{"resourceId":"arxiv-edtech-privacy-deferral-ai-disclosure-20260923","versions":[{"version":"external-9d37ff0b41620157b91eca3b8141450b1a120c378beb9ac77dc5e75f0dd4d6de","resource":{"id":"arxiv-edtech-privacy-deferral-ai-disclosure-20260923","title":"EdTech privacy deferral study: one-third of 48 platforms give no meaningful AI disclosure despite visible AI features","organization":"Meghna Manoj Nair and Rachel Greenstadt (arXiv preprint authors)","sector":"K-12 education","geography":"US (platform audit; mixed K-12 and other EdTech)","publishedAt":"arXiv preprint submitted 2026-09-23","publicationDate":"2026-09-23","eventDate":null,"sourceName":"arXiv","sourceLabel":"arXiv","sourceUrl":"https://arxiv.org/abs/2609.28137","evidenceClass":"academic-research","outcomeClass":"cautionary","topics":["data-security","governance-procurement"],"finding":"Mixed-methods preprint: 12 interviews with EdTech professionals plus a privacy-policy audit of 48 platforms on five dimensions (mean Cohen's kappa 0.781). Privacy is recognized but deferred; responsibility is delegated to cloud providers, documents or downstream institutions. 33% of platforms make no meaningful AI disclosure despite visible AI features; 73% offer only generic accountability and breach-response language. K-12 platforms do better on children's consent where regulation is explicit, but not on AI governance or accountability.","sledRelevance":"Directly bears on district approved-tool processes now being mandated (Frederick County, Utah): vendor policies may not disclose AI use well enough to approve tools.","evidence":"Abstract page inspected; full paper not reviewed; preprint not peer reviewed.","architectureImplications":"Districts cannot rely on vendor privacy policies alone; technical review of data flows is needed.","governanceImplications":"Supports contractual AI-disclosure and accountability requirements rather than voluntary commitments.","securityPrivacyImplications":"Generic breach-response language leaves districts uncertain about incident handling for AI features.","caveats":"Preprint, not peer reviewed; only the abstract was inspected; 12-interview sample; platform selection and K-12 share not verified.","streamIds":["k12"],"roles":{"sales":"Framing point: vendor paperwork is a weak basis for AI approval. This preprint finds a third of audited EdTech platforms do not meaningfully disclose AI use. For districts building approved-tool lists, a bounded review of vendor AI disclosures and contract terms is a credible offer. Avoid overstating: it is a 48-platform preprint and cannot certify any specific vendor as unsafe.","engineering":"Framing point: verify data flows, not policies. Because disclosures are often missing or generic, pre-sales engineers should propose technical checks: network traffic review, data-processing addenda specifying AI subprocessors, and model-training prohibitions. Fit is strongest where districts already require DPAs. Limits: the study audits policy text, not system behavior.","delivery":"Framing point: build AI disclosure into the approval gate. Delivery adds a vendor questionnaire and contract clauses on AI features, training use and breach response, with a privacy officer as owner. Acceptance criteria are proposals such as every approved tool having a documented AI disclosure. Risks include questionnaire fatigue and vendors answering generically."},"roleDetails":{"sales":{"customerProblem":"Districts approving tools cannot see whether or how vendors use AI from their privacy policies.","stakeholders":["District privacy officer","Technology director","Procurement","Legal counsel"],"discoveryQuestions":["Do current DPAs address AI features and model training?","How are vendor AI features discovered today?","What breach-response terms exist for AI features?"],"valueHypothesis":"Interpretation: a structured AI-disclosure review may surface gaps before approval.","potentialEngagement":"Bounded review of AI disclosures for a district's top approved tools.","unsupportedClaims":["That any specific vendor is non-compliant","Generalization beyond 48 platforms","Peer-reviewed certainty"]},"engineering":{"fit":"Complements DPA-based approval processes.","architectureIntegration":"Add AI-subprocessor and data-flow checks to tool review; optionally network traffic inspection.","prerequisites":["Tool inventory","DPA templates","Privacy review capacity"],"constraints":["Policy-text audit only","Preprint, not peer reviewed","State privacy laws vary"],"security":"Generic breach language implies districts should require specific AI incident notification terms.","proofOfValue":["Compare a vendor's policy disclosure to observed AI features","Test DPA clause coverage on 5 tools"]},"delivery":{"work":"Embed AI disclosure and accountability checks into procurement and approval.","dependencies":["Procurement policy","Legal review","Vendor cooperation"],"ownership":"District privacy officer with procurement.","skillsAdoption":"Reviewers need training to recognize embedded AI features.","governanceCheckpoints":["Pre-approval AI disclosure review","Annual re-review"],"acceptanceCriteria":["Proposed: every approved tool has documented AI disclosure","Proposed: DPAs include AI-specific breach terms"],"risks":["Vendors provide generic answers","Review backlog delays instruction"]}},"retrievedAt":"2026-10-09T22:03:30-05:00","enrichedAt":"2026-10-09T22:20:00-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Limited direct relevance to accessibility.","procurementImplications":"Supports adding AI disclosure clauses to RFPs and DPAs.","operatingModelImplications":"Shifts privacy accountability upstream into procurement.","sourceVerification":{"openedUrl":"https://arxiv.org/abs/2609.28137","referenceExcerpt":"Thirty-three percent make no meaningful Artificial Intelligence (AI) disclosure despite visible AI features, and 73% provide only generic accountability and breach-response language.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}