2018 STATE OF EDTECH SECURITY SURVEY Common Sense Privacy Evaluaon Iniave CREDITS Authors: Girard Kelly Jeff Graham Jill Bronfman Steve Garton Suggested citaon: Kelly, G., Graham, J., Bronfman, J. & Garton, S. (2018). 2018 State of Edtech Security Survey, Common Sense Privacy Evaluaon Iniave. San Francisco, CA: Common Sense This work is licensed under a Creave Commons Aribuon 4.0 Internaonal Public License.

2018 STATE OF EDTECH SECURITY SURVEY, COMMON SENSE PRIVACY EVALUATION INITIATIVE commonsense.org/educaon/privacy 2018 STATE OF EDTECH SECURITY SURVEY Common Sense Privacy Evaluaon Iniave

CREATIVE COMMONS ATTRIBUTION 2018 STATE OF EDTECH SECURITY SURVEY, COMMON SENSE PRIVACY EVALUATION INITIATIVE 4.0 INTERNATIONAL PUBLIC LICENSE Common Sense is grateful for the contribuons to this survey from our 2018 privacy intern, Irene Lee, and the generous support and underwring that funded this research survey from the Michael and Susan Dell Foundaon, the Bill and Melinda Gates Foundaon, and the Chan Zuckerberg Initave. TABLE OF CONTENTS

Introducon 1 EdTech Security ...... 2 Privacy vs. Security ...... 2 Focus on Encrypon ...... 2 Background ...... 2 Preliminary Survey in 2016 ...... 2 Encrypon List ...... 3 Updated Survey in 2017 ...... 4

Methodology 4

2018 Results 5 Products Scanned ...... 5 Successful Status Codes ...... 5 Supports Encrypon ...... 5 Requires Encrypon ...... 6 HTTP Strict Transport Security (HSTS) Headers ...... 6

Conclusion 7

Appendix 8 2018 Vendors That Require Encrypon ...... 8

CREATIVE COMMONS ATTRIBUTION 2018 STATE OF EDTECH SECURITY SURVEY, COMMON SENSE PRIVACY EVALUATION INITIATIVE 4.0 INTERNATIONAL PUBLIC LICENSE security (HSTS) headers, which is a web security policy mech- INTRODUCTION anism that helps to protect websites by using only secure HTTPS connecons. The Common Sense Privacy Evaluaon Iniave is a coordi- The release of this 2018 State of EdTech Security Survey nated effort to evaluate educaon technology (edtech) tools, represents a yearly examinaon of security pracces of edu- protect student privacy, and build in privacy and security caon technology-related online services using our security from the start.1 The Common Sense Privacy Evaluaon Inia- assessment. In 2016 Common Sense privacy ran its inial ve helps clarify privacy policies so teachers can make smart encrypon survey to determine a baseline for the state of choices about the learning tools they use with students and edtech security. Then, in 2017, Common Sense privacy ran so schools and districts can parcipate in evaluang the tech- the encrypon survey again and released our findings, which nology used in K–12 classrooms. Common Sense privacy has showed posive but non-significant trends in the edtech in- been collecng and incorporang feedback from stakehold- dustry with increasing encrypon since 2016, but with clear ers about how to share the results of our privacy evaluaons room for improvement. This 2018 security survey includes since we began this work in 2015. Since that me, Common results from over 2,000 URLs of popular edtech online ser- Sense privacy has spoken with numerous teachers, students, vices. To determine this sample set, we interviewed various parents, developers, vendors, privacy advocates, and indus- teachers, schools, and districts about which services they try representaves about their perspecves on privacy and had used during the 12 months prior to the security survey. security. This research led to the design of a 180-queson This is an increase in products scanned from 1,121 edtech evaluaon framework designed to analyze privacy policies products in 2017 and 1,100 edtech products in 2016. These and create a profile of each edtech product’s privacy and se- services provide a representave sample of the wide range of curity pracces. educaonal technologies, including educaonal games and In May 2018, Common Sense privacy released its ground- tools, for communicaon, collaboraon, formave assess- breaking 2018 State of EdTech Privacy Report.2 The report rep- ment, student feedback, content creaon, and delivery of resents the culminaon of Common Sense privacy’s research instruconal content. These types of services are currently over the previous three years, including the evaluaon of used by millions of children at home and by tens of millions hundreds of educaon technology-related applicaons and of students in classrooms across the United States. services. In this report, Common Sense privacy went beyond Our overall findings in 2018 indicate a significant increase in evaluang individual edtech products and captured a snap- the percentage of services that both support and require en- shot of the edtech industry as a whole. Common Sense pri- crypon. In addion, our findings indicate that there was a vacy’s overall findings in the privacy report are illustrave of modest decrease in the percentage of services that support current trends in the edtech industry including a widespread encrypon, but do not require encrypon. However, there lack of transparency and inconsistent privacy and security was no significant change in the percentage of services that pracces. implement HSTS. These findings illustrate that the edtech in- dustry has made significant improvement in its use of encryp- Good security, however, is not stac. Edtech industry secu- on of personal informaon over the past three years, but, rity pracces may be – indeed, should be – updated in re- given that 22 percent of edtech products sll do not require sponse to current events and improvements in technology. encrypon, the industry has a long way to go to improve its Aer the release of the privacy report, Common Sense pri- security pracces. vacy immediately began to update its security findings. In or- der to have a solid foundaon for privacy, edtech providers Security pracces of edtech providers should have a higher must also have adequate security pracces. Therefore, in ad- standard than the industry standard for online services and dion to evaluang privacy policies, Common Sense privacy applicaons generally given the potenally sensive nature ulized a comprehensive security assessment to determine of personal informaon that may be gathered from children whether the evaluated edtech products supported encryp- and students. These crucial observaons are whether an on with the return of successful status codes. Edtech prod- edtech service: 1). supports encrypon; 2). requires encryp- ucts that responded successfully were surveyed to deter- on; 3). supports encrypon and requires encrypon; and 4). mine whether they also required encrypon with hypertext supports encrypon and uses HSTS direcves in its headers. transfer protocol (HTTP) to HTTP secure (HTTPS) redirec- Given the size of the sample and the tools used to evaluate on and whether they implemented HTTP strict transport the edtech products, our key findings in the security survey hold a mirror up to the security pracces of the edtech in- 1 Common Sense Media. “Privacy Evaluaon Iniave,” https://www. dustry as a whole. commonsense.org/education/privacy. 2Kelly, Girard, Jeff Graham, and Bill Fitzgerald. 2018 State of Edtech Privacy, https://www.commonsense.org/blog/2018-state-of-EdTech- privacy-report.

CREATIVE COMMONS ATTRIBUTION 2018 STATE OF EDTECH SECURITY SURVEY, COMMON SENSE PRIVACY EVALUATION INITIATIVE 1 4.0 INTERNATIONAL PUBLIC LICENSE Our 2018 security survey key findings indicate: panded beyond the right to be le alone to the right to con- trol your personal informaon. Further, this expanded mean- 1. A significant increase from 2017 of 16 percent in the ing of privacy has taken on new prominence in the digital percentage of services that support encrypon. world. Privacy includes the ability to control your informa- 2. A significant increase from 2017 of 22 percent in the on, who has access to it, and what it is used for – including percentage of services that require encrypon. what decisions are made because of it. To effectuate privacy, security needs to expand in scope as well, to take on the re- 3. A modest decrease from 2017 of 6 percent in the per- sponsibility of protecng these individual decisions. Security centage of services that support encrypon, but do not involves the protecon of a user’s control of their personal require encrypon. informaon, as well as protecon of a vendor’s systems and 4. No significant change from 2017 in the percentage of products from outside influences. services ( 14 percent) that support encrypon and im- plement HSTS. Focus on Encrypon This survey would not have been possible without support from the Privacy Evaluaon Iniave Consorum, which in- Using encrypon to protect data in transit is widely recog- cludes over 150 schools and districts that help inform Com- nized as a best pracce and even, in some cases, a legal re- mon Sense privacy’s work and use the privacy evaluaons quirement to sasfy a “reasonable” standard of security. To and security informaon as part of their veng process for illustrate this preference, Google priorizes encrypted sites educaonal applicaons and services used in the classroom.3 in its search results, and the browsers Chrome and Firefox The latest findings in the security survey were prepared by show warnings if unencrypted content is shown on a web- the Privacy Evaluaon Iniave team members, which in- page. The lack of encrypon on a site means that informaon clude Girard Kelly, Jeff Graham, Jill Bronfman, and Steve Gar- flowing to and from the user to the site host could poten- ton, all of whom are leaders and experts in the fields of pri- ally be read in plain text along the way – a parcular danger vacy and security, and our 2018 privacy intern, Irene Lee. on unsecured wireless networks – or intercepted en route Our Common Sense privacy team has diverse backgrounds and replaced with other, perhaps dangerous or misleading, in educaon, entrepreneurship, computer science, ethics, content. Even so, Common Sense privacy only applied its law, academia, and public policy. Common Sense privacy be- red “Not Recommended” privacy evaluaon er to sites that lieves that advocacy, parental choice, and school-based de- do not encrypt registraon, login, or pages accessed while a cision making will be more effecve if users are provided user is logged in – an extremely low bar.4 Fortunately, most with comprehensive and up-to-date informaon on the state edtech providers did meet this low bar. Findings from the of security for edtech applicaons and services. Common privacy report indicate that a majority of applicaons and Sense privacy hopes this data will help show the impact that services, approximately 92 percent, use HTTPS encrypon security pracces have on the lives of millions of children of informaon for login and account creaon. and students who use educaonal technology every day and help support meaningful and posive changes in those prac- ces. The following secons will discuss background on the security survey performed in 2016 and 2017, our method- Background ologies, results, categorical concerns, and key findings regard- ing the security pracces used by over 2,000 popular edtech applicaons and services. Preliminary Survey in 2016

In the fall of 2016, Common Sense privacy conducted a sur- vey of 1,221 edtech products used in schools or by young EdTech Security people.5 Common Sense privacy tested only login URL lo- caons because that is where personal or sensive informa- Privacy vs. Security on is collected. The inclusive goal of the encrypon sur- vey was to allow people to be able to run these tests them- selves without any addional technical training. School dis- Privacy and security are intertwined, and security is the trict staff, parents, students, people in STEM classes, people foundaon of effecve individual privacy. For example, en- crypon of messages supports the privacy of communica- 4Common Sense Media. “Evaluaon Tiers,” https://www.commonsense. ons contained therein. The understanding of privacy has ex- org/education/privacy/about/evaluation-tiers. 5Common Sense Media. “Encrypon Support - an Inial Survey,” 3Common Sense Media. “School Districts Inform Our Work,” https:// 1 Dec. 2016, https://www.commonsense.org/education/privacy/blog/ www.commonsense.org/education/privacy/about/districts. encryption-support-initial-survey.

2 2018 STATE OF EDTECH SECURITY SURVEY, COMMON SENSE PRIVACY EVALUATION INITIATIVE commonsense.org/educaon/privacy learning how to code, and vendors all can have visibility into quire encrypon on login – that is, they enforce secure inter- this evaluaon process. This test is not complicated, and if acons between the browsers used by students and teach- a developer is launching a new edtech service, this type of ers and their websites upon exchange of user credenals tesng is a crical part of product development. Common such as usernames and passwords.12 Sites that are secure Sense privacy goes into more detail about addional security have an “https://” in the URL and are visually indicated with tesng in the Informaon Security Primer, but this basic en- a green lock next to it in most browsers on such pages. This crypon test script is an easy starng point.6 To make Com- level of security is a best pracce that should be standard mon Sense privacy’s work both more transparent and more in the industry. The standard means no one can read some- accessible, Common Sense privacy has been able to release one’s personal informaon, even on an open wireless net- this encrypon test publicly under an open-source license.7 work, and even contributes to something as basic as search The repository contains documentaon that describes how engine rankings. It is important to understand that this list to scan individual URLs of edtech products and how to batch- only covers applicaons with logins over the web. It does scan hundreds or even thousands of URLs.8 9 For vendors, not cover mobile applicaons yet. However, including mo- Common Sense privacy strongly recommends using this en- bile applicaons in our encrypon survey and on our list of crypon test to check the login URLs of all your products secure edtech products is on Common Sense privacy’s road as part of your security pracces. A school or district could map for the future. use this encrypon survey as part of a quick triage when it As part of publishing this list of vendors and websites, Com- is evaluang whether to incorporate new technology in the mon Sense privacy notes that it is important to clarify what classroom. Common Sense privacy has incorporated these this list means and what it does not mean. There are many checks as part of the evaluaon process and intends to con- good reasons a vendor might not be on this list, including: nue to expand automated checks of more edtech products in the future. 1. The vendor only offers a private login for subscribers; 2. The vendor’s service does not require a login; In addion, on some sites, different “user-agent-strings” are 3. The vendor’s login varies based on client, so every cus- treated differently.10 User-agent (UA) strings are contained tomer has a different subdomain; or in HTTP headers and are intended to idenfy devices re- 4. Common Sense privacy has not yet tested the specific quesng online content. In praccal terms, this allows sites vendor at this me. to use encrypon with some browser agents and not use it with others. When Common Sense privacy moves forward to Therefore, just because a vendor is not listed does not mean scanning connected devices and the Internet of Things (IoT), the vendor failed our encrypon survey. Common Sense pri- it will be important to note that this is one reason the secu- vacy’s list is representave but not all-inclusive, and it is grow- rity of connected devices lags behind that of many other ser- ing all the me. Common Sense privacy will connue to run vices: Some sites explicitly allow connected devices to send this survey yearly and update the list in the Appendix ac- informaon through unencrypted connecons while other cordingly. The list of sites surveyed comes from the districts devices support encrypon.11 The future of security may de- supporng the Privacy Iniave, and the sites are among the pend on how well we can secure these incredibly proliferat- most popular services used in classrooms and for homework ing connected devices going forward. by K–12 students.

When Common Sense privacy ran the first survey in Octo- ber 2016, there were many long conversaons about how Encrypon List to share the results.13 In these conversaons, publishing a list of sites that did not support encrypon on login was As a result of our research, Common Sense privacy has pub- not widely supported. The intenon was to increase trans- lished a list of vendors and websites that both support and re- parency rather than cricize or rate companies. Common Sense privacy does this work to provide resources so we 6 Common Sense Media. Informaon Security Primer for Evaluang can all do a beer job creang and using technology to sup- Educaonal Soware, https://www.commonsense.org/education/privacy/ 14 security-primer. port inquiry. Common Sense privacy has spent a significant 7Common Sense Media. “README.md,” https://github.com/ amount of me talking with vendors, teachers, district staff, commonsense-org/scanner. 8Common Sense Media. “check.md,” https://github.com/commonsense- 12Common Sense Media. List of Sites with Encrypted Logins, https:// org/scanner/blob/master/examples/check.md. www.commonsense.org/education/privacy/sites-with-encrypted-logins. 9Tange, Ole. “GNU Parallel: The Command-Line Power Tool.” ;login: The 13Common Sense Media. “Surveying Encrypon Pracces of Technology Usenix Magazine, vol. 36, num. 1, Feb. 2011, pp. 42-47. Used Within Schools,” https://www.commonsense.org/education/privacy/ 10Piejko, Pawel. “List of User Agent strings.” DeviceAtlas, 7 March 2018, survey/encryption. https://deviceatlas.com/blog/list-of-user-agent-strings. 14Common Sense Media. “Informaon Security Primer for Evaluang 11Common Sense Media. “allow seng User-Agent #1,” https://github. Educaonal Soware,” https://www.commonsense.org/education/privacy/ com/commonsense-org/scanner/issues/1. security-primer.

CREATIVE COMMONS ATTRIBUTION 2018 STATE OF EDTECH SECURITY SURVEY, COMMON SENSE PRIVACY EVALUATION INITIATIVE 3 4.0 INTERNATIONAL PUBLIC LICENSE parents, and students, and the overwhelming majority of in- ogy industry. To that end, this security survey is intended to dustry professionals strives to meet security standards and increase transparency and access to informaon for vendors provide secure products. With the Privacy Evaluaon Inia- and for their customers. Across the industry, Common Sense ve, Common Sense privacy looks to honor and respect that privacy’s work on transparency of encrypon pracces has intent. In 2016 and 2017, over 600 edtech websites were sought to unite all the stakeholders in seeking beer security listed as meeng basic encrypon standards, while over 500 for informaon collected from children and students. either did not require or enforce encrypon. In this inial year of research and evaluaon of results, the hope was that the number of websites that support encrypon, as a pro- poron of edtech sites and vendors we survey, would sub- METHODOLOGY stanally increase in the coming years. In 2018 we now have over 1,000 edtech websites currently listed in the Appendix The encrypon survey methodology used by Common Sense as meeng basic encrypon standards. Going forward, we privacy has not changed between the inial 2016 survey, the expect that this process of encouragement rather than crit- updated survey in 2017, and our current 2018 survey. Our icism will support transparency and yet another increase in methodology has connued to cover the same security met- the number of compliant vendors. rics, including what was incorporated in as well as outside the scope of this survey. As Common Sense privacy described in the first iteraon of the survey, encrypon is a basic require- Updated Survey in 2017 ment for edtech products that collect usernames, passwords, and other personally idenfiable informaon. Using encryp- on to protect data in transit is widely recognized as a best In early March of 2017, Common Sense privacy ran its en- pracce and, in some cases, has been designated as a com- crypon tests on 1,215 logins used by 1,121 unique edtech ponent of a “reasonable” standard of security. products used in schools and by youth. This was a follow-up survey from research we began in October 2016.15 These This survey performed four acons at each URL locaon: new results indicated that there had been measured improve- 1. Sent an HTTP request to the login URL and checked ment between October 2016 and March 2017. In October the HTTP status code (i.e., asked whether HTTP was 2016, 52 percent of the 1,221 login URLs we surveyed re- supported); quired encrypon, 25 percent did not support encrypon at all, and an addional 20 percent did not require encrypon. 2. Sent an HTTPS request to the login URL and checked As of March 2017, 56 percent required encrypon, 23 per- the HTTP status code (i.e., asked whether HTTPS was cent did not support encrypon at all, and 18 percent sup- supported); ported, but did not require, encrypon. The results indicated a modest increase of 4 percent in the number of sites that re- 3. Sent an HTTP request to access the login URL to quired encrypon at login and a small decrease of 2 percent see whether the site redirected to HTTPS (i.e., asked in the number of sites that failed to fully support encrypon. whether HTTPS was required); and This was progress, even if 44 percent of edtech websites sur- 4. Inspected the URL header for the presence of HTTP veyed in 2017 sll did not require encrypon. Strict Transport Security (HSTS) direcves.

As Common Sense privacy observed in its 2017 survey, since The results of the survey are an indicator – not an abso- 2016 there was sll a lack of support for encrypon from lute measure – of how edtech services encrypt informaon some of the vendors, and these gaps in encrypon prac- passed during login. They provide an accurate representaon ce were found in vendors of all sizes. Results indicated that of trends across the products surveyed, but an authoritave encrypon was absent in some products across the board, statement about any specific product would require a more including products offered by small firms, early and middle- detailed evaluaon assessment.16 stage start-ups, midsize privately held companies, and enter- prise vendors operang in thousands of districts with millions In evaluang the survey results, we categorized each edtech of learners. From the onset, Common Sense privacy intended product according to whether it met the following criteria: to connue to conduct this survey on a regular basis and doc- • Supports encrypon; ument the trends observable in the results. Connuing and • Supports encrypon and requires encrypon; prospecvely increased support for encrypon is one proxy • Supports encrypon and uses HSTS direcves in its for safe and secure pracces across the educaonal technol- headers; or

15Common Sense Media. “Encrypon Support - an Inial Survey,” 16Common Sense Media. “Surveying Encrypon Pracces of Technology 1 Dec. 2016, https://www.commonsense.org/education/privacy/blog/ Used Within Schools,” https://www.commonsense.org/education/privacy/ encryption-support-initial-survey. survey/encryption.

4 2018 STATE OF EDTECH SECURITY SURVEY, COMMON SENSE PRIVACY EVALUATION INITIATIVE commonsense.org/educaon/privacy • Does not use encrypon at all. previous years, we treat response codes in the range of 200- 399 as successful server responses.17 All other responses are considered non-successful. A response code of 0 likely indicates an issue with the server configuraon or lack of 2018 RESULTS support for HTTPS. Errors in the range of 400 or above indi- cate some form of error either in the request or in the server response. Approximately 89 percent of the 1,428 login URLs The results from our 2018 encrypon survey examined returned a successful status code in response to an HTTPS over 2,000 unique edtech products to determine whether request. The following chart illustrates HTTP and HTTPS sta- they support encrypon with the return of successful status tus responses codes: codes. This is an increase in products scanned from 1,215 edtech products in 2017, and 1,221 edtech products in HTTPS Status Codes 2016. Edtech products that respond successfully were sur- 100% veyed to determine whether they also required encrypon with HTTP to HTTPS redirecon and whether they imple- 75% mented HTTP strict transport security (HSTS) headers. The

following results summarize our 2018 findings of edtech 50% products scanned that returned a successful status code;

support encrypon; require encrypon; support encrypon, Percentage 25% but do not require encrypon; support encrypon and use HSTS direcves in their headers; do not use encrypon at 0% all; and need further review. 2016 2017 2018 Year

0 200 3xx 4xx 5xx Products Scanned Figure 1: This chart illustrates the comparison of HTTPS re- sponse codes across all three years. The 2018 encrypon survey scanned 1,428 edtech products that observaonally displayed a registraon or login URL; these URLs are used by visitors to provide personal infor- Table 1: This table illustrates the percentage of HTTPS status maon to log into and use the service. Among the 1,428 codes returned from a HTTPS request. scanned login URLs 18 percent include login pop-ups which are visually disnguished from login URLs because the collec- Year 0 200 3xx 4xx 5xx on of personal informaon may occur on any URL through 2016 0.20 0.71 0.07 0.01 0 a separate visual element that is layered (or that pops up) 2017 0.18 0.75 0.06 0.01 0 on top of the main webpage. Login pop-ups do not clearly 2018 0.09 0.88 0.01 0.01 0 display a separate login URL, but sll provide the opportu- nity for a visitor to provide personal informaon to the ser- vice. For the purposes of this survey, the encrypon results of the base or homepage URL is used as a proxy for any corresponding login URL if the site displays a login pop up. Supports Encrypon Lastly, among the 1,428 URLs scanned approximately 2 per- cent responded successfully to HTTPS requests but not to Similar to previous years we use the classificaons of: does HTTP requests. This means for a small subset of products the not support encrypon; supports, but does not require en- “HTTP redirects to HTTPS” response is largely irrelevant, as crypon; requires encrypon; and needs review. The 2018 the infrastructure is configured to not respond to any HTTP survey found that approximately 90 percent of the 1,428 lo- requests. gin URLs scanned supported encrypon. However, only ap- proximately 9 percent of login URLs scanned sll did not sup- port encrypon, and a small amount of responses, approxi- mately 1 percent, fell into our “needs review”” classificaon. Successful Status Codes In 2016, approximately 25 percent of login URLs scanned did not support encrypon, while approximately 23 percent A successful HTTPS response from a web request can in- of login URLs scanned in 2017 did not support encrypon.

dicate several factors about the configuraon of the server 17Wikipedia. “List of HTTP status codes,” https://en.wikipedia.org/wiki/ that include the server’s support for encrypon. Similar to List_of_HTTP_status_codes.

CREATIVE COMMONS ATTRIBUTION 2018 STATE OF EDTECH SECURITY SURVEY, COMMON SENSE PRIVACY EVALUATION INITIATIVE 5 4.0 INTERNATIONAL PUBLIC LICENSE The 2018 results demonstrate a significant improvement 2016 study, where the results indicated that approximately compared to previous years and indicate a decreasing trend 20 percent of the login URLs surveyed supported encryp- in the percentage of edtech products that do not support en- on, but did not require it. In addion, this finding is also a crypon on login. These findings would appear to suggest an modest decrease from the 2017 study, which reported that increased awareness of encrypon on the part of the edtech 18 percent of login URLs supported, but did not require en- vendors who understand the importance of encrypng per- crypon. sonal informaon on login and a realizaon that customers have come to expect educaonal sites that collect any per- sonal informaon should use encrypon. HTTP Strict Transport Secu- Level of HTTPS support rity (HSTS) Headers 100%

75% The 2018 survey found that only approximately 13 per- cent of the 1,428 login URLs implemented HSTS headers. 50% This means the remaining 87 percent did not implement HSTS headers which indicated that those that did implement Percentage 25% HTTPS encrypon were sll potenally exposing users to a 0% man-in-the-middle (MITM) aack.18 In 2016, only approxi- 2016 2017 2018 mately 14 percent of login URLs surveyed used HSTS direc- Year ves. Likewise, in 2017, only 14 percent of login URLs sur- veyed used HSTS direcves. This consistently low percent- Does not support Supports, but does not require age of HSTS deployments most likely demonstrates a lack of Requires Needs review resources and understanding of the importance of HSTS in the educaonal seng. These percentages can be expected Figure 2: This chart illustrates the comparison of HTTPS sup- to increase if the expectaon of adequate security pracces port across all three years. for the edtech community extends beyond use of a basic HTTPS protocol moving forward. Table 2: This table illustrates the percentage of login URLs that require encrypon, support but does not require encryp- Table 3: This table illustrates the percentage of login URLs on, does not support encrypon and that need further re- that implement HTTP Strict Transport Security (HSTS) head- view across all three years. ers across all three years.

2016 2017 2018 Year HSTS Does not support 0.25 0.23 0.09 2016 0.14 Requires 0.52 0.56 0.78 2017 0.14 Supports, but does not require 0.20 0.18 0.12 2018 0.13 Needs review 0.03 0.03 0.01

Requires Encrypon

The 2018 survey found that approximately 78 percent of lo- gin URLs required encrypon. In contrast, only 56 percent of login URLs in 2017 and 52 percent of login URLs in 2016 required encrypon by redirecng HTTP requests to HTTPS. The 2018 results are a significant improvement compared to previous years and an indicaon of an increasing trend in the percentage of edtech products that require encrypon on login.

Addionally, in 2018 the survey found that approximately 12 percent of login URLs supported encrypon, but did not re- 18Open Web Applicaon Security Project. “Man-in-the-middle aack,”” quire it. This finding is similar to the results obtained in the https://www.owasp.org/index.php/Man-in-the-middle_attack.

6 2018 STATE OF EDTECH SECURITY SURVEY, COMMON SENSE PRIVACY EVALUATION INITIATIVE commonsense.org/educaon/privacy support edtech vendors in implemenng encrypon, such CONCLUSION as the Open Web Applicaon Security Project’s Guide to Cryptography. Further, Common Sense privacy encourages Between October 2016 and March 2017, Common Sense readers of this survey to conduct addional research and privacy observed a non-significant increase in the percent- examine how sites they use support encrypon. Change can age of edtech products with support for encrypon. The be difficult, but acknowledging the discrepancies between 2018 results indicate marked improvement in the percentage best pracces in security and reality is important, and the of support for encrypon over our previous surveys. How- transion to using encrypon to protect educaonal data is ever, edtech vendors sll fail to deploy HTTPS sengs in essenal and long overdue in 2018. Common Sense privacy configuraons that maximize the efficacy of the security pro- believes industry awareness and consumer expectaon tecons in place. It is our hope that more vendors will redi- will drive beer security pracces that include support for rect all HTTP requests to HTTPS as well as properly imple- encrypon as technology plays an ever increasing role in ment HSTS headers to ensure adequate protecon of per- the educaon community moving forward. sonal informaon. As discussed in the 2016 survey, encryp- on is a foundaonal step that sites must take to support basic security and privacy. If a site does not support encryp- on, many schools and districts will not even consider using it. Common Sense privacy strongly encourages stakeholders to evaluate how sites support encrypon and raise aware- ness about the importance of encrypon of personal and sensive informaon with vendors, developers, or other in- terested pares. In addion to the resources provided in this security survey, Common Sense privacy encourages these stakeholders to use Common Sense privacy’s freely available toolkit.19

The need for strong encrypon to protect informaon passed to a site is broadly accepted.20 Both Firefox and Chrome already integrate stronger warnings into their browsers when sites do not support encrypon, and the use of strong encrypon of data in transit is widely recognized as part of what constutes “reasonable security.” Before receiv- ing the results of our 2018 survey, Common Sense privacy ancipated that less than 5 percent of all websites would fail to require encrypon due to various factors. Instead our results indicated that approximately 22 percent of websites failed to require encrypon.

Common Sense privacy remains commied to highlighng beer pracces to improve the state of security in the edtech industry. Publicly available resources, such as our 2017 list of websites that require encrypon and our current list from 2018, which is available in the Appendix of websites that require encrypon as defined in this survey, are helpful to the extent that they allow consumers to make informed decisions about whether or not to use a product given its support for encrypon at the me of the survey.21 In addion, there are other resources freely available to

19Common Sense Media. “Freely Available Tools to Check for Encryp- on” Feb. 2017, https://www.commonsense.org/education/privacy/blog/ freely-available-tools-to-check-for-encryption. 20Schneier, Bruce, “Why We Encrypt.” Schneier on Security, https://www. schneier.com/blog/archives/2015/06/why_we_encrypt.html. 21Common Sense Media. “Announcing the List of Sites That Require Encrypted Login,” April 2017, https://www.commonsense.org/education/ privacy/blog/list-of-sites-that-require-encrypted-login.

CREATIVE COMMONS ATTRIBUTION 2018 STATE OF EDTECH SECURITY SURVEY, COMMON SENSE PRIVACY EVALUATION INITIATIVE 7 4.0 INTERNATIONAL PUBLIC LICENSE APPENDIX

2018 Vendors That Require Encrypon

Note that URLs with character lengths greater than 80 were truncated for display purposes.

Vendor URL 9GAG hps://9gag.com/login 5-Star Students hps://app.5starstudents.com/ 8 Notes hps://www.8notes.com/members/login.asp Absolute Safe Schools Program hps://cc.absolute.com/ 360 Cies hps://www.360cies.net/account/login A mighty girl hps://www.amightygirl.com/customer/account/login/ ABC Mouse hps://www.abcmouse.com/login ABC hps://mylogin.abc.net.au/index.html?screen=login-kids Achieve the Core hp://achievethecore.org/ Accelify hps://www.accelify.com/clientlogin/ 123d Circuits hps://circuits.io/users/0 Acvely Learn hps://read.acvelylearn.com/account.html#/ Absolute Safe Schools Program hps://absolute.allbound.com/ Achieve3000 Literacy Soluons hps://portal.achieve3000.com/index ABC hps://mylogin.abc.net.au/index.html?screen=login 3D Slash hps://www.3dslash.net/user_logon.php ABA English hps://campus.abaenglish.com/en/login ACS hps://pubs.acs.org/acon/showLogin?uri=%2F Acmator hps://www.acmator.com/signin Agents of Discovery hps://mm.agentsofdiscovery.com/Account/SignIn?ReturnUrl=%2F Ablenec hps://www.ablenenc.com/customer/account/login/referer/aHR0cHM6Ly93d3cuYWJsZW AgentPiggy hps://www.agentpiggy.com/ AIMSweb hps://app.aimswebplus.com/#/login Akdemia hps://edge.akdemia.com/login ACMI hps://www.acmiart.org/index.php/login Akindi hps://akindi.com/account/login Aleks hps://www.aleks.com/login Alchemy SmartBinder hps://app.alchemylearning.com/users/sign_in Algorithmia hps://algorithmia.com/ Alpine Achievement hps://www.alpineachievement.com/ Amplify hps://www.mclasshome.com/mobilelogin/educator_login?login_type=tradional Alumni Toolkit hps://schools.alumnitoolkit.org/user/login Allovue hps://allovue.com/login Allclasses hps://allclasses.com/Online/ Animal Jam hps://www.animaljam.com/welcome Animal Jam - Play Wild! hps://www.animaljam.com/home Amgen Assist360 hps://www.amgenassistonline.com/ Aeries hps://www.aeries.com/Training-Support/Account/Login amebatv hp://www.amebatv.com amaZEN U hp://www.amazenu.com/ Apex Learning hps://www.apexvs.com/ApexUI/default.aspx

8 2018 STATE OF EDTECH SECURITY SURVEY, COMMON SENSE PRIVACY EVALUATION INITIATIVE commonsense.org/educaon/privacy (connued) Vendor URL Animoto hps://animoto.com/log_in AoPS hp://www.artofproblemsolving.com arcademics hps://plus.arcademics.com/login Ardusat hps://staging-ehub.ardusat.com/users/sign_in artsonia hps://www.artsonia.com/parents/members/login.asp arorkidshub hps://www.arorkidshub.com/login/ artsonia hps://www.artsonia.com/teachers/members/login.asp arcadetown hp://www.arcadetown.com Ask.fm hps://ask.fm/login ASCD hps://auth.ascd.org/login.aspx Apprentus hps://www.apprentus.com/en/login Assistments hps://www.assistments.org/account/login AT&T hps://www.a.com/my/#/login Autodesk hps://accounts.autodesk.com/Authencaon/LogOn?viewmode=iframe&ReturnUrl=%2F Atlas Obscura hps://www.atlasobscura.com/sign-in Avant hps://stamp4s.avantassessment.com/avant/do/login Avant hps://stamp4se.avantassessment.com/avant/do/login Aurasma (HP Reveal Studio) hps://studio.hpreveal.com/landing AutoGradr hps://app.autogradr.com/login Aainment Company hps://www.aainmentcompany.com/customer/account/login/ Ave Point hps://www.avepoint.com/au/Security/login?BackURL=%2Fau%2Fproducts%2Fsharepoint Badge List hps://www.badgelist.com/users/sign_in Bandcamp hps://bandcamp.com/login AWE Learning hps://awelearning.com/my-account/ Babbel hps://accounts.babbel.com/en/accounts/sign_in Barracuda hps://login.barracudanetworks.com/auth/login/ BeerLesson hps://beerlesson.com/login?redirect=/coaching/lab&from=bl_landing_pd_login Bee-Bot hps://www.bee-bot.us/customer/account/login/ BeerChinese hps://online.beerchinese.com/Login.aspx BeerLesson hps://beerlesson.com/login?from=bl_landing_plans_login BeerChinese hps://www.beerchinese.com/account/login Big History Project hps://school.bighistoryproject.com/pages/signin Beyondpad hps://www.beyondpad.com/signin BiblioNasium hps://security.follesoware.com/aasp/ui/pick/pick Benetrac hps://www.eenroller.net/btrac/broker.asp Big Huge Labs hps://bighugelabs.com/login.php BiblioNasium hps://www.biblionasium.com/sign_ins Biodigital hps://human.biodigital.com/signin.html Big Universe hps://www.biguniverse.com/signin Big Ideas Math hps://www.bigideasmath.com/BIM/login Big Word of the Day hps://bigwordclub.com Bitsbox hps://bitsbox.com/code.html#signin Bitmoji hps://www.bitmoji.com/account_v2/ Binfire hps://www.binfire.com/ BirghtBytes hps://clarity.brightbytes.net/users/sign_in Biteslide hp://www.biteslide.com Bimboland hps://bimbo.land/site/login

CREATIVE COMMONS ATTRIBUTION 2018 STATE OF EDTECH SECURITY SURVEY, COMMON SENSE PRIVACY EVALUATION INITIATIVE 9 4.0 INTERNATIONAL PUBLIC LICENSE (connued) Vendor URL Blacke Colorado hps://www.blacke-colorado.com/ Blippar for Educaon hps://hub.blippar.com/ Bloc hps://www.bloc.io/sign_in Bloomz hps://www.bloomz.net/ BlocksCAD hps://www.blockscad3d.com/account/login/ Bloom Board hp://www.bloomboard.com Book Creator hps://app.bookcreator.com/sign-in/student/provider Book Creator hps://app.bookcreator.com/sign-in/teacher/provider BBC hps://account.bbc.com/signin Book Track hps://booktrackclassroom.com/content/sign-in?successUrl=%2Fintro Bookopolis hp://www.bookopolis.com Book Retriever hps://app.bookretriever.com/auth/sign-in Booktrack hps://www.booktrack.com/content/sign-in Booktrack hps://www.booktrackclassroom.com/content/sign-in BoomWriter hps://www.boomwriter.com/students/login?sendto=/author BoomWriter hps://www.boomwriter.com/Account/Login Box hps://account.box.com/login Booksource hps://www.booksource.com/Login.aspx Bookshare hp://www.bookshare.org Brain Pop Jr. hps://jr.brainpop.com/ Brainingcamp hps://www.brainingcamp.com/login/index.php BrainPOP hp://www.brainpop.com Brainly hps://brainly.com/login?entry=2&return=%2F Branching Minds hps://app.branchingminds.com/#/login Branching Minds hps://brm.branchingminds.com/#/login Brainscape hps://brainscape.com BRIM Bullying Prevenon Plaorm hps://admin.anbullyingsoware.com/site/login Brilliant hps://brilliant.org/account/login/ Brightstorm hps://www.brightstorm.com/login/ Bubbl.us hp://www.bubbl.us Britannica Digital Learning hps://school.eb.com/ Britannica hp://www.britannica.com Built By Girls hps://www.builtbygirls.com/wave/login Bringit hps://www.bringit.bz/find_account Buncee hps://app.edu.buncee.com/login C-spanclassroom hps://www.c-span.org/classroom/ Buzzfeed hps://community.buzzfeed.com/auth/login?redirect_uri=/ BuzzMath hps://www.buzzmath.com/SignIn Call-Em-All hps://app.call-em-all.com/login/ CALL hps://app.leadershipforlearning.org/auth/sign_in Callido Learning hps://callido.litmos.com/account/login/ CALL hps://app.leadershipforlearning.org/respondent/responses/new Busuu hps://www.busuu.com/en/login Canva hps://www.canva.com Calm hps://www.calm.com/login Canvas hps://canvas.instructure.com/login/canvas Capit hps://portal.capitlearning.com/login

10 2018 STATE OF EDTECH SECURITY SURVEY, COMMON SENSE PRIVACY EVALUATION INITIATIVE commonsense.org/educaon/privacy (connued) Vendor URL

Capit Learning hps://portal.capitlearning.com/login Capella University hps://www.capella.edu/content/capella-shared-content/shared/form-profiles/logi Canvas (Instructure) hps://canvas.instructure.com/login/canvas CAPE School hps://capeschool.com/reg/login.php Carnegie Learning hps://www.carnegielearning.com/login/index.html Capella University hps://cs.capella.edu/psc/cslr/EMPLOYEE/CU_CS/c/CU_NAC_REG_MENU.CU_NAC_USR_LOGI Capit hps://capitlearning.com/sign-in/ Career Foundry hps://careerfoundry.com/en/signin Cashvity hps://play.cashvity.com/login Carngie Speech hps://naveaccent3.carnegiespeech.com/login/ CatapultCMS hps://www.catapultcms.com/Login.aspx Catchup Math hps://catchupmath.com/login.html Castle Learning hps://cl.castlelearning.com/review/clo/account/logon Celtx hps://www.celtx.com/a/ux/logon Chalk hps://auth.chalk.com/login Caseworx hps://www.caseworx.co/login/ CG Cookie Membership hps://cgcookie.com/users/sign_in Chalkable hps://classroom.chalkable.com/home/index Chalkable hps://www.chalkablecafe.com/Account/LogOn Chalkup hps://www.chalkup.co/login Charter Vision hps://www.chartervision.net/Account/Login Cheezburger hps://www.cheezburger.com/ Cheddar Up hps://my.cheddarup.com/login Children’s Progress hps://reports.childrensprogress.com/login.php Challenge hp://www.challenge.gov Channel One News hps://www.channelone.com/login/ Bloxx hps://service.bloxx.com/support/login Choosito hps://www.choosito.com/login/class Choosito hps://www.choosito.com/login Cignion hps://fogstoneisle.com/?_ga=2.222492185.383950275.1528716968-1874418307.152871 Choremonster hps://www.choremonster.com/kids/login Choremonster hps://www.choremonster.com/parents/login Cisco hps://cloudsso.cisco.com/sp/startSSO.ping?SpSessionAuthnAdapterId=standardnomf Circuits.io hp://www.circuits.io CK-12 Plaorm hp://www.ck12.org Citaon Machine hps://www.citaonmachine.net/login Cite This For Me hps://www.citethisforme.com/premium/login Class Dojo hps://www.classdojo.com/ Class Charts hps://www.classcharts.com/account/login Class Cra hps://game.classcra.com/login Chesscademy hps://www.chesscademy.com/login Class Composer hp://www.classcomposer.com/ Class Kick hps://app.classkick.com/#/login Class Kick hps://app.classkick.com/#/account/login Class Link hps://launchpad.classlink.com/ Classflow hps://prod.classflow.com/classflow/#!/login/teacher Classflow hps://prod.classflow.com/classflow/#!/login/student

CREATIVE COMMONS ATTRIBUTION 2018 STATE OF EDTECH SECURITY SURVEY, COMMON SENSE PRIVACY EVALUATION INITIATIVE 11 4.0 INTERNATIONAL PUBLIC LICENSE (connued) Vendor URL Chromville hps://chromville.com/account/ Classcra hps://game.classcra.com/login ClassLink hps://launchpad.classlink.com/ Classcharts hps://www.classcharts.com/parent/login Classcharts hps://www.classcharts.com/account/login Class123 hp://www.class123.ac Classroom Inc hps://rtl.classroominc.org/ Classpartoo hps://app.classpartoo.com/page/login Classpager hps://www.classpager.com/sign-in Classroom Mosaic hps://app.classroommosaic.com/login Classroom Mosaic hps://classroommosaic.com/cm/login ClassTag hp://www.classtag.com ClassWallet hps://app.classwallet.com/login Clever hps://clever.com/login?student Clever hps://clever.com/login?teacher Classng hps://oauth.classng.com/v1/oauth2/authorize Club Penguin Island hps://www.clubpenguinisland.com/ CliffsNotes hps://www.cliffsnotes.com/account/Sign-In-Register?ReturnUrl=%2f Class Hopper hps://classhoppers.com/profile/login/ CloudMath hps://www.getcloudmath.com/EN/login Cloudready hps://my.neverware.com/login Cloudschool hps://www.cloudschool.org/login Code hps://studio.code.org/users/sign_in CodeCombat hps://codecombat.com Code.org hps://studio.code.org/users/sign_in CodeHS hps://codehs.com/login CodeFights hps://codefights.com/ Codecademy: Hour of Code hps://www.codecademy.com/login?redirect=about%3A%2F%2Fblank Colvard Learning hps://app.colvardlearning.com/ College Board hps://www.collegeboard.org Codecademy hps://www.codecademy.com/login Codeboard hps://codeboard.io/signin Common Cra hp://www.commoncra.com/ Codesters hps://www.codesters.com/ commentbubble hps://commentbubble.com/#sign_up Common Curriculum hps://www.commoncurriculum.com/users/sign Common Lit hps://www.commonlit.org/en/user/login Conceptua Math hps://teach.conceptuamath.com/client/StudentApp.html Common Sense Media hps://www.commonsensemedia.org/user/login?desnaon=homepage Common Sense Educaon hps://www.commonsense.org/educaon/user/login Cool Math hps://www.coolmath-games.com/user/login Conceptua Math hps://teach.conceptuamath.com/app/curriculum#login Cornerstone hps://ge.csod.com/ countable hp://www.countable.us Cornerstone hps://clients.csod.com/ Course Hero hps://www.coursehero.com/login/?ref=login Core Skills Mastery hps://www.csmlearn.com

12 2018 STATE OF EDTECH SECURITY SURVEY, COMMON SENSE PRIVACY EVALUATION INITIATIVE commonsense.org/educaon/privacy (connued) Vendor URL Course Networking hps://www.thecn.com/login Cram hps://www.cram.com/user/login Crasy hps://www.crasy.com/login CreaveLIVE hps://www.creavelive.com/#/login Creately hp://www.creately.com Crosni hps://app.crosni.io/ Crisis Go hps://crisisgo.net/ Crowdmark hps://app.crowdmark.com/sign-in CS First hps://csfirst.withgoogle.com/user/login Cuethink hps://app.cuethink.com/ Connecons Academy hps://www.connexus.com/login.aspx?sendTo=%2fdefault.aspx%3fpartner%3dconneco Curiosity Stream hps://app.curiositystream.com/login Curiosity Machine hp://www.curiositymachine.org Cuny hps://cunyportal.cuny.edu/cpr/authencate/portal_login.jsp Curiosityville hp://Curiosityville.com Curriki hps://www.curriki.org/ Curriculet hps://www.curriculet.org/login/ Cuny hps://home.cunyfirst.cuny.edu/oam/Portal_Login1.html Curiosity.com hps://curiosity.com/ Curious hp://www.curious.com Declara hps://declara.com/login D23 hp://www.d23.com Defined STEM hp://www.definedstem.com/ Curriculum Associates hps://www.curriculumassociates.com/Account/login.aspx Delicious hps://del.icio.us/login Dailymoon hp://www.dailymoon.com DigiExam hps://app-us.digiexam.com/app#/ Curriculum Pathways hp://www.sascurriculumpathways.com/portal Digitability hps://app.digitability.com/ Desire2Learn hps://d2l.cbe.ab.ca/d2l/loginh/ Didax hps://www.didax.com/customer/account/login/ DigitWhiz hp://www.digitwhiz.com Diigo hps://www.diigo.com/sign-in?referInfo=hps%3A%2F%2Fwww.diigo.com Digital Passport hps://www.digitalpassport.org/educator-registraon/login Digital Passport hps://www.digitalpassport.org/educator-registraon/studentLogin Dimension U hps://www.dimensionu.com/DimU/Registraon/SignIn.aspx?ref=rightcorner Discovery Educaon hp://app.discoveryeducaon.com/ Disney Story Central hp://www.disneystorycentral.com Deviantart hps://www.deviantart.com/users/login?ref=hps://www.deviantart.com/ Code Avengers hp://www.codeavengers.com/ Disney Movie Club hp://disneymovieclub.go.com/movies/login Dhebhuk hps://login.dnevnik.ru/login Do Something hps://www.dosomething.org/us/user/authorize Disney World hps://disneyworld.disney.go.com/en-eu/login/ DIY hp://www.diy.org Digital Theatre Plus hp://www.digitaltheatreplus.com DocHub hp://www.dochub.com

CREATIVE COMMONS ATTRIBUTION 2018 STATE OF EDTECH SECURITY SURVEY, COMMON SENSE PRIVACY EVALUATION INITIATIVE 13 4.0 INTERNATIONAL PUBLIC LICENSE (connued) Vendor URL DOGObooks hp://www.dogobooks.com/ DOGOnews hp://www.dogonews.com Docsity hp://www.docsity.com Docebo hps://www.docebo.com/saas/en DOGOmovies hp://www.dogomovies.com/ Doceri Interacve Whiteboard hps://doceri.com/login/login.php?rt=%2Findex.php Donors Choose hps://secure.donorschoose.org/common/signin.html?pageFromType= Drawp for School hps://app.drawpforschool.com/student/search-school Drawp for School hps://app.drawpforschool.com/teacher/login/ Drillster hps://www.drillster.com/login Dream Box hps://play.dreambox.com/ DreamBox hps://play.dreambox.com/ DropBox hps://www.dropbox.com/login Dub Labs hps://cloud.dublabs.com/s3/index.html Dude Soluon hps://login.schooldude.com/mlogin?producd=community Dude Soluon hps://login.facilitydude.com/FDMarkeng Duolingo hp://duolingo.com/ Dreamdo hp://www.edu.dream.do Easelly hps://www.easel.ly/auth/login Earthrangers hp://www.earthrangers.com EasyBib hps://www-secure.easybib.com/login ebackpack hps://parent.ebackpack.com/ econedlink hp://www.econedlink.org edcite hps://www.edcite.com/usr/signin Edgenuity hps://auth.edgenuity.com/Login/Login/Student Economics Games hp://economics-games.com Edgenuity hps://auth.edgenuity.com/Login/Login/Educator Edivate hps://edivate.com/#login Ed-Fi hps://dellfoundaon.force.com/c365/s/login EDaura hps://login.edaura.com/ eCoach hps://app.ecoach.com/ Edmentum hps://ple.platoweb.com/Account/SignIn Edmentum hps://ple.platoweb.com/Account/SignIn edmodo hp://www.edmodo.com Edsby hps://www.edsby.com/login/ Edorble hps://www.edorble.com/dashboard/login edpuzzle hp://www.edpuzzle.com eDoctrina hps://secure.edoctrina.org/v2/login.html edshelf hps://edshelf.com/sign-in/ edsurge hps://accounts.edsurge.com/login edthena hps://app.edthena.com/ Educaon Crub hps://educaoncurb.com/login edublogs hps://edublogs.org/wp-login.php Educaon Framework hps://educaonframework.com/signin.aspx Educaon hp://www.educaon.com Educents hps://www.educents.com/ educlipper hps://educlipper.net/users/sign_in

14 2018 STATE OF EDTECH SECURITY SURVEY, COMMON SENSE PRIVACY EVALUATION INITIATIVE commonsense.org/educaon/privacy (connued) Vendor URL Educaon City hps://ec1.educaoncity.com/ edulasc hps://app.edulasc.com/login#login Educator Learning Labs hps://courses.educatorlearninglab.com/users/sign_in Edupoint hps://support.edupoint.com/Login_OVR.aspx EduCrate hps://www.educrate.com.au/customer/login Eduplanet21 hps://my.eduplanet21.com/eduplanet21/ Edureacons hps://www.educreaons.com/login/ Eduporium hps://www.eduporium.com/store/customer/account/login/ EduTect Unit Planner hps://my.eduplanet21.com/eduplanet21/ EduTone hps://inside.edutone.net/ Ellentube hps://www.ellentube.com/ Ellevaon hps://login.ellevaoneducaon.com/ edWeb hps://www.edweb.net/login embrance hps://www.outreachme.com/login/ ELF hps://www.libraryelf.com/base/SignIn.aspx ello hps://ello.co/enter emaze hp://www.emaze.com Emma hps://myemma.com/login Elesapiens hps://www.elesapiens.com/ Enchanted Learning hp://members.enchantedlearning.com/home.shtml emathhelp hps://www.emathhelp.net/login/ engineergirl hps://www.engineergirl.org/Register.aspx Enriching Students hps://app.enrichingstudents.com/ eNotes hps://www.enotes.com/signin?redirect=%2F EnglishCentral hp://www.englishcentral.com EPICOR hps://epicorcs.service-now.com/epiccare/ Epiphany Learning hps://login.epiphanylearning.com/ English Aack hps://www.english-aack.com/user/login EQAO Quizzer hps://app.eqaoquizzer.com/ EPS hp://eps.schoolspecialty.com/Account-Login eSpark Learning hps://mc.esparklearning.com/users/sign_in EverFi hps://www.campusclarity.com/signup/ Evernote hps://www.evernote.com/Login.acon Essenal Skills hps://essenalskills.com/user EverFi hps://plaorm.everfi.net/ Everloop hps://everloop.com/admin Explain Everything hps://drive.explaineverything.com/discover/login-form ExploreLearning Gizmos hps://www.explorelearning.com Facing History And Ourselves hps://www.facinghistory.org/user/login FanSchool hps://app.fanschool.org/login faketown hp://www.faketown.com Family Educaon hps://www.familyeducaon.com/user/login Explee hp://www.explee.com FamilyID hps://www.familyid.com/login Fast Bridge Learning hps://auth.fastbridge.org/login.do feedly hp://www.feedly.com FastBridge Learning hps://auth.fastbridge.org/login.do

CREATIVE COMMONS ATTRIBUTION 2018 STATE OF EDTECH SECURITY SURVEY, COMMON SENSE PRIVACY EVALUATION INITIATIVE 15 4.0 INTERNATIONAL PUBLIC LICENSE (connued) Vendor URL

FastFig hps://www.fastfig.com/app/ Field Trip Factory hps://www.fieldtripfactory.com/Login?ReturnURL=/ Filament Games hps://www.filamentgames.com/user/login?desnaon= FEV Tutor hps://www.fevtutor.com/ First In Math hp://www.firsnmath.com/ FileWave hps://www.filewave.com/?morequest=sso Fishtree hps://app.fishtree.com/signin Flat hps://flat.io/auth/signin Flaron School hps://learn.co/ FlipGrid hps://admin.flipgrid.com/ FlipSnack hps://www.flipsnack.com/accounts/sign-in.html flixpress hps://flixpress.com/Login/tabid/72/Default.aspx?returnurl=%2f Florida Virtual School hps://login.flvs.net/?returnUrl=hps://vsa.flvs.net Flocabulary hp://www.flocabulary.com Florida Virtual School hps://flvs.focusschoolsoware.com/focus/ Footsteps2Brilliance hps://myf2b.com/my_library/ FluentU hps://www.fluentu.com/login/ Folle hp://security.follesoware.com/aasp/ui/pick/pick FooPets hps://www.foopets.com/signup/login Flyer Connect hps://login.flyerschoolapp.com/login ForAllRubrics hps://www.forallrubrics.com/login/ FLIPBOARD hp://www.flipboard.com FourSquare hps://foursquare.com/login?connue=%2F&clicked=true Forefront Math hps://unity.forefrontmath.com/ Evan Moor hps://www.evan-moor.com/account Formacally hps://formacally.com/login.html Formave hps://goformave.com/login Fresh Schools hps://www.freshschools.com/app/users/sign_in Freckle hps://student.freckle.com/#login Freckle hps://classroom.freckle.com/#login Fresh Grade hps://student.freshgrade.com/#login FreshGrade hps://www.freshgrade.com Fresh Grade hps://parent.freshgrade.com/#login Forvo hps://forvo.com/login/ Fuel Educaon hps://peak.geueled.com/#login Gaggle hps://apps.gaggle.net/gen?_template=/templates/gaggle/html/index.jsp gaia ONLINE hp://www.gaiaonline.com Freshi Learning Online hps://www.freshilearningonline.com/login GameSalad for Educaon hps://auth.gamesalad.com/auth/signIn?targetUri=hp://auth.gamesalad.com/accou Frontline Educaon hps://www.frontlineeducaon.com/signin/ Gamespot hps://www.gamespot.com/login/ Games for Language hps://www.gamesforlanguage.com/login Genius hp://www.genius.com Geocaching hps://www.geocaching.com/account/login?returnUrl=%2fplay Fuse School hps://www.fuseschool.org GeneraonOn hps://changemaker.pointsoflight.org/login Generaon Ready hps://readypath.generaonready.com/

16 2018 STATE OF EDTECH SECURITY SURVEY, COMMON SENSE PRIVACY EVALUATION INITIATIVE commonsense.org/educaon/privacy (connued) Vendor URL Ginger hp://www.gingersoware.com/auth/login?client=website&trigger=/home_page&targe GGinteracve hps://store.gginteracve.com/login GFC Learn Free hp://www.gcflearnfree.org/account/signin/ Girls’Life hp://www.girlslife.com/account/login?returnurl=%2F Geronimo Slton World hp://www.geronimoslton.com Gizmos hp://www.explorelearning.com Genshuixue hps://www.genshuixue.com/stac/login?next=hps%3A%2F%2Fwww.genshuixue.com%2F GoalBook hps://goalbookapp.com/accounts/users/sign_in Go Guardian hps://goguardian.com/account GoNoodle hps://app.gonoodle.com/login?ref_id=GNlogin GoAnimate hps://goanimate4schools.com/login Google hps://accounts.google.com/ServiceLogin?hl=en&passive=true&connue=hps://www Google Drive hps://accounts.google.com/ServiceLogin?service=wise&passive=true&connue=hp Google Maps hps://accounts.google.com/ServiceLogin?hl=en&passive=true&connue=hps://www GoBubble hps://www.bubble.school Gmetrix hps://www.gmetrix.net/ GoSoapBox hps://app.gosoapbox.com/ GoSkills hps://www.goskills.com/Login goodreads hp://www.goodreads.com GoConqr hps://www.goconqr.com/ Gee Whiz Educaon hp://www.geewhizeducaon.com Global Oneness Project hps://www.globalonenessproject.org/ GradeHub hps://app.gradehub.com/login GradeCam hps://app.gradecam.com/login GradeCam hps://app.gradecam.com/studentLogin Grade Hacks hps://www.gradehacks.com/profile/login/ Gradescope hps://gradescope.com/ Gradeable hps://www.gradeable.com/users/sign_in GreatSchools hps://www.greatschools.org/gsr/login/ GoClass hp://www.goclass.com Grammarly hps://www.grammarly.com/signin GrammarFlip hp://app.grammarflip.com/ GradeSlam hps://www.gradeslam.org Grovo hps://app.grovo.com/login Hapara hps://www.teacherdashboard.com/#/login GreyCampus hp://www.greycampus.com/ HeyMath hps://heymath.com Hasbro Toy Shop hps://www.hasbrotoyshop.com/LogonForm?catalogId=10051&myAcctMain=1&langId=-1&s HippoCampus hp://hippocampus.org Grammaropolis hps://www.grammaropolis.com/login.php Highrise hps://launchpad.37signals.com/highrise/signin HiMama hps://www.himama.com/login HelpHub hps://helphub.me HireVue hps://app.hirevue.com/accounts/login/?&_ga=2.202128791.703527544.1529129816-11 hmhco hps://www.hmhco.com/account/sign-in?inCheckout=false HHMI hp://www.hhmi.org/user HMH Developer Portal hps://developer.hmhco.com/login

CREATIVE COMMONS ATTRIBUTION 2018 STATE OF EDTECH SECURITY SURVEY, COMMON SENSE PRIVACY EVALUATION INITIATIVE 17 4.0 INTERNATIONAL PUBLIC LICENSE (connued) Vendor URL Homer hps://learnwithhomer.com/signin/ Hoonuit hps://learnit.hoonuit.com/login Hoffman Academy hps://www.hoffmanacademy.com/log-in/ Houghton Mifflin Harcourt hps://www.hmhco.com/account/sign-in?inCheckout=false Hotwheels hps://hotwheels.mael.com/shop/AjaxLogonForm?catalogId=10102&myAcctMain=1&lan HR Imaging Partners hps://shop.hrimaging.com/shop/login.aspx Hotornot hps://hotornot.com/signin/?f=top HUE hps://huehd.com/my-account/ Hyperaudio hps://hyperaud.io/login/ Hypothes.is hps://hypothes.is/login Hubbli hp://hubbli.com/wp-login.php Hybridge hps://www.edgenuity.com/login/ HR Imaging Partners hps://myschool.hrimaging.com/MySchool/Login.aspx?ReturnUrl=%2fmyschool%2f i-Ready hps://login.i-ready.com Homework Together hp://www.17zuoye.com/ Icurio hps://www.icurio.com/login.html IFTTT hps://i.com/login iCivics hps://www.icivics.org/login Imagine Learning hps://www.imaginelearning.com/login i3 Technologies Learning hps://www.i3-technologies.com/en/login-portal/ Imgur hps://imgur.com/signin?invokedBy=regularSignIn IL Insert Learning hps://insertlearning.com/v1/dashboard/ InferCabulary hps://app.infercabulary.com/login iNaturalist hps://www.inaturalist.org/login Infinite Campus hps://www.infinitecampus.com/audience/parents-students/login-search infogram hps://infogram.com/login In Pictures Tech Tutorials hps://secure.imvu.com/welcome/ux/ Informed K12 hps://app.informedk12.com/ Inq-ITS hps://selfservice.inqits.com/ Instagram hps://www.instagram.com/accounts/login/ Insight Advance hps://login.insightadvance.com/Account/Login InstaTeam hps://www.instateam.net/app/#/access/signin Inventables hps://www.inventables.com/login iPracce Math hps://www.ipraccemath.com/membership/signin Inspark hps://inspark.educaon/oauth/start?rd=127.0.0.1/ iPathways hp://www.i-pathways.org/ Itch hp://teach.itchcode.com/ Isidewith hps://secure.isidewith.com/social-login?r=hps%3A%2F%2Fwww.isidewith.com%2F issuu hps://issuu.com/signin?onLogin=%2F&issuu_product=header&issuu_subproduct=anon- Istaon hps://secure.istaon.com/Account/ChooseDomain iwitness hps://iwitness.usc.edu/SFI/Account/login.aspx IXL hp://www.ixl.com Jamf hps://login.jamfcloud.com/?lang=en-US Jamf hps://www.jamf.com/jamf-naon/login JAMF Soware hps://www.jamf.com/jamf-naon/login Java School hps://javaschool.com/ JAMF Soware hps://login.jamfcloud.com/?lang=en-US&_ga=2.70818448.169341684.1528713623-1699

18 2018 STATE OF EDTECH SECURITY SURVEY, COMMON SENSE PRIVACY EVALUATION INITIATIVE commonsense.org/educaon/privacy (connued) Vendor URL Jib Jab hps://www.jibjab.com/login JoeZoo hps://joezooapp.com/ Jeopardy Labs hps://jeopardylabs.com/account/login/ Jive hps://signup.jiveon.com/login.jspa Jive hps://signup.jiveon.com/login.jspa JogNog hps://www.jognog.com/SignIn.aspx Jump Rope hps://nyc3.jumpro.pe/login/ Jumpstart Games hps://www.jumpstart.com/main/account/login.aspx JoomlaLMS hp://www.joomlalms.com/ Jefferson Lab hps://www.jlab.org/user?desnaon=node/4998%3F K12 hps://login-learn.k12.com/#login Kajeet hps://www.kajeet.com/sennel/login.html?__hstc=215977800.d34f27638f947229603d Kami hps://web.kamihq.com/web/viewer.html Kahoot! hps://create.kahoot.it/login?next=/%3F_ga%3D2.201009518.1729815724.1529510316- Kaymbu hps://my.kaymbu.com/app/login/auth Kedzoh mlearn hp://www.kedzoh.com Kennedy-center hp://www.kennedy-center.org/account/login KeptMe hps://prod.keptme.com/web/login.php Keys2Engage hps://bfw.writerkey.com/users/login Keys2Engage hps://ml.writerkey.com/users/login Khan Academy hps://www.khanacademy.org/login Kickboard hps://www.kickboardforschools.com/login KickUp hps://pulse.kickup.co/accounts/login/?next=/ Kiddom hps://app.kiddom.co/login?role=student Kidoodle.Tv hps://www.kidoodle.tv/login Kiddom hps://app.kiddom.co/login?role=teacher Kidblog hps://kidblog.org/login Kidzworld hp://www.kidzworld.com Kids Email.org hps://www.kidsemail.org/parent-login.php KIVA hps://www.kiva.org/login KiSSFLOW hps://app.kissflow.com/ Kinvolved hps://kinvo.kinvolved.com/users/sign_in Knewton hps://www.knewton.com/login Kizoa hps://www.kizoa.com/editor2.php?rmode=40&phpsession=&lang=en-us&country=AA&par Know Your Meme hp://knowyourmeme.com/login Known hps://withknown.com/signin/ Knowledge hook hps://app.knowledgehook.com/app/StudentJoin Knowledge hook hps://app.knowledgehook.com/app/Login Knowre hps://school.knowreapp.com/ KnoitAll hps://www.knoitall.com/ Knowre hps://homeschool.knowreapp.com/ Kiwibox hp://www.kiwibox.com Koantum hps://my.koantum.com/sign-in KidzVuz hp://www.kidzvuz.com Koofers hps://www.koofers.com Kyte Learning hps://app.kytelearning.com/login Komodo hps://app.komodomath.com/iapp/

CREATIVE COMMONS ATTRIBUTION 2018 STATE OF EDTECH SECURITY SURVEY, COMMON SENSE PRIVACY EVALUATION INITIATIVE 19 4.0 INTERNATIONAL PUBLIC LICENSE (connued) Vendor URL Kurzweil Educaon hps://www.kurzweil3000.com/KLogin.php kurzweil3000 hps://www.kurzweil3000.com/KLogin.php LDC hps://coretools.ldc.org/login Labster hps://courses.labster.com/login?next=/dashboard LearnBoost hp://www.learnboost.com LaunchPad hps://launchpad.net/+login KiraKira 3D hps://kirakira.com/ learnbop hps://www.learnbop.com/family/login Learnhub hps://www.getlearnhub.com/users/sign_in Learning hps://login.learning.com/?utm_source=website_header learnbop hps://www.learnbop.com/classroom/login Learneroo hps://www.learneroo.com/signin Learning Genie hps://web.learning-genie.com/#/login Learning A-Z hps://accounts.learninga-z.com/accountsweb/account/login.do Lego hps://www.lego.com LearnThatWord hps://www.learnthat.org/users/login Lessoneer hps://lessoneer.com/sign-in LearnZillion hps://learnzillion.com/login Let’s Go Learn hps://frontend.letsgolearn.com/login Let’s Go Learn hps://frontend.letsgolearn.com/login Lexia Learning hp://www.lexiacore5.com/ Lesson Planet hps://www.lessonplanet.com/search Lessonface hps://www.lessonface.com/user/login?desnaon=dashboard Lincoln Interacve hps://learn.lincolnlearningsoluons.org/Account/Login?ReturnUrl=%2F Linkedin hps://www.linkedin.com/uas/login Lino hps://linoit.com/session/login?dispLang=en_US Lingo Live hps://app.lingolive.com/users/sign_in Listenwise hps://listenwise.com/students Listenwise hps://listenwise.com/teachers/sign_in Literably hps://literably.com/login Literably hps://literably.com/login Literator hps://confer.literatorapp.com/dashboard Lilebirdtales hp://www.lilebirdtales.com LileBits hps://lilebits.com/login Livejournal hp://www.livejournal.com LiveSchool hps://student.liveschoolinc.com/#/login LiveText hps://www.livetext.com/purchase-register-membership/ LoiLoNote School hps://n.loilo.tv/users/sign_in LiveSchool hps://app.liveschoolinc.com/ Lile Pim hps://shop.lilepim.com/my-account/ LTI hps://tms.languagetesng.com/ProctorSite/ Lumio hps://web.lumioeducaon.com/app/signin.html Lucid Chat hps://www.lucidchart.com/users/login Looop hps://app.looop.co/#/login Lucidpress hps://www.lucidpress.com/users/login Lynda hps://www.lynda.com/signin Lynda.com hps://www.lynda.com/signin

20 2018 STATE OF EDTECH SECURITY SURVEY, COMMON SENSE PRIVACY EVALUATION INITIATIVE commonsense.org/educaon/privacy (connued) Vendor URL

Lumos Learning hps://www.lumoslearning.com/llp/login.php MAD-learn hps://plaorm.mad-learn.com/Account/Login?ReturnUrl=%2f Magnus Health hps://secure.magnushealthportal.com/ Mag Cloud hps://www.magcloud.com/login Magisto hp://www.magisto.com Makers Empire hps://dash.makersempire.com/teachers/sign_in?_ga=2.237715520.178767982.1529151 lumosity hps://www.lumosity.com/login MacMillan Learning hps://www.macmillanlearning.com/Catalog/Login Mangahigh hps://app.mangahigh.com/en/login/teacher Lyricstraining hp://www.lyricstraining.com Make School hps://www.makeschool.com/login Mango Languages hps://learn.mangolanguages.com/login Mangahigh hps://app.mangahigh.com/en/login Marvel hp://www.marvel.com LTI hps://www.languagetesng.com/login-and-registraon Math Learning Center - Fracons hps://apps.mathlearningcenter.org/fracons/ Mari hps://www.mari.com/ MasteryConnect hps://app.masteryconnect.com/login Math Games (TeachMe) hps://www.mathgames.com/user/login MASSOLIT hps://www.massolit.io/ Mathalicious hp://www.mathalicious.com/login Masher hps://www.masher.com/login.jsp Mathgames hps://www.mathgames.com/user/login MathFights hp://mathfights.com/ MathGames.com hps://www.mathgames.com/user/login Mathseeds hps://app.readingeggs.com/login?_ga=2.167457019.479149089.1529263564-160268495 Mathspace hps://mathspace.co/accounts/login/ MathScore hps://home.mathscore.com/user/loginForm.php Mathtv hp://www.mathtv.com Mafic hps://www.mafic.com/us/en-us/login-page Media Breaker Studios hps://mbstudios.thelamp.org/auth/login Measurement hps://write.pegwring.com/Account/Login?ReturnUrl=%2F LiveCode hps://livecode.com/login/ Meeng Pulse hps://app.meet.ps/login Meetme hp://www.meetme.com Meet the Teacher hps://unis.meeheteacher.com/Auth/Teacher/ Meludia hps://web.meludia.com/en/login Meinunterricht.de hps://app.meinunterricht.de/login/ MemberHub hps://app.memberhub.com/login MemRise hps://www.memrise.com/login/ Memarden hps://www.memarden.com/ Merit Soware hps://www.meritonlinelearning.com/OLMS/Login/Login.aspx Memorado hps://memorado.com/users/sign_in Microso Azure hps://portal.azure.com/ Microso hps://account.microso.com/account Microso OneNote hps://www.onenote.com/signin?wdorigin=ondcnotebooks&showHrd=true MindMup hps://app.mindmup.com/account.html

CREATIVE COMMONS ATTRIBUTION 2018 STATE OF EDTECH SECURITY SURVEY, COMMON SENSE PRIVACY EVALUATION INITIATIVE 21 4.0 INTERNATIONAL PUBLIC LICENSE (connued) Vendor URL Minecra hps://minecra.net/en-us/login/?ref=gm Mindprint hps://my.mindprintlearning.com/login Miniclip hp://www.miniclip.com Mindomo hps://www.mindomo.com/login Mindset Works hps://www.mindsetworks.com/#login-secon Mission 100% hps://app.mission100percent.com/login MobLab hps://game.moblab.com/server/login Mission US hps://www.mission-us.org/login Model Diplomacy hps://modeldiplomacy.cfr.org Modern Teacher hps://app.modernteacher.com/login Meridianstories hps://www.meridianstories.com/wp-login.php Moon Math hps://accounts.moonmathgames.com/#/signup Mosa Mack Science hps://mosamack.com/student_login Mosa Mack Science hps://mosamack.com/login Mondomedia hp://www.mondomedia.com Modular Robocs hps://www.modrobocs.com/ Moxtra hps://www.moxtra.com/service5/#login Mozi hps://www.themozi.com/teachers/sign_in Mozi hps://www.themozi.com/students/sign_in Mr. Elmer hps://www.mrelmer.com/#login-modal Muzzy Lane hps://author.muzzylane.com/ MyBigCampus hps://mybigcampus.in/login/index.php My Choice Pad hps://cloud.mychoicepad.com/login My Tutor hps://www.mytutor.co.uk/students/login.html My Tutor hps://www.mytutor.co.uk/parents/login.html myHomework hps://myhomeworkapp.com/login Myexperiment hps://www.myexperiment.org/session/new?return_to=%2Fhome Myon hps://www.myon.com/login/index.html Mypopstudio hps://www.mypopstudio.com/login.php MyStemKits.com hps://www.mystemkits.com/ My Study Life hps://app.mystudylife.com/?utm_source=mystudylife&utm_medium=sign-in&utm_campa Naiku hps://a.naiku.net/ Myspace hps://myspace.com/signin Mystery Science hps://mysteryscience.com/log-in NaMaYa hps://www.namaya.com/account/login Naturalreaders hps://www.naturalreaders.com/myaccount.html NCTM hps://www.nctm.org/login/ Naonal Student Clearinghouse hps://secure.studentclearinghouse.org/SSOLogin/login.jsp?bmctx=57D2BF0CBDBC361 Naviance hps://connecon.naviance.com/auth/fclookup Naviance hps://succeed.naviance.com/auth/signin Narnia hps://store.harpercollins.com/store/harperco/en_US/DisplayHelpPage Nearpod hps://nearpod.com/login/ Nervanix hps://learn.nervanix.com/ NEO hps://www.neolms.com/ NCLab hps://nclab.com/login/ Nepris hps://www.nepris.com/account/login NeuroPlus hps://my.neuro.plus/users/sign_in

22 2018 STATE OF EDTECH SECURITY SURVEY, COMMON SENSE PRIVACY EVALUATION INITIATIVE commonsense.org/educaon/privacy (connued) Vendor URL Newmoon hps://newmoon.com/adult-member-home/ New Arst Model hp://newarstmodel.mykajabi.com/login New Techer Center hps://learningzone.ntcportal.org/portal News-O-Mac EDU hps://newsomac.org/login NextLesson hp://www.nextlesson.org Newsela hp://www.newsela.com/ Niche hps://www.niche.com/ Night Zookeeper hps://www.nightzookeeper.com/edu/home Night Zookeeper hps://www.nightzookeeper.com/edu/dashboard/login Nitro Type hps://www.nitrotype.com/ NoRedInk hp://www.noredink.com/ Ninchanese hps://app.ninchanese.com/login Noodle hps://www.noodle.com/ NobleHour hps://www.noblehour.com/login NorthPass hps://app.northpass.com/login NoteBowl hps://plaorm.notebowl.com/ Nureva Troove hps://span.nureva.com/9/app/#/login Novare Plaorm hps://app.novareedu.com/ Nymes hp://www.nymes.com NWEA hps://sso.mapnwea.org/auth/login NWEA hps://sso.mapnwea.org/auth/login Observe4success hps://www.observe4success.com/user_session/new Office365 hps://login.microsoonline.com Nulu hps://www.nulu.com Omnito hps://omnito.net/app/ OER Commons hp://www.oercommons.org/ OKpanda hps://student.okpanda.com/ ONLYOFFICE hps://www.onlyoffice.com/signin.aspx Onelogin hps://app.onelogin.com/login ONEder hps://app.oneder.com/#/login/signIn Ooka Island hps://lighthouse.ookaisland.com/account/login/ Open English hps://learningplaorm.openenglish.com/login.html Open English hps://junior.openenglish.com/login Open Reading hps://junior.openenglish.com/login Open Learning Iniave hps://oli.cmu.edu/jcourse/webui/welcome.do OpenEd hps://www.opened.com/profile/signin OpenStax hps://openstax.org/accounts/login/openstax/?next=hps%3A%2F%2Fopenstax.org%2F Osmosis hps://www.osmosis.org/login Otus hps://my.otus.com/login Outlook hps://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&ct=1529149859&rver=6.7.6 Ourteennetwork hps://www.ourteennetwork.com/signin Overgrad hps://overgrad.com/login Padlet hps://padlet.com/auth/login Owl Eyes hps://www.owleyes.org/login Organized Binder hp://organizedbinder.com/ Parchment hps://www.parchment.com/u/auth/login Panorama educaon hps://secure.panoramaed.com/login

CREATIVE COMMONS ATTRIBUTION 2018 STATE OF EDTECH SECURITY SURVEY, COMMON SENSE PRIVACY EVALUATION INITIATIVE 23 4.0 INTERNATIONAL PUBLIC LICENSE (connued) Vendor URL Parchment hps://exchange.parchment.com/u/auth/login PaGamO hps://www.pagamo.org/ PB Works hps://my.pbworks.com/ ParentSquare hps://www.parentsquare.com/signin PCH hps://accounts.pch.com/login PeachJar hps://www.peachjar.com/index.php?a=4 PBS hps://www.pbs.org/ ParciPoll hps://www.parcipoll.com/login/ Pearson hps://www.pearsonmylabandmastering.com/northamerica/mymathlab/ Pearson hps://www.pearson.com/us/higher-educaon/subject-catalog/download-instructor- PD In Focus hp://auth.ascd.org/login.aspx?rurl=hp://pdinfocus.ascd.org/Home/default.aspx Pearson hps://www.pearsoncanadaschool.com/profile.cfm?pageref=login&app_id=7&group_id= Pearson hps://mypearsontraining.com/login Pearson MyLab Math hps://portal.mypearson.com/portal Pearson School hps://portal.mypearson.com/login Pearson School hps://www.pearsonschool.com/profile.cfm?pageref=login&group_id=1 Pearson Realize hps://www.pearsonrealize.com/community/ Peekapak hps://www.peekapak.com/~login PenPal Schools hps://go.penpalschools.com/login Peercepv hps://go.peercepv.com/login.jsp Pearson hps://www.pearsonclinical.com/account/login.html Penzu hps://penzu.com/app/login Performance Maers hps://unify.performancemaers.com/ PeerPower hps://www.peerpowerinc.com/ Peergrade.io hps://app.peergrade.io/login PicCollage hps://pic-collage.com/login_page PiggyBackr hps://www.piggybackr.com/users/sign_in PikMyKid hps://schools.pikmykid.com/pikmykid/ Pinterest hps://www.pinterest.com Picmonic hp://picmonic.com/ Pixton hps://www.pixton.com/ca/login Play4A hps://www.play4a.com/login.php Piqosity hps://app.piqosity.com/users/sign_in Plural Sight hps://app.pluralsight.com/id?redirectTo=%2Flibrary%2F Pluralsight hps://app.pluralsight.com/id?redirectTo=%2Flibrary%2F PledgeCents hps://www.pledgecents.com Plickers hps://www.plickers.com/signin Poll Everywhere hps://www.polleverywhere.com/login Ponder hps://www.ponder.co/accounts/login/ PowerSchool hps://www.powerschool.com/sign-in/ pol.is hps://pol.is/signin Powerpoetry hps://www.powerpoetry.org/user PowerMyLearning hp://www.powermylearning.org/connect PowerSchool hps://my.haikulearning.com/do/account/xauth PrepToon hps://www.preptoon.com/site/login PresenceLearning hps://login.presencelearning.com/login/ PowToon hps://www.powtoon.com/account/login/

24 2018 STATE OF EDTECH SECURITY SURVEY, COMMON SENSE PRIVACY EVALUATION INITIATIVE commonsense.org/educaon/privacy (connued) Vendor URL PracTutor hps://app.practutor.com/signin Pocoyo hps://www.pocoyo.com/club/entrar Proctor U hps://go.proctoru.com/session/new Pracce Labs hps://www.pracce-labs.com/login.aspx Problem-Ac hps://www.problem-ac.com/login Prezi hps://prezi.com/login/ Prodigy hps://www.prodigygame.com Primarypad hps://login.primarypad.com/ Proquest hps://www.proquest.com/connect/#researcher PSNI hps://cust.promedsoware.com/Login?ReturnUrl=%2f Publicinsightnetwork hps://www.publicinsightnetwork.org/source/en/login Quick Key hps://quickkeyapp.com/users/sign_in QwertyTown hps://go.qwertytown.com/ Quizlet hp://quizlet.com/ Quickbase hps://login.quickbase.com/db/main?a=SignIn&_ga=2.211024981.1551958505.15293096 Quill hps://www.quill.org/session/new Raise.me hps://www.raise.me/#auth=login&user=student Raise.me hps://www.raise.me/#auth=signup&user=educator Ques hps://www.ques.com ProProfs hps://www.proprofs.com/ Read Theory hps://readtheory.org/auth/login Reading Eggs hps://app.readingeggs.com/login?_ga=2.73290451.1118582394.1529241140-812055640 Reading Kingdom hps://www.readingkingdom.com/login ReadWorks hp://www.readworks.org/ Reading A-Z hps://www.readinga-z.com/ Readorium hps://app.readorium.com/ Reasoning Mind hps://my.reasoningmind.org/ Readorium hps://app.readorium.com/teacher/login ReadTheory hps://readtheory.org/auth/login RedShelf hps://www.redshelf.com/accounts/login/ Redbird Professional Learning Plaorm hps://redbird.massivepd.com/ Renaissance hps://www.myon.com/login/index.html Rescue hps://secure.logmeinrescue.com/Account/Login?_ga=2.108481729.2144731619.152915 RealmeBoard hps://realmeboard.com/signup/ Renaissance hps://www.renaissance.com/product-login/#renaissancelogin Remind hps://www.remind.com/log_in Repl.It hps://repl.it/ Rezzly Heroic Learning hps://portal.rezzly.com/users/sign_in RocketLit hps://www.rocketlit.com/login/ Safari hps://www.safaribooksonline.com/ Roojoom hps://my.roojoom.com/accounts/login/?is_edu=true Rosea Stone hps://totale.roseastone.com/sign_in RyeCatcher hps://www.ryecatcher.com/users/sign_in Sadlier hps://www.sadlierconnect.com/login.html Sadlier hps://religion.sadlierconnect.com/login.html sage Intacct hps://www.intacct.com/ia/acct/login.phtml Roseastoneclassroom hps://www.roseastone.com/login

CREATIVE COMMONS ATTRIBUTION 2018 STATE OF EDTECH SECURITY SURVEY, COMMON SENSE PRIVACY EVALUATION INITIATIVE 25 4.0 INTERNATIONAL PUBLIC LICENSE (connued) Vendor URL

Samanage hps://app.samanage.com/login?__hstc=51647990.d84476cbbd3b08dda93ec1928db6b9ac. SAP Concur hps://www.concursoluons.com/ Sangha hps://www.sanghapp.com/login Sangakoo Maths hps://www.sangakoo.com/en/enter Saylor hps://learn.saylor.org/login/ Satchel hps://www.showmyhomework.co.uk/login Scholasc hps://www.scholasc.com/kids/home/#login Scholarchip ABE hps://abe.scholarchip.com/ School Yourself hps://schoolyourself.org/login SchoolLoop hps://live.schoolloop.com/portal/login SchoolCNXT hps://app.schoolcnxt.com/ SchoolTube hps://www.schooltube.com/login Schoology hps://app.schoology.com/login Schoolzilla hps://app.schoolzilla.com/login Schoolrunner hps://www.schoolrunner.org/sign-in Schoolwide hps://resources.schoolwide.com/login Scienfic Learning hps://www.scilearn.com/student-login Scienfic Learning hps://www.scilearn.com/customer-login School Bytes hps://online.schoolbytes.educaon Science Engineering Medicine hps://www.nap.edu/login.php?page=hp%3A%2F%2Fwww.nap.edu Sciencebuddies hp://www.sciencebuddies.org Scratch hp://scratch.mit.edu/ Science4Us hps://www.science4us.com/school/schoolloginguide.aspx Screencasfy hps://www.screencasfy.com/user/sign_in?next=%2F Scrible hps://www.scrible.com/sign-in#/ Securly hps://www.securly.com/app/login See Saw hps://app.seesaw.me/#/login SchoolTime hps://school-me.co/login Seesaw hps://app.seesaw.me/#/login?role=teacher Seesaw hps://app.seesaw.me/#/login?role=student Seesaw: The Learning Journal hps://app.seesaw.me/#/login Securly hps://www.securly.com/parent-login SCS hps://www.schoolclimatesoluons.org/?login=%2Fmy-resources%2F Seams Cloud hps://www.seamscloud.com/user/login Scoop.it hps://www.scoop.it/login Sesame hps://app.sesamehq.com/signin Sevenstar hps://sevenstar.org/login/ Science-Bits hp://www.science-bits.com Shopbop hps://www.shopbop.com/acons/loginPageAcon.acon Share My Lesson hp://www.sharemylesson.com Signal Kit hps://app.signalkit.com/login/ Shmoop hps://www.shmoop.com/login.html?origin_page=%2F Showbie hps://my.showbie.com/?utm_source=homepage&utm_medium=website&utm_campaign=logi Sedo hps://sedo.com/us/ Sexetc hp://www.sexetc.org Simplilearn hp://www.simplilearn.com/ SimplyCircle hps://my.simplycircle.com/users/sign_in

26 2018 STATE OF EDTECH SECURITY SURVEY, COMMON SENSE PRIVACY EVALUATION INITIATIVE commonsense.org/educaon/privacy (connued) Vendor URL Signal Vine hps://v3.signalvine.com/auth/login Sibme hps://app.sibme.com/users/login Shedd Aquarium hps://www.sheddaquarium.org/plan-a-visit/login/ Skilljar hps://dashboard.skilljar.com/login?next=%2F Skillset hps://www.skillset.com/login Skype in the classroom hps://login.live.com Skoolbo hps://www.skoolbo.com/login Simplisico hps://www.simplisico.com Skooli hps://www.skooli.com/login SIMTICS Sonography hps://www.simcs.com/login/?ReturnUrl=%252f SMART amp hps://www.smartamp.com/signin?state=00_OSSwuzsksLmEAAA Shuerfly hps://www.shuerfly.com/forwardingSignin/start.sfly?forwardToURL=/nav/mysfly. Skyward hps://www.skyward.com/parents-and-students Snap Learning hps://www.snaplearning.co/ Socrave hps://b.socrave.com/login/student/ Smart Tutor hps://www2.smarutor.com/studentslogin.asp Smart Tutor hps://www2.smarutor.com/parentslogin.asp?returl=&tkt= Socrave hps://b.socrave.com/login/teacher/ Slader hps://www.slader.com/account/login/ So Chalk hps://www.sochalkcloud.com/login Source Forge hps://sourceforge.net/auth/ Socrac hp://socrac.org/ Soundtrap AB hps://www.soundtrap.com Sophia hp://www.sophia.org Sown to Grow hps://www.sowntogrow.com/login Sparknotes hps://www.sparknotes.com/login SpaalNote hps://accounts.spaalnote.com/ SplashTop hps://my.splashtop.com/login?plaorm=web&page=home&_ga=2.158642297.219848543. Speakaboos hps://www.speakaboos.com/signin?redirect=hps://www.speakaboos.com/ Sofatutor hp://www.sofatutor.com/ Spelling City hps://www.spellingcity.com/Log-yourself-in.html SpringBoard hps://springboard.collegeboard.org/ ST Math hps://web.stmath.com/entrance/jijiconsole.html Square hps://squareup.com/login SimpleK12 hp://simplek12.com Splash Math hps://www.splashmath.com/ Standards Planner hps://app.standardsplanner.com/home/login?ReturnUrl=%2faccount%2flogoff Stackup hps://manager.stackup.net/Account/Login?ReturnUrl=%2faccount%2flogin%2f Starfall hps://secure.starfall.com/memb/login1.php Start.me hps://start.me/users/sign_in Star Wars hp://www.starwars.com STEM Scopes hps://login.acceleratelearning.com/ STEM Fuse hps://educate.stemfuse.com/user/login Stopit hps://appweb.stopitsoluons.com/login Student Lap Tracker hps://www.laptracker.net/sign-in?ReturnUrl=%2F Storybird hps://storybird.com/accounts/login/ Studies Weekly hps://app.studiesweekly.com/online/

CREATIVE COMMONS ATTRIBUTION 2018 STATE OF EDTECH SECURITY SURVEY, COMMON SENSE PRIVACY EVALUATION INITIATIVE 27 4.0 INTERNATIONAL PUBLIC LICENSE (connued) Vendor URL Storyboard That hps://www.storyboardthat.com/account/logon Study hps://www.intel.com Studio Code hps://studio.code.org/users/sign_in Story Shares Hub hps://campus.stormwindstudios.com/ Student CPR hps://www.protrainings.com/en/login?from_course_id=37&_pt_uuid=eadf9df7-8b26-4 Sterling Pixels hps://www.pixelsed.com/#/login Studioweb hps://cloud.studioweb.com/ StudySoup hp://studysoup.com Studyo hp://app.studyo.co/ Study.com hps://study.com/academy/login.html STEMKids Classes hps://stemkids.co.uk/my-account/ StudyBlue hp://www.studyblue.com/ Subtracmals hps://data.teachley.com/login/ sumdog hps://www.sumdog.com/user/sign_in Sumo Paint hps://www.sumopaint.com/signin/ Super Kids Reading hps://teachers.rowlandreading.org/teachers/tp2Index.html#login?ReturnUrl=%2f Sutori hps://www.sutori.com/login Survey Monkey hps://www.surveymonkey.com/user/sign-in/ Sutori hps://www.sutori.com/teachers Swivl Cloud hps://cloud.swivl.com/login Sycamore School hps://app.sycamoreschool.com/index.php?cid= Tackk hps://www.smore.com/3qzq2-tackk Symphony Math hps://adminpanel.symphonylearning.com/ng2/ Taking IT Global hps://www.gweb.org/members/login.html?pushpath=www.gweb.org%2F TakeLessons hps://takelessons.com/login TakeLessons.com hps://takelessons.com/login Sylvan Paper hps://www.sylvanpaper.sylvanlearning.com/login TalkingPoints hp://app.talkingpts.org/login?_ga=2.185147113.1171192418.1529334828-554585828. TE21 hps://www.eadms.com/EADMSX/SignIn.aspx?ReturnUrl=/eadmsx/ TE21 hps://app.masteryconnect.com/login teachable hps://teachable.com/login Tales2Go hps://www.tales2go.com/audiobook-desktop-player/ Teachboost hps://teachboost.com/login TeacherCal hps://www.edusync.us/ TCI hps://student.teachtci.com/student/sign_in TCI hps://subscripons.teachtci.com/staff/sign_in Teacher Tube hp://www.teachertube.com Teachermate hps://www.tutormate.org/users/sign_in Teachers Pay Teachers hps://www.teacherspayteachers.com/Login TeacherEase hps://www.teacherease.com/common/login.aspx Teachers Discovery hps://www.teachersdiscovery.com/member_login TeachersPayTeachers hps://www.teacherspayteachers.com/Login Teaching Tolerance hps://www.tolerance.org/login?desnaon=/ Team(You) hp://school.teamyou.co/ TeamLearn hps://teamlearn.me/ Teachley hps://data.teachley.com/login/ Teachers.io hps://teachers.io/login

28 2018 STATE OF EDTECH SECURITY SURVEY, COMMON SENSE PRIVACY EVALUATION INITIATIVE commonsense.org/educaon/privacy (connued) Vendor URL Teachstone hps://dashboard.teachstone.com/users/login TenMarks hps://www.tenmarks.com/login TenMarks hps://www.tenmarks.com/login/user TechSmith hps://signin.techsmith.com/?wa=wsignin1.0&wtrealm=hps%3a%2f%2fwww.techsmith. Tes Teach hps://www.tes.com/lessons TED-Ed hps://auth.ted.com/session/new TES hp://www.tes.com Texthelp hps://essenals.texthelp.com/ TestRocker hps://www.testrocker.com/login The American Academy hps://www.theamericanacademy.com/user Testbook hps://testbook.com/login?le=login&modal=true&redirect_url=/ The Graide Network hp://app.thegraidenetwork.com/login The Earth Rangers Shop hps://www.theearthrangersshop.com/account/login The Washington Post hps://www.washingtonpost.com ThemeSpark hps://www.themespark.net/login The Virtual High School hp://go.thevhs.org/courses The Public Square Academy hps://praccalacademics.instructure.com/login/canvas Thinkster Maths hps://studentapp.hellothinkster.com/login Thingiverse hps://accounts.thingiverse.com/ Think Cerca hps://learn.thinkcerca.com/ Thinkful hps://dashboard.thinkful.com/ Thrively hps://www.thrively.com/login Thinglink hps://www.thinglink.com/acon/account Time For Kids hps://www.meforkids.com/login/ Time To Know hps://global.echo.metoknow.com/login.html TinyTap hps://www.nytap.it/account/login/ Tinkercad hps://www.nkercad.com/auth/shadowbox_fullscreen TinkerEd hps://nkered.co/teachers/sign_in Todo Math hps://secure.todomath.com/classroom/signin Tizmos hps://www.zmos.com/user_sessions/new Top Hat hps://app.tophat.com/login Trevor Space hp://www.trevorspace.org TreeRing hps://www.treering.com/signin Treehouse hps://teamtreehouse.com/signin?return_to=%2F Trovvit hps://app.trovvit.com/ Topper Learning hps://www.topperlearning.com/sign-in Trinket hps://trinket.io/login Turnin hp://www.turnin.com/login_page.asp?lang=en_us Turnin Feedback Studio hps://turnin.com/login_page.asp Turning Technologies hps://account.turningtechnologies.com/account/ Tutor Me hps://tutorme.com/ Tutor Matching Service hps://tutormatchingservice.com/#/login?redirectTo=home Tutorcruncher hps://secure.tutorcruncher.com/the-home-tutor/login/ Twier hps://twier.com/login TuvaLabs hp://www.tuvalabs.com/ Twoo hps://www.twoo.com/?login=1 Tynker hps://www.tynker.com/#/sign-in-student/

CREATIVE COMMONS ATTRIBUTION 2018 STATE OF EDTECH SECURITY SURVEY, COMMON SENSE PRIVACY EVALUATION INITIATIVE 29 4.0 INTERNATIONAL PUBLIC LICENSE (connued) Vendor URL Tynker hps://www.tynker.com/#/sign-in-teacher/ Typing Agent hps://app.typingagent.com/ Typing.com hps://www.typing.com/student/login Typing.com hps://www.typing.com/teacher/login Tweentribune hps://www.tweentribune.com/accounts/login/ UMU Mobile Learning hps://www.umu.com/auth/login?#/login TUNEin to READING hps://www.tuneintoreading.com/my-account/ UpSwing hps://upswing.io/select-school/ UpSwing hps://upswing.io/login Unicon hps://www.unicon.net/user/login Varsity Tutors hps://www.varsitytutors.com/login USEED hps://useed.net/admins/sign_in Valore Books hps://www.valorebooks.com/YourAccount.do Twig hps://www.twigcarolina.com/user/login/?next=/ Versal hps://versal.com/signin Vernier hps://www.vernier.com/account/ Verso Learning hps://v2.versoapp.com/login Verbling hp://verbling.com/ Videolicious hps://dashboard.videolicious.com/login VidCode hps://app.vidcode.com/signin?utm_source=home_nav Vocabulary.com hps://www.vocabulary.com/login/ VivaLing hps://vivaling.com/wp-login.php Tutortube hps://www.tutortube.com/login/ VitalSource hps://www.vitalsource.com/login VIF Curriculum hps://www.parcipate.com/login VocabularySpellingCity hps://www.spellingcity.com/Log-yourself-in.html The Achievement Network hp://my.achievementnetwork.org/ VoiceThread hps://voicethread.com/login/ Voyager Sopris hps://clc.voyagersopris.com/#nletrs TalentEd hps://unify.performancemaers.com/ Voki hp://www.voki.com/ Voyager Sopris hps://elibrary.voyagersopris.com/welcome.do Vocabularya-z hp://www.vocabularya-z.com Voxy hps://app.voxy.com/go/login VYOND hps://ga.vyond.com/login Walkabouts hps://www.acvedinc.com/acved/user Waterford hps://manager.waterford.org/LoginPage.html Waterford hps://www.curriculet.org/login/ Weebly hps://www.weebly.com/in#login Watchkin hps://watchkin.com/ Wikihow hp://www.wikihow.com Wildtangent hp://www.wildtangent.com Wix hps://users.wix.com/signin?loginDialogContext=login&referralInfo=HEADER&postLo WeVideo hps://www.wevideo.com/sign-in Wisewire hps://plaorm.wisewire.com/login?__hstc=70585039.305f50a14885742f67eb988ea277 Wixie hps://wixie.com/sitelogin Wiki Watershed hps://wikiwatershed.org/wp-login.php

30 2018 STATE OF EDTECH SECURITY SURVEY, COMMON SENSE PRIVACY EVALUATION INITIATIVE commonsense.org/educaon/privacy (connued) Vendor URL

Wonder Workshop hps://www.makewonder.com/ Woot Math hps://www.wootmath.com/ Wisewire hps://www.wisewire.com/user-login/ Wizer hps://app.wizer.me/login Wolframalpha hps://account.wolfram.com/auth/sign-in Wordplay hps://wordplay.com/login WizIQ hps://www.wiziq.com/sign-in/ Wnyc hp://www.wnyc.org Wowzers hps://login.wowzers.com/users/sign_in Word Voyage hps://wordvoyage.com/wv-vocabulary/wv-login.php WriteLab hps://app.writelab.com/accounts/login/?next=/ WorldVuze hps://www.worldvuze.com/ Write The World hps://www.writetheworld.com/users/sign_in Write About hps://www.writeabout.com/signin/ WyzAnt hp://www.wyzant.com Xmile Learning hps://xms.xmile.com.br/ Workbench hp://www.workbenchplaorm.com Yahoo hps://login.yahoo.com XtraMath hps://xtramath.org/#/signin/student_other XtraMath hps://xtramath.org/#/signin/teacher_other YouTube hps://www.youtube.com/signin YouthTruth Student Survey hps://youthtruth.surveyresults.org/clients/sign_in Youtopia hps://www.youtopia.com/users/sign_in Zendesk hps://www.zendesk.com/login/ YouSeeU hps://www.youseeu.com/login/ Zilla Dog hps://zilladog.net/Default.aspx?t=131737204437417500 ZipBooks hps://app.zipbooks.com/login ZuKnow hps://dashboard.zorbitsmath.com/#/ Zinc Reading Labs hp://games.zinclearninglabs.com/ ZipGrade hps://www.zipgrade.com/login/ ZyBooks hps://zybooks.zyante.com/#/signin Zooniverse hps://www.zooniverse.org/ Zulama hps://app.zulama.com/login Word Lab Web hps://www.wordlabweb.org/admin TutorVista hp://www.tutorvista.com/

CREATIVE COMMONS ATTRIBUTION 2018 STATE OF EDTECH SECURITY SURVEY, COMMON SENSE PRIVACY EVALUATION INITIATIVE 31 4.0 INTERNATIONAL PUBLIC LICENSE ABOUT COMMON SENSE

Common Sense is a nonprofit, nonparsan organizaon dedicated to improving the lives of kids, families, and educators by providing the trustworthy informaon, educaon, and independent voice they need to thrive in a world of media and technol- ogy. Our independent research is designed to provide parents, educators, health organizaons, and policymakers with reliable, independent data on children’s and student’s use of media and technology and the impact it has on their physical, emoonal, social, and intellectual development.

For more informaon, visit commonsense.org/educaon/privacy.

For inquiries, contact [email protected].

32 2018 STATE OF EDTECH SECURITY SURVEY, COMMON SENSE PRIVACY EVALUATION INITIATIVE commonsense.org/educaon/privacy OUR OFFICES

San Francisco Headquarters 650 Townsend Street, Suite 435 San Francisco, CA 94103 (415) 863-0600

Washington, D.C. Office 2200 Pennsylvania Avenue NW 4th Floor East Washington, D.C. 20037 (202) 350-9992

New York Office 575 Madison Avenue New York, NY 10022 (212) 315-2138

Los Angeles Office 1100 Glendon Avenue, 17th Floor Los Angeles, CA 90024 (310) 689-7535

www.commonsense.org

© 2018 Common Sense Media. All rights reserved. Common Sense, associated names, associated trademarks, and logos are trademarks of Common Sense Media, a 501(c)(3) nonprofit organizaon, FEIN 41-2024986.