targeting advertisements.
Still regulators argued that the settlement sends a message to rival education software and service companies.
"Ed tech providers should carefully examine their practices to ensure they're not compromising students' privacy," Samuel Levine, director of the FTC's consumer protection bureau, said in the news release.
Edmodo raised $30 million through 2015 via five rounds of venture funding from investors including Greylock Partners, Union Square Ventures, Benchmark and Learn Capital, according to PitchBook Data. It was acquired by Chinese gaming provider NetDragon Websoft Inc. in 2018 for $137.5 million.
