School devices and what parents do not control

A school-issued iPad or Chromebook is the first internet device many children use at scale. A 2022 Human Rights Watch investigation of 164 EdTech products used in 49 countries found that 89% of the products could put children’s privacy at risk. The data flowed to nearly 200 advertising-technology companies [source: www-hrw-edtech-2022].

This article is about what that means for a parent. The wiki does not give legal advice and does not tell a parent what to demand from a school. It describes what is documented about school-device data flows and what the parent-side control surface looks like.

The single most important sentence in the article is in the Scope section. Read it first if you are short on time.

Definition

A “school device” here means any device the school issues, recommends, or requires the child to use for schoolwork.

The device may be a managed iPad, a Chromebook managed through Google Workspace for Education, a Windows laptop enrolled in Microsoft Intune, or a web-only account that runs in a browser.

The control surface on a school device is partitioned.

The school controls the device-level configuration.

It sets the apps that are installed, the network filters that are active on managed Wi-Fi, the account that the child signs in to, and the data that flows back to the school or its vendors.

The parent controls very little of this.

Where the parent controls anything at all, it is usually the parent-side Apple Account or Google Account the child uses outside school hours, the home Wi-Fi filter, and the conversation about what the child saw on the school device.

The child controls almost nothing at the device level.

They may switch apps, browse within the school filter, and message friends through school-approved tools. They cannot uninstall the management profile or change the account the device is enrolled in.

What the school device does that the parent’s device does not

A managed iPad or Chromebook sends telemetry to the platform vendor (Apple, Google, Microsoft).

This happens regardless of whether the child is signed in to a parent-side Apple ID or Google Account.

The telemetry is governed by the school’s agreement with the vendor, not by the parent’s privacy settings [source: www-hrw-edtech-2022].

The school may install apps the parent has never reviewed. The list is set at the school-district or school-administrator level, not at the parent level.

The school may configure web filtering at the network level on managed Wi-Fi. The filter applies to every device that joins the school’s Wi-Fi, including a parent’s phone.

The school may use a learning platform that records the child’s activity: which apps they opened, for how long, what they typed, and what they submitted. The recording is for the teacher’s use, not the parent’s.

What the parent device does that the school device does not

A parent’s personal device has parent-side controls. The wiki’s what-parental-control-apps-can-do article covers them.

A school device does not pick up these controls.

The parent-side Apple ID or Google Account is not the account the child uses on the school device. The Screen Time or Family Link settings the parent has configured apply to the parent’s account, not to the school’s.

A parent who sets Screen Time on the child’s iPad at home discovers this when the iPad returns from school with a different account signed in. The settings are gone.

Where the two devices meet

The two devices meet at three points: the home Wi-Fi, the child, and the conversation.

The home Wi-Fi is the only network the parent controls.

A parent who runs a DNS-level filter on the home router can filter what the school device sees when it joins the home network.

The filter does not follow the device onto school Wi-Fi [source: bsi-kinder-digital].

The child is the second meeting point.

A child who switches between a school device and a parent device carries habits, contacts and content across both. The wiki’s talking-about-it article covers the conversation layer.

The conversation is the third meeting point.

The parent cannot see what the school device recorded. They can ask.

Scope

What the documented evidence shows

The Human Rights Watch investigation, reported by ABC News in 2022, examined 164 EdTech products used in schools in 49 countries. The investigation found:

• 89% of the 164 products could put children’s privacy at risk.
• Data flowed to nearly 200 ad-tech companies.
• Some products collected data on children identified as immigrants, children with disabilities, or children from minority religious backgrounds [source: www-hrw-edtech-2022].

The investigation did not name individual schools. It named the products.

The UK ICO’s Age-Appropriate Design Code, in force since September 2021, sets 15 standards for online services likely to be accessed by children. The standards include high privacy by default, profiling and geolocation off by default, and transparency about any parental monitoring.

The Code applies to services “likely to be accessed by children”. A school-managed learning platform that knows the child is a child falls in scope [source: ico-code].

EU BIK+ policy names protection, empowerment and participation as the three pillars of a better internet for kids. The EdTech data flow sits inside the protection pillar.

The Digital Markets Act factsheet on interoperability and data portability names mobile ecosystems, including alternative app distribution, as part of the DMA’s scope [source: digitalstrategy-eu-bikplus] [source: digitalmarketsact-eu-dma-factsheet] [source: digitalmarketsact-eu-dma-citizens].

What the parent can ask the school

The wiki does not give legal advice. The wiki lists the questions that other parents have asked, drawn from the practitioner guides cited below.

• Who is the data controller for the school device’s data flows? Under GDPR, the school or the local authority usually is, not the parent and not the platform vendor. The answer determines who the parent asks.
• What is the list of EdTech products installed on the device? The HRW investigation started from a product list. Parents who ask for one usually receive one.
• Is the device or the school account shared with anyone outside the family? A device shared with a sibling or a tutor changes the data flow.
• Does the school run its own filter on the device, and what does the filter log? The school’s filter sees the child’s browsing on the school network. The parent’s filter on the home network does not.
• What happens to the school account when the child leaves the school? Some accounts survive transfer; others are deleted. The school’s policy determines which.

The klicksafe practitioner workshop manual and the BSI “Kinderschutz im Internet” page cover the practitioner side of the parent-school conversation [source: klicksafe-handreichung-elternabende] [source: bsi-kinder-digital].

The wiki’s talking-to-the-school article covers the conversation at the school level.

What the parent cannot do at the device level

A parent cannot:

• See what apps are installed on a managed school device.
• See what web filter the school has configured.
• See the data the school device sends back to the school or to its vendors.
• Uninstall the school’s management profile from the device.
• Change the Apple ID or Google Account the device is enrolled in.
• Disable the school’s telemetry without unenrolling the device, which usually means the school withdraws it.

A parent who tries any of these on a school-issued device is working against the school’s terms of use, not against the parent’s own controls.

What the parent can do at the home level

A parent can:

• Run a DNS-level filter on the home router. The filter applies to every device on the home Wi-Fi, including the school device when it is at home.
• Use the parent-side Apple ID or Google Account for the child’s personal use. The school device uses the school account. The two accounts are separate.
• Set Screen Time or Family Link on the parent’s account, not on the school account.
• Ask the school for the product list, the filter policy, and the data-retention rule.

The wiki’s the-network-layer article covers the home network filter, and the family-sharing-what-a-child-can-change article covers the parent-side account controls.

What this article does not do

It does not name individual schools or districts. The HRW report named products, not schools.

It does not give legal advice. The wiki’s glossary points to the jurisdictional pages; legal advice is a job for a lawyer familiar with the relevant jurisdiction.

It does not tell a parent to remove a child from a school’s device programme. That is a family decision that depends on the alternative the family can provide.

It does not address home-schooling. The school device layer presumes a school that issues devices.

Sources

Each marker resolves to a stub under Wiki/sources/ with the URL, the retrieval date and the licence.

• www-hrw-edtech-2022 — Human Rights Watch, “How Dare They Peep into My Private Life?” — reported via ABC News (2022). The 164-product, 49-country investigation [source: www-hrw-edtech-2022].
• ico-code — Information Commissioner’s Office, “Age appropriate design: a code of practice for online services” (2021). The UK 15-standard code that governs services likely to be accessed by children [source: ico-code].
• euconsent-gdpr-art8 — euconsent.eu, “Digital age of consent under the GDPR”. The member-state breakdown of GDPR Article 8 [source: euconsent-gdpr-art8].
• digitalstrategy-eu-bikplus — European Commission, “European strategy for a Better Internet for Kids, BIK+”. The EU policy pillar that frames EdTech [source: digitalstrategy-eu-bikplus].
• digitalmarketsact-eu-dma-factsheet — European Commission, “How the DMA is making smartphones better: interoperability and data portability case studies” (2026) [source: digitalmarketsact-eu-dma-factsheet].
• digitalmarketsact-eu-dma-citizens — European Commission, “Digital Markets Act: EU citizens Q&A” [source: digitalmarketsact-eu-dma-citizens].
• bsi-kinder-digital — Bundesamt für Sicherheit in der Informationstechnik, “Kinder und Jugendliche im digitalen Alltag absichern” [source: bsi-kinder-digital].
• klicksafe-handreichung-elternabende — klicksafe, “Handreichung Elternabende: Smartphones, Apps, mobiles Internet” [source: klicksafe-handreichung-elternabende].
• doi-core-4cs — Livingstone and Stoilova, “The 4Cs — Classifying online risk to children” (CO:RE Short Report, 2021). The taxonomy that places EdTech data flows in the cross-cutting privacy layer [source: doi-core-4cs].