The school app that knew too much
A school adds a free learning app. A parent notices ads following her son.
Day 1
Greenfield Public School, a fictional school, adds a free homework app and shares every student's name and class with it.
Day 9
A parent sees ads for coaching classes on her son's phone, aimed at his exact grade. The app had analytics and ad tags running.
Day 10
She asks the school what data the app gets. Nobody knows. The website has no privacy notice and no named contact.
Day 24
With no answer, she files a complaint with the Data Protection Board about children's data used without a parent's consent.
Day 40
The Board asks the school for its consent records and vendor contract. It has neither.
Day 60
The school removes the app, writes to every parent and spends a term rebuilding trust it had for years.
The Data Protection Board can impose a penalty up to the maximum the law sets for a breach like this. It weighs each case; nobody can predict the figure. See the penalty categories
What would have prevented it
- Ask parents for verifiable consent before any app gets a child's data.
- Check that apps used by children do not track them or show them targeted ads.
- Publish a notice and a named contact, so a worried parent gets an answer in days.
Find out where your website stands
A free, read-only scan with plain-language findings you can act on.