Attorney General James and NYSED Commissioner Rosa Secure $750,000 from College Board for Violating Students’ Privacy

NEW YORK – New York Attorney General Letitia James and New York State Education Department (NYSED) Commissioner Betty A. Rosa announced a $750,000 settlement with College Board for violating students’ privacy and unlawfully licensing that personal data to others. For years, College Board collected students’ personal information when they took the PSAT, SAT, and AP exams in school, and then licensed this data to colleges, scholarship programs, and other customers who used it to solicit students to participate in their programs. In 2019 alone, College Board improperly licensed the information of more than 237,000 New York students who took their exams. In addition, College Board improperly sent promotional materials to students who signed up for College Board accounts in connection with exams or AP courses. As a result of today’s agreement, College Board must pay $750,000 in penalties and will be prohibited from monetizing New York students’ data that it acquires through its contracts with New York schools and school districts. 

“Students have more than enough to be stressed about when they take college entrance exams, and shouldn’t have to worry about their personal information being bought and sold,” said Attorney General James. “New York law requires organizations like College Board to protect the data they collect from students when they take their exams in school, not sell it to customers for a profit. I want to thank Commissioner Rosa for her work on this investigation to ensure we hold College Board accountable and protect New York students’ privacy.”   

“When the organizations we trust to provide meaningful services to our students exploit student information for profit, it violates privacy laws as well as the public trust,” said Commissioner Betty A. Rosa. “We will continue to ensure that every student’s information is appropriately utilized and protected. We are grateful to the Attorney General for her collaboration in protecting the interests of the students and families of New York.”

College Board is a New York-based non-profit institution that develops and administers standardized tests, primarily to high school students who take them as part of the college admissions process. It also develops other college readiness programs, such as AP courses, and has a contract with NYSED to subsidize AP exam fees for low-income students. In addition, College Board operates the Student Search Service (Search), in which it licenses data it collects from students — including their names, contact information, ethnicity, GPAs, and test scores — to customers like colleges and scholarship programs to use for recruiting students.

Beginning in 2010, College Board contracted with New York schools and school districts to allow schools to offer the PSAT and SAT exams during the school day and to pay for the students’ exam fees. In the past five years, approximately 20 New York schools or school districts, including the New York City Department of Education, which operates more than 500 high schools, have entered into such contracts. Schools across New York have also consistently signed agreements with College Board to offer AP courses and exams. 

An investigation led by the Office of the Attorney General (OAG) revealed that prior to June 2022, College Board solicited students to provide information, such as their GPA, anticipated course of study, interest in a religiously affiliated college and religious activities, and parents’ level of income, during the administration of PSAT, SAT, and AP exams, as well as when students signed up for a College Board online account. Although providing this data for participation in Search was optional, students were solicited to participate in the urgent context of an important exam and were encouraged to sign up because it would connect them with scholarship and college opportunities. From 2018-2022, College Board licensed New York student data to over 1,000 institutions through Search and received significant revenue from data related to New York students who took PSAT, SAT, or AP exams during the school day.     

The investigation further found that College Board improperly used student data for its own marketing. Until fall 2022, College Board used student data collected in connection with PSAT and SAT exams administered during the school day to send marketing communications. In addition, until 2023, when New York students registered for the AP program, they were solicited to opt in to receiving College Board marketing materials. 

Under New York law, it is illegal to use student data obtained under a contract with a New York educational agency for commercial or marketing purposes. The investigation found College Board improperly used student data obtained in connection with PSAT and SAT exams administered during the school day and the AP program by licensing student data to Search clients and using student data to send its own marketing materials.  

Under the settlement announced today, College Board must pay $750,000 in penalties, disgorgement, and costs to the state. College Board is also prohibited from using New York student data it collects or receives in connection with a contract with a New York educational agency for any marketing or commercial purposes. This includes data obtained from administering PSAT, SAT, or AP exams during the school day. In addition, College Board cannot solicit students to participate in Search or similar programs during these exams.

This matter was handled for OAG by Assistant Attorneys General Laura Mumm, Jina John, and Hanna Baek of the Bureau of Internet and Technology, under the supervision of Bureau Chief Kim Berger and Deputy Bureau Chief Clark Russell, with special assistance from former Special Advisor and Senior Counsel for Economic Justice Zephyr Teachout. The Bureau of Internet and Technology is part of the Division for Economic Justice, which is overseen by Chief Deputy Attorney General Chris D’Angelo and First Deputy Attorney General Jennifer Levy. 

This matter was handled for NYSED by Chief Privacy Officer Louise De Candia and Counsel & Deputy Commissioner for Legal Affairs Daniel Morton-Bentley.