Selected Papers of #AoIR2023: The 24th Annual Conference of the Association of Internet Researchers Philadelphia, PA, USA / 18-21 Oct 2023 Suggested Citation (APA): Kumar, P.C., & Hyde, L. (2023, October). Exploring how U.S., K-12 education addresses privacy literacy. Paper presented at AoIR2023: The 24th Annual Conference of the Association of Internet Researchers. Philadelphia, PA, USA: AoIR. Retrieved from http://spir.aoir.org. EXPLORING HOW U.S. K-12 EDUCATION ADDRESSES PRIVACY LITERACY Priya C. Kumar Pennsylvania State University, College of Information Sciences and Technology Lily Hyde Pennsylvania State University, College of Information Sciences and Technology Introduction As children grow up immersed in digital environments, scholars and policymakers emphasize the importance of helping children learn how to navigate privacy online (Culver & Grizzle, 2017; Livingstone et al. 2020). Educators recognize this need for privacy lessons but do not always feel equipped to teach them (Kumar et al., 2019). Indeed, the term “privacy” has many meanings, and the concept of privacy does not easily fit in a specific subject, intersecting with social studies, computer science, media literacy, digital literacy, and digital citizenship (Kumar & Byrne, 2022). Scholars have begun developing frameworks for privacy education (e.g., Kumar & Byrne, 2022; Livingstone et al. 2020), but such efforts will have a higher chance of success if they can be integrated into existing educational standards. Thus, in this study we are analyzing U.S. K-12 educational standards to understand whether and how they address privacy literacy. Background: What is privacy literacy? The spread of digital media technologies into many facets of everyday life, especially among children and young adults, has given rise to several “new” literacies (Ito et al., 2009). These include making sense of information across a variety of media forms, navigating the social norms of different digital environments, and creating media within or across multiple platforms. New literacies acknowledge connections between digital interactions and privacy, for instance, through recognizing that digital technologies facilitate public and private communication. But the concept of privacy literacy as a distinct subset of new literacies is relatively recent. Initial conceptualizations of privacy literacy emphasized knowledge of specific facts (e.g., how to adjust privacy settings) or processes of critical thinking (e.g., reflecting before posting online) and were not specific to children (Kumar et al., 2020). To shift privacy literacy beyond a focus on individual knowledge and decision-making and toward an understanding of privacy as dynamic and socially driven, Kumar et al. (2020) define privacy literacy as a “practice of enacting appropriate information flows” when engaging in digital interactions (p. 175). This draws on Nissenbaum’s (2010) conception of privacy as the appropriate flow of information, which, while popular in academic circles,1 is not how the wider public is used to thinking about privacy (Auxier et al., 2019). Thus, if the privacy-literacy-as-enacting-appropriate-flows approach is to take root in education, we first need to understand how schools currently teach privacy literacy and then identify areas of alignment between existing educational efforts and this new approach to privacy. Methods To determine whether states have educational standards related to privacy literacy, we searched for standards in relevant subjects, primarily digital literacy/citizenship, technology, and computer science. We focused on standards that applied to all students, rather than standards that applied only to students who enrolled in an elective subject, since any privacy-related information in the latter would not reach all students. We began by searching each U.S. state’s department of education website for relevant standards, which yielded results for 24 states. We then searched for relevant standards through Google searches, which yielded relevant standards for another 24 states. For the final two states, we found no relevant standards. In our initial analysis, we categorized the standards based on their status (e.g., proposed, in effect), the school subjects they fit into, and topics in which they discuss privacy. We then began reviewing the implemented standards to understand how education policymakers conceptualize privacy for students. Our analysis is ongoing, and we present preliminary findings below. Preliminary Findings Of the 50 U.S. states, we found 44 have implemented educational standards related to privacy, four have guidance or proposed standards related to privacy, and two do not appear to have standards related to privacy. The school subjects that these standards fit into vary across states but primarily comprise library, computer science, and social studies. Of the 44 states with implemented standards, 36 explicitly mention privacy. For instance, Massachusetts integrates privacy into the concepts of safety and security, network systems operations, and ethics and laws. Similarly, Idaho integrates privacy into standards related to describing ethical issues, discussing trade-offs, and analyzing regulation. The remaining eight states do not use the term “privacy” but cover topics similar to the other standards, such as password practices, data ethics, and digital citizenship. For instance, Alabama’s technology education standards include “protecting personal information online” in the digital citizenship criteria from kindergarten through 12th grade. 1 For instance, see the annual Symposium on Applications of Contextual Integrity: https://privaci.info/ https://privaci.info/ Overall, the main privacy-related topics in state standards include being careful about posting information online and managing passwords. Most standards approach privacy education as instructing students on “what not to do” rather than on helping them learn how to navigate privacy issues in digital environments, despite the fact that scholars advise against this “do’s and don’ts” approach to privacy education (Kumar et al., 2018; 2020). This suggests that recently developed privacy education frameworks (e.g., Kumar & Byrne, 2022; Livingstone et al. 2020) may help educators bring a more nuanced approach to privacy into their classrooms. Next Steps and Proposed Contribution Based on this initial analysis, we are developing a codebook related to our research questions, which we will then use to code the text of the standards. Our analysis will examine what specific aspects of privacy are covered in state educational standards and what privacy-related outcomes or abilities these standards require students to demonstrate. We will also apply our codebook to discipline-specific standards that correspond to the subjects in which privacy is taught, including library (AASL, 2018) and computer science (CSTA, 2017; ISTE, 2018), and compare how they align with individual state standards. One of our goals is to understand whether and what kind of differences arise when privacy is taught from a digital citizenship perspective compared to a computer science/security perspective. Comparing state and disciplinary standards will also shed light on who in schools is expected to teach children about privacy (e.g., librarian, computer science teacher) and what kind of professional development efforts may help ensure that the people in those roles feel equipped to teach privacy-related topics. Our analysis will also examine how privacy is taught across grade levels. In our initial analysis, we observed different approaches across states. For instance, the Alabama standards mentioned in the previous section incorporate privacy-related information across the entire K-12 span, whereas a few other states limit privacy-related lessons to middle or high school. Our goal is to illustrate what and how students are learning about privacy across their trajectory through primary and secondary education. This will be useful to inform the development of privacy-focused educational resources. Taken together, these analyses will contribute a comprehensive picture of what expectations for privacy education exist across the U.S. Scholars involved in developing privacy literacy efforts can then tailor their work toward meeting these standards or advocating for changes that reflect the kinds of privacy lessons important for children who grow up immersed in digital environments. References American Association of School Librarians (AASL) (Ed.). (2018). National school library standards for learners, school librarians, and school libraries. ALA Editions, an imprint of the American Library Association. Auxier, B., Rainie, L., Anderson, M., Perrin, A., Kumar, M., & Turner, E. (2019). Americans and privacy: Concerned, confused and feeling lack of control over their personal information. Pew Research Center. https://www.pewresearch.org/internet/2019/11/15/americans-and-privacy- concerned-confused-and-feeling-lack-of-control-over-their-personal-information/ Computer Science Teachers Association (CSTA). (2017). CSTA K-12 computer science standards. Retrieved from http://www.csteachers.org/standards. Culver, S. H., & Grizzle, A. (2017). Survey on privacy in media and information literacy with youth perspectives (Vol. 18). UNESCO. https://unesdoc.unesco.org/ark:/48223/pf0000258993 International Society for Technology in Education (ISTE). (2018). ISTE national educational technology standards (NETS). Eugene, OR. www.iste.org/standards/iste-standards-for-teachers Ito, M., Horst, H., Bittanti, M., boyd, d., Herr-Stephenson, B., Lange, P. G., Pascoe, C. J., & Robinson, L. (2009). Living and learning with new media: Summary of findings from the digital youth project. MIT Press. Kumar, P. C., & Byrne, V. L. (2022). The 5Ds of privacy literacy: A framework for privacy education. Information and Learning Sciences, 123(7/8), 445–461. https://doi.org/10.1108/ILS-02-2022-0022 Kumar, P. C., Chetty, M., Clegg, T. L., & Vitak, J. (2019). Privacy and security considerations for digital technology use in elementary schools. Proceedings of the 2019 CHI Conference on Human Factors in Computing Systems (CHI ’19), 1–13. https://doi.org/10.1145/3290605.3300537 Kumar, P. C., Subramaniam, M., Vitak, J., Clegg, T. L., & Chetty, M. (2020). Strengthening children’s privacy literacy through contextual integrity. Media and Communication, 8(4), Article 4. https://doi.org/10.17645/mac.v8i4.3236 Kumar, P., Vitak, J., Chetty, M., Clegg, T. L., Yang, J., McNally, B., & Bonsignore, E. (2018). Co-designing online privacy-related games and stories with children. Proceedings of the 17th ACM Conference on Interaction Design and Children (IDC ’18), 67–79. https://doi.org/10.1145/3202185.3202735 Livingstone, S., Stoilova, M., & Nandagiri, R. (2020). Data and privacy literacy: The role of the school in educating children in a datafied society. In D. Frau-Meigs, S. Kotilainen, M. Pathak-Shelat, M. Hoechsmann, & S. R. Poyntz (Eds.), The handbook of media education research (1st ed., pp. 413–425). Wiley. https://doi.org/10.1002/9781119166900.ch38 Nissenbaum, H. (2010). Privacy in context: Technology, policy, and the integrity of social life. Stanford University Press. https://www.pewresearch.org/internet/2019/11/15/americans-and-privacy-concerned-confused-and-feeling-lack-of-control-over-their-personal-information/ https://www.pewresearch.org/internet/2019/11/15/americans-and-privacy-concerned-confused-and-feeling-lack-of-control-over-their-personal-information/ https://www.pewresearch.org/internet/2019/11/15/americans-and-privacy-concerned-confused-and-feeling-lack-of-control-over-their-personal-information/ http://www.csteachers.org/standards https://unesdoc.unesco.org/ark:/48223/pf0000258993 https://unesdoc.unesco.org/ark:/48223/pf0000258993 http://www.iste.org/standards/iste-standards-for-teachers https://doi.org/10.1108/ILS-02-2022-0022 https://doi.org/10.1108/ILS-02-2022-0022 https://doi.org/10.1145/3290605.3300537 https://doi.org/10.1145/3290605.3300537 https://doi.org/10.17645/mac.v8i4.3236 https://doi.org/10.1145/3202185.3202735 https://doi.org/10.1002/9781119166900.ch38 https://doi.org/10.1002/9781119166900.ch38