Student learning · Grades 9–12, Higher Ed · 65 minutes
Data Trail Audit
Teams read an AI study app's privacy policy like investigators, map where their data could travel, and choose settings and habits that shrink their trail.
Every app and AI tool students use collects something: what they type, where they are, how long they look, who they talk to. Privacy policies explain much of it, but they are long and written for lawyers. In this audit, teams decode a realistic mock privacy policy for a fictional AI study app, trace how a single data point can travel from the app to partners and data brokers, and then audit a tool they actually use. They leave with a short, evidence-based plan for what to share, what to change in settings, and what to stop typing into chatbots.
In this packet
- Handout A: StudyNest AI Privacy Policy (Excerpt) (reading)
- Handout B: Data Trail Cards (cut-apart cards)
- Handout C: Policy Audit Organizer (organizer)
- Facilitator key (last page)
TCEA ELE indicators
- S2.1 I know how to protect my personal information online.
- S2.3 I am aware of the potential risks of sharing content online.
- AI2.3 I am aware of the importance of transparency and accountability in AI systems.
- AI2.2 I can identify potential ethical issues in AI applications and propose solutions.
Full facilitator guide: mglearn.github.io/eles/activities/data-trail-audit.html
Handout A for Data Trail Audit
StudyNest AI Privacy Policy (Excerpt)
StudyNest is a fictional AI study app. Highlight green (fine), yellow (want to know more), red (worried). Circle vague words.
11. Information you give us. When you create an account, we collect your name, email address, date of birth, and school name. When you use StudyNest's AI tutor, we collect the questions you type, files you upload (such as notes, essays, or photos of homework), and the tutor's responses.
22. Information we collect automatically. We collect your device type, IP address, approximate location, the pages and features you use, how long you use them, and the times you are active. We use cookies and similar technologies to remember you across sessions and across other websites that use our advertising partners.
33. How we use your information. We use your information to provide and personalize the service, to improve our services, including developing and training our AI models, to send you updates and offers, and to keep StudyNest safe.
44. Your conversations. Conversations with the AI tutor are stored for as long as your account is active. Authorized staff and contractors may review a sample of conversations to improve quality and safety. You can delete individual conversations in Settings; deleted conversations may remain in backups for a period of time.
55. Sharing. We may share information with trusted partners who provide services on our behalf, such as hosting and analytics. We may share de-identified or aggregated information with partners for research, marketing, and other business purposes. We do not sell your name or email address.
66. Your choices. You may opt out of marketing emails at any time. You may request deletion of your account by contacting support. Users in some locations may have additional rights under local law.
77. Business transfers. If StudyNest is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.
88. Age. StudyNest is intended for users 13 and older. Users under 18 should have permission from a parent or guardian.
99. Changes. We may update this policy from time to time. Continued use of StudyNest after changes means you accept the updated policy.
Handout B for Data Trail Audit
Data Trail Cards
Arrange the cards to tell how one question typed into StudyNest could lead to an ad on a different website. Then flip to check. Print backs separately.
Hop 1
At 11:40 p.m., Riley types into StudyNest: "How do I study for the SAT when I have anxiety and can't sleep?"
Hop 2
StudyNest stores the conversation along with Riley's device, approximate location, and the time.
Hop 3
StudyNest's systems tag Riley's account with interests: "test prep," "sleep," "stress."
Hop 4
A cookie from one of StudyNest's advertising partners records that this browser visited a test-prep study page.
Hop 5
StudyNest shares "de-identified" interest data with a marketing partner. Riley's name is removed, but the device ID and approximate location remain.
Hop 6
A data broker, a company Riley has never heard of, buys data from many apps and websites and combines them into a profile for this device: age range, location, interests.
Hop 7
A company selling sleep supplements buys an audience from the broker: "teens near this area interested in stress and test prep."
Hop 8
The next day, on a gaming website, Riley sees an ad for sleep supplements "for stressed students."
Handout C for Data Trail Audit
Policy Audit Organizer
Quote exact words from each policy. Write "doesn't say" when the policy is silent; that counts as a finding. Write your data plan on the back.
| Tool | What do they collect? (quote) | Why, and who else gets it? (quote) | What can I control? (quote or setting) | Trust rating + reason |
|---|---|---|---|---|
| StudyNest AI (Handout A) | ||||
| Real tool: | ||||
Facilitator only for Data Trail Audit
Answer key and notes
Handout B: Data Trail Cards
- Hop 1
- The question itself holds sensitive clues: a test, a health concern, and a late-night habit. Section 1 says StudyNest collects what you type.
- Hop 2
- Sections 2 and 4. The time and location data are collected automatically; Riley never typed them.
- Hop 3
- Apps commonly label users with interest categories to personalize content and ads. Section 3's "personalize" covers this.
- Hop 4
- Section 2 mentions cookies used "across other websites that use our advertising partners." This is how activity in one place follows you to another.
- Hop 5
- Section 5. Removing a name doesn't always make data anonymous. Combined with other details, a device and location can point back to one person.
- Hop 6
- Data brokers collect information about people from many sources, combine it into profiles, and sell or license those profiles. People often don't know a broker holds information about them.
- Hop 7
- Profiles are sold as audiences for targeted advertising. Riley's late-night question has become part of a marketing category.
- Hop 8
- The trail is complete. Riley never gave permission directly to the broker or the advertiser. Ask: which hop could Riley have interrupted, and how?