College Board Pays $750K in Settlement for Misusing NY Students’ Data

On February 13, 2024, a settlement of $750,000 was reached by New York's Attorney General Letitia James and the Commissioner of the New York State Education Department (NYSED), Betty A. Rosa, with the College Board over breaches of student privacy. 

According to the investigation, the College Board, which was responsible for administering academic assessments such as the PSAT, SAT, and AP (Advanced Placement) exams, was found to have engaged in the unauthorized collection and distribution of student data to various entities, including colleges and scholarship programs, for years. This data, which pertained to more than 237,000 New York students in 2019 alone, was used for solicitation without proper consent, also involving the distribution of promotional materials through College Board accounts related to these exams or AP courses.

Settlement Summary 

The College Board agreed to pay New York State $750,000 for violating students' privacy by improperly licensing their personal information through its Student Search Service. This service allowed colleges and other institutions to solicit students based on this data, which included sensitive information collected during standardized tests like the PSAT, SAT, and AP exams. The settlement also says that the College Board must comply with New York's data privacy laws, ensuring student data is not used for commercial or marketing purposes without proper consent.

The investigation into this matter revealed that the College Board's actions constituted repeated violations of New York's Education Law §2d and Executive Law §63(12), both of which are designed to protect student data from unauthorized commercial use. Despite the College Board's significant revenue from licensing student data, these practices were found to breach contractual and statutory obligations to protect student privacy.

Under the terms of the settlement, the College Board is prohibited from selling or licensing student data for commercial purposes and must implement measures to ensure compliance with New York's strict student data privacy regulations. This includes renegotiating contracts with educational agencies to include data protection standards and paying the State of New York $750,000 in penalties and costs, marking a significant effort to safeguard student privacy rights.

Attorney General Letitia James stated the following: 

Students have more than enough to be stressed about when they take college entrance exams, and shouldn’t have to worry about their personal information being bought and sold [...]. New York law requires organizations like the College Board to protect the data they collect from students when they take their exams in school, not sell it to customers for a profit. I want to thank Commissioner Rosa for her work on this investigation to ensure we hold College Board accountable and protect New York students’ privacy.

This sentiment was echoed by NYSED Commissioner Betty a. Rosa, who stated:

When the organizations we trust to provide meaningful services to our students exploit student information for profit, it violates privacy laws as well as the public trust [...]. We will continue to ensure that every student’s information is appropriately utilized and protected. We are grateful to the Attorney General for her collaboration in protecting the interests of the students and families of New York.

The College Board now has 30 days to pay the penalty from the effective date of the settlement, which is the date of the last signature, namely February 12, 2024, meaning payment is due by March 12, 2024.