PARENT SQUARE AND HOW INNOCENT LEGISLATURE CAN BE DAMAGING

Recently, Clear Creek Amana High School has switched to using Parent Square for communication, a third-party service. Read about privacy policies, data collection and how seemingly fine laws can end up strengthening corporate surveillance (along with corporate profit margins).

Reading (or Better Defined as a Desperate Attempt at Reading) “Recursive” Privacy Policies

Woah, woah, woah. Legislature? Privacy policies? Recursive? I don’t got any idea (or business, rather) with any of this stuff! Or at least, that may be what you’re thinking (unless you’re cool and do in fact know about this stuff). But privacy policies can be more important than you think; despite a lack of emphasis on the “privacy” part of the many policies corporate America has to offer, privacy is still something important that people should consider with the services they use.

Frustration over corporate shenanigans. Graphic by Elliott Cisco.

If you’re unaware, a privacy policy is basically a big ruleset full of legal jargon that defines how a service/company will use your information. (The metaphor of “a big ruleset” is quite hopeful though, as most privacy policies can be more like mazes than clear rulesets.) Privacy policies are, as opposed to terms and conditions, legally required in order to comply with GDPR and/or CCPA laws (if you don’t know what these are, don’t worry; they’re just laws about privacy and data collection). Also, terms and conditions are not privacy policies. Terms and conditions are the rules users should follow when using a service.

So, why are privacy policies important? Well, if a privacy policy says that a service can collect as much information about you as they want and then sell it all, you probably don’t want to use that service. In general, the more information about you that you share (intentionally or not) with third parties, the worse. Now, I don’t want this to be like the scare tactics used in data deletion service advertisements. Yes, tons of information about you is out there, and no, it’s not a super big deal. Yes, Google and Apple and [insert literally any tech company here] probably know your home address, your occupation, how generally wealthy you are, and how likely you are to click on Skibidi Toilet videos. It’s not the end of the world. Still, though, the less you are being surveilled by big corporations who literally only care to make as much money as possible, the better.

So, what does this have to do with Parent Square and legislature? Well, Parent Square has a privacy policy. And to their credit, it’s a pretty good privacy policy. There are some fishy things, such as automatic location collection at city level, and data being permanently retained for “standard business practices” (which could be anything). 

They also track clicks and actions to “improve the Subscription Services” and “personalize your experience,” as well as collecting a lot of sensitive info. Otherwise? Their privacy policy is pretty clear and well laid out.

So, is this the end of the road? Is that all? Oh no no no, you sweet summer child. Because why have one privacy policy when you could have THIRTY-NINE MORE! Thirty-nine more of Parent Square’s privacy policies? No; in a small paragraph in the fifth section, Parent Square mentions that they share some data they collect with 39 other “subprocessors” (basically meaning other companies that process data). They then point out that their privacy policy does not apply when data is at those 39 other subprocessors, and that instead you should read their privacy policies. Now, they do also mention that “those third-party subprocessors must adhere to privacy obligations in a manner consistent with and at least as protective of your personal data as is set forth in this Privacy Policy.” But... “consistent” and “at least” are pretty loose terms, and honestly, I don’t really see why Parent Square would even care what those 39 other subprocessors do with their data (except for school staff-related sensitive things that could get them in actual legal trouble). 

Now, most of those 39 other subprocessors are just payment services (such as PayPal), server maintenance and debug services (such as Rollbar), and social media linking services (such as Facebook). But some of the subprocessors have to do with messaging data, and would likely receive information about messages sent using the service, and perhaps other data. So we go to their privacy policies, read for a bit and then realize that these services also use subprocessors of their own. Great. That means that, while unlikely, it is possible for one piece of information collected by Parent Square to travel this net of privacy policies, going from one subprocessor to another, being saved and tracked and whatever the heck these services do with all that data. It’s practically impossible to read all these privacy policies, and with each privacy policy possibly allowing any amount of tracking and retaining of data, the privacy policy laid out by Parent Square might as well be null. The only protections Parent Square provides is in some pretty legally loose terms (how do you define “consistent with” and “at least” when the thing you are comparing against is an entire privacy policy that has to be interpreted by law?), and it is very much possible that Parent Square is not ensuring that the third-party subprocessors they are sharing data with are actually staying consistent with their privacy policy. Why care when the chances of being sued over this are so little? Lawyers aren’t cheap, and why pay for one if you can just ignore the problem and hedge your bets that some random person isn’t going to sue you over your privacy policy?

Now, if this article was written in Europe, it really wouldn’t exist. GDPR laws (Europe-specific privacy laws) don’t just sit there and wait for a lawsuit to happen. No, instead GDPR laws will actively seek out and attack poor billionaire companies via investigations! Quickly, look away before such a thought drains you of your patriotism! The U.S. has no such laws that are quite as aggressive, and especially under an administration cough like this cough cough it’s very easy for companies to avoid any form of punishment. It is for this reason that the main idea of the previous paragraph is plausible (but still unlikely).

What This All Means

Parent Square, despite a few oddities in its privacy policy, is most certainly fine to use and likely is not a privacy hazard at all. The unlikely scenario in which Parent Square’s subprocessor’s subprocessor’s subprocessor’s

(you get the point) are creating this net of privacy policies in which a few or more are using the collected data for purposes not disclosed in Parent Square’s privacy policy should not be a concern to anyone. It probably isn’t happening, but it still isn’t impossible either. 

You see, the real problem here is that CCA switched over to Parent Square mostly due to a change in legislature. DOJ Order No. 5919-2024 basically says that to ensure that everyone can access and use online services, they should have to be accessible via accessibility features. Now, I highly doubt that CCA could translate, text-to-speech, etc. every single message and notification they send on their own. That is simply unrealistic. So, CCA switched to using Parent Square, a third-party service that can do all that for them. (Now, CCA switching to Parent Square isn’t entirely due to this DOJ order; a brief interview with Principal Thomas Daniel revealed that a more centralized form of communication was something that was desired, and Parent Square fulfilled that.) The DOJ order seems very rational, and is something that most people would probably support. But the DOJ order also influenced CCA to use Parent Square. Imagine a different scenario: a completely normal and beneficial-looking piece of legislature is passed. A bunch of organizations and entities switch to using what seems to be the best option: a third-party service that fulfills the requirements set forth in the legislature. But this third-party service was created in anticipation of this legislature; corporate bribes pushed politicians to pass the law. The new third-party service quickly buys out any competitors, and then becomes malicious. Effectively, it is enforced by law. Yet, it is a corporate entity doing nothing but exploiting those who are practically forced to use it.

Now, this imaginary scenario seems quite grim and dystopian. After all, Parent Square is at most an incredibly weak example of this, twisted into something seemingly far worse by the words of the evil deities that reside within The Anchor newspaper team. But the funny thing is: scenarios like this example have actually happened before. Multiple times. You can search up various examples online, such as offender-funded private probation laws.

The point is: it is important to consider all the possible effects of a piece of legislature, even if it seems perfectly fine. While Parent Square does not cause any problems, it is a very recent example of how seemingly fine legislature can have unknown side effects, and possibly even harmful ones.