Last year, I watched my daughter scan her student ID to board the school bus. She’s in elementary school. Scan in. Scan out. A routine so mundane that no one around us seemed to notice.
But I couldn’t stop thinking: Where is that data about my child going? Why is it being collected? How long is it stored, and who can access it?
That moment crystallized something I’ve been grappling with for over a decade, through my work in data ethics and student privacy, including being certified as a K-12 data privacy trainer by the Future Privacy Forum. We’ve normalized surveillance in education. What would have once sparked debate now happens quietly, packaged as efficiency or safety, and adopted by institutions because “everyone else is doing it.”
In a recent post, I explored the questions we should ask when campuses transition to mobile credentials. Digital IDs that reside in Apple Wallet, rather than our pockets. That discussion focused on one system, but it’s part of a much larger pattern. The quiet expansion of data collection across K–12 and higher education, accompanied by the erosion of privacy, transparency, and shared governance.
The Pattern: Convenience First, Questions Later
Too often, decisions to adopt new tools and systems are made by small groups within institutions. This includes departments such as IT, campus services, and administrators, without meaningful input from faculty, students, or parents. The pitch is always similar: streamline processes, improve safety, increase accountability.
But these systems rarely stop where they start. Each new layer of data collection expands an infrastructure of surveillance that shapes not only how we study and teach, but how we are governed. And we rarely ask what happened to the data, systems, and policies that the new system is replacing.
Elementary school bus scanners. High school ID readers. College mobile credentials. Proctoring software that watches students take exams. Learning management systems that track every click. AI analytics that predict student success, or flag students as “at risk.”
These everyday forms of monitoring raise fundamental questions about what we lose in a world increasingly shaped by surveillance capitalism. Where convenience comes at the cost of control, privacy, and autonomy.
Digital Literacy as Democratic Practice
Throughout my career, from helping to architect the Mozilla Web Literacy Framework to co-writing NCTE’s Definition of Literacy in a Digital Age, I’ve argued that digital literacy is more than technical skills. It’s about agency, ethics, and power.
As I wrote in my work with Mozilla, being digitally literate means understanding not just how to use technology, but how technology uses us. It means asking: Who designs these systems? What data do they collect? Whose interests do they serve?
When we teach students to read, write, and participate on the web, we must also teach them to question the infrastructure beneath their feet. Privacy isn’t a technical issue; it’s a literacy issue. Currently, we’re failing to teach it.
A Decade of Privacy Work—And What’s Changed
Back when I completed the K–12 Student Privacy Train-the-Trainer Program, I assumed we were reaching a turning point, that schools and universities would take privacy seriously as part of digital literacy and democratic practice.
Instead, what we see today is the normalization of surveillance across K–12 and higher education:
- Student information systems that track attendance, grades, behavior, and increasingly, biometric data
- Proctoring tools that record students’ faces, scan their rooms, and monitor their eye movements
- ID scanners at bus stops, cafeterias, and building entrances
- AI analytics platforms that mine student data to predict outcomes and flag interventions
- Learning platforms that sell students’ attention to advertisers or share data with third parties
Faculty are frequently asked to implement these tools before we’ve had time to understand their implications or the risks they introduce. Parents often don’t know these systems exist until they’re already operational. Students rarely have meaningful consent or the option to opt out.
In my Digitally Literate newsletter, I regularly share stories about these expanding systems. Each week brings new examples of data collection creeping further into students’ lives. These are often with the best intentions, but always with unexamined consequences.
The Real Stakes: When Data Collection Becomes Dangerous
Privacy isn’t just about individual preferences or minor policy details. It ‘s about power: who sees, stores, and interprets our data, and who decides how it’s used.
History reminds us that when regimes change, so do the hands holding that data. For our most marginalized students, those already targeted by policing, immigration enforcement, or political repression, the quiet expansion of institutional data collection isn’t neutral. It ‘s dangerous.
Every agreement to “share data” today can become a dragnet tomorrow.
Consider:
- Immigrant students whose attendance records could be subpoenaed by ICE
- LGBTQ+ students whose counseling records or library checkouts could be used against them
- Students of color who are disproportionately flagged by predictive algorithms as “at risk”
- Students with disabilities whose accommodation records become permanent markers in their digital files
When we build surveillance infrastructure “for safety” or “for efficiency,” we must ask: Safe for whom? Efficient for what purpose?
What Educators and Parents Can Do
We don’t need to become privacy lawyers or technologists, but we do need to slow down adoption cycles and insist on due process:
1. Ask Questions Before Implementation
Before new systems are deployed:
- Who requested this technology?
- What specific problem does it solve?
- What data is collected, and why?
- Who has access, and for how long?
- What are the alternatives?
These aren’t obstructionist questions. They serve as the baseline for responsible governance.
2. Insist on Transparency
Policies shouldn’t be hidden from those they affect. If students, parents, or faculty can’t easily review data governance policies, those policies are inadequate.
Request:
- Plain-language privacy policies
- Data impact assessments
- Regular audits of third-party vendors
- Clear procedures for data deletion
3. Link Privacy to Pedagogy
As I’ve argued throughout my work on web literacy and digital citizenship, data ethics must be part of digital literacy. Not just IT compliance.
We need to model for students that questioning digital systems is an essential skill:
- Teach students to read privacy policies critically
- Discuss surveillance capitalism as part of media literacy
- Create opportunities for students to practice informed consent
- Explore the history of surveillance and its impacts on marginalized communities
4. Protect the Vulnerable
If surveillance harms even one group more than others, it’s not equitable. It’s exploitative.
Before adopting any data-intensive system, ask:
- How might this affect immigrant students?
- How might this affect students with disabilities?
- How might this affect LGBTQ+ students?
- How might this affect students already over-policed in their communities?
If the answer is “it could harm them,” the system needs redesign or rejection.
5. Engage Shared Governance
Parents, teachers, faculty, and students should be included at the table when new data systems are being considered, not just informed after contracts are signed.
Push for:
- Faculty and community oversight of data policies
- Student government involvement in technology decisions
- Parent advisory boards for K-12 systems
- Policies for data retention and data deletion days
- Community forums before major implementations
Why This Matters Now
As I wrote in my post on campus mobile credentials, technological convenience shouldn’t bypass democratic decision-making. The shift from physical IDs to digital systems isn’t just an upgrade; it’s a transformation of institutional power.
The same principle applies across all levels of education. Every time we add another layer of data collection, we’re making a choice about what kind of learning environment we want to build.
Do we want learning communities that:
- Trust students or surveil them?
- Protect privacy or normalize monitoring?
- Share power or concentrate it?
- Build community or enforce compliance?
These aren’t abstract questions. They shape students’ daily experiences and their understanding of what it means to be a citizen in a democratic society.
A Call to Action
By thinking critically about the tools we adopt and the data we produce, we demonstrate to students and colleagues alike that digital literacy encompasses more than just skills. It’s about agency, ethics, and accountability.
Privacy is not an obstacle to innovation. It is a prerequisite for trust, creativity, and a sense of community. When institutions prioritize surveillance over care or secrecy over transparency, they erode the very conditions that make education possible.
We can’t wait for perfect guidance or comprehensive policies. We need to start asking questions now. In school board meetings, faculty senate sessions, parent-teacher conferences, and our own classrooms.
The surveillance infrastructure is already being built. The question is whether we’ll have a say in how it’s designed, who it serves, and what values it reflects.
We owe our students, and ourselves, something better than a future where every movement, every question, every moment of learning leaves a permanent data trail in systems we don’t control and can’t contest.
Start asking questions. Demand transparency. Model critical digital literacy. The stakes are too high to stay silent.
This post is part of an ongoing series exploring privacy, surveillance, and digital literacy in education. Read more aboutcampus mobile credentials and faculty data sovereignty. Subscribe to the Digitally Literate newsletter for weekly insights on digital literacy, AI, and educational technology.