Privacy-by-Design in AI-Powered Online Tutoring: A Framework for GDPR-Compliant Learning Analytics for Children
Keywords:
Privacy-by-Design, children’s data protection, online tutoring, GDPRAbstract
Introduction: The rapid growth of online tutoring has created demand for artificial intelligence (AI) tools that monitor learner engagement and support tutors’ instructional decisions. Many engagement-analytics systems, however, rely on video surveillance, facial and emotion recognition and continuous behavioral tracking, which raises serious concerns for children’s privacy and rights. Methods. The study combines doctrinal analysis of the General Data Protection Regulation (GDPR), the EU Artificial Intelligence Act, international standards on children’s rights in the digital environment and Georgia’s 2023 Law on Personal Data Protection with the Privacy-by-Design approach. From this analysis it derives a conceptual framework for privacy-preserving engagement analytics and applies it to a qualitative single case study of a voice-only AI tutoring assistant that operates without video capture, facial recognition or emotion inference. Results. The framework comprises seven design principles: modality minimisation, pedagogical purpose binding, human oversight with non-evaluative outputs, ephemerality, visible presence with child-legible transparency, control by default and an accountable supply chain. The case study shows that most principles can be embedded in system architecture, while residual risks remain in raw audio retention, third-party processing and age-appropriate transparency. Conclusions. Educational AI can provide meaningful pedagogical support without intrusive surveillance when privacy constraints are treated as design requirements rather than as compliance afterthoughts. The framework offers practical guidance for educational technology developers, tutoring providers, regulators and policymakers, including those in EU candidate countries aligning national law with the EU data protection acquis.
References
Andrejevic, M., & Selwyn, N. (2020). Facial recognition technology in schools: Critical questions and concerns. Learning, Media and Technology, 45(2), 115–128. https://doi.org/10.1080/17439884.2020.1686014
Article 29 Data Protection Working Party. (2017). Guidelines on data protection impact assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679 (WP 248 rev.01). European Commission.
Barrett, L. F., Adolphs, R., Marsella, S., Martinez, A. M., & Pollak, S. D. (2019). Emotional expressions reconsidered: Challenges to inferring emotion from human facial movements. Psychological Science in the Public Interest, 20(1), 1–68. https://doi.org/10.1177/1529100619832930
Bygrave, L. A. (2017). Data protection by design and by default: Deciphering the EU’s legislative requirements. Oslo Law Review, 4(2), 105–120. https://doi.org/10.18261/issn.2387-3299-2017-02-03
Cavoukian, A. (2009). Privacy by design: The 7 foundational principles. Information and Privacy Commissioner of Ontario. https://www.ipc.on.ca/wp-content/uploads/resources/7foundationalprinciples.pdf
Committee on the Rights of the Child. (2021). General comment No. 25 (2021) on children’s rights in relation to the digital environment (CRC/C/GC/25). United Nations. https://www.ohchr.org/en/documents/general-comments-and-recommendations/general-comment-no-25-2021-childrens-rights-relation
D’Mello, S., Dieterle, E., & Duckworth, A. (2017). Advanced, analytic, automated (AAA) measurement of engagement during learning. Educational Psychologist, 52(2), 104–123. https://doi.org/10.1080/00461520.2017.1281747
Drachsler, H., & Greller, W. (2016). Privacy and analytics: It’s a DELICATE issue. A checklist for trusted learning analytics. In Proceedings of the Sixth International Conference on Learning Analytics & Knowledge (pp. 89–98). Association for Computing Machinery. https://doi.org/10.1145/2883851.2883893
European Council. (2023, December 15). European Council meeting (14 and 15 December 2023): Conclusions. Council of the European Union. https://www.consilium.europa.eu/
European Data Protection Board. (2019, August 22). Facial recognition in school renders Sweden’s first GDPR fine [News release]. https://www.edpb.europa.eu/news/national-news/2019/facial-recognition-school-renders-swedens-first-gdpr-fine_en
European Data Protection Board. (2020). Guidelines 4/2019 on Article 25: Data protection by design and by default (Version 2.0). https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_201904_dataprotection_by_design_and_by_default_v2.0_en.pdf
European Parliament & Council of the European Union. (2016). Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). Official Journal of the European Union, L 119, 1–88. http://data.europa.eu/eli/reg/2016/679/oj
European Parliament & Council of the European Union. (2024). Regulation (EU) 2024/1689 of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Official Journal of the European Union, L 2024/1689, 12 July 2024. http://data.europa.eu/eli/reg/2024/1689/oj
European Union. (2014). Association Agreement between the European Union and the European Atomic Energy Community and their Member States, of the one part, and Georgia, of the other part. Official Journal of the European Union, L 261, 4–743.
Fredricks, J. A., Blumenfeld, P. C., & Paris, A. H. (2004). School engagement: Potential of the concept, state of the evidence. Review of Educational Research, 74(1), 59–109. https://doi.org/10.3102/00346543074001059
Hevner, A. R., March, S. T., Park, J., & Ram, S. (2004). Design science in information systems research. MIS Quarterly, 28(1), 75–105. https://doi.org/10.2307/25148625
Hoepman, J.-H. (2014). Privacy design strategies. In N. Cuppens-Boulahia, F. Cuppens, S. Jajodia, A. Abou El Kalam, & T. Sans (Eds.), ICT systems security and privacy protection (pp. 446–459). Springer. https://doi.org/10.1007/978-3-642-55415-7_38
Human Rights Watch. (2022). “How dare they peep into my private life?”: Children’s rights violations by governments that endorsed online learning during the Covid-19 pandemic. https://www.hrw.org/report/2022/05/25/how-dare-they-peep-my-private-life/childrens-rights-violations-governments
Information Commissioner’s Office. (2020). Age appropriate design: A code of practice for online services. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/childrens-code-guidance-and-resources/age-appropriate-design-a-code-of-practice-for-online-services/
Kitto, K., & Knight, S. (2019). Practical ethics for building learning analytics. British Journal of Educational Technology, 50(6), 2855–2870. https://doi.org/10.1111/bjet.12868
Livingstone, S., Stoilova, M., & Nandagiri, R. (2019). Children’s data and privacy online: Growing up in a digital age. An evidence review. London School of Economics and Political Science. https://eprints.lse.ac.uk/101283/
Pardo, A., & Siemens, G. (2014). Ethical and privacy principles for learning analytics. British Journal of Educational Technology, 45(3), 438–450. https://doi.org/10.1111/bjet.12152
Parliament of Georgia. (2023). Law of Georgia on Personal Data Protection (No. 3144-XIმს-Xმპ), adopted 14 June 2023, consolidated version as amended. Legislative Herald of Georgia. https://matsne.gov.ge/en/document/view/5827307
Selwyn, N. (2019). What’s the problem with learning analytics? Journal of Learning Analytics, 6(3), 11–19. https://doi.org/10.18608/jla.2019.63.3
Slade, S., & Prinsloo, P. (2013). Learning analytics: Ethical issues and dilemmas. American Behavioral Scientist, 57(10), 1510–1529. https://doi.org/10.1177/0002764213479366
Spiekermann, S. (2012). The challenges of privacy by design. Communications of the ACM, 55(7), 38–40. https://doi.org/10.1145/2209249.2209263
van der Hof, S. (2016). I agree, or do I? A rights-based analysis of the law on children’s consent in the digital world. Wisconsin International Law Journal, 34(2), 409–445.
Veale, M., & Zuiderveen Borgesius, F. (2021). Demystifying the draft EU Artificial Intelligence Act. Computer Law Review International, 22(4), 97–112. https://doi.org/10.9785/cri-2021-220402
Williamson, B. (2017). Big data in education: The digital future of learning, policy and practice. SAGE.
Yin, R. K. (2018). Case study research and applications: Design and methods (6th ed.). SAGE.
Zuboff, S. (2019). The age of surveillance capitalism: The fight for a human future at the new frontier of power. PublicAffairs.
Downloads
Published
How to Cite
Issue
Section
License
This work is licensed under a Creative Commons Attribution 4.0 International License.
This journal provides immediate open access to its content on the principle that making research freely available to the public supports a greater global exchange of knowledge.
Articles published in the Health Policy, Economics and Sociology are licensed under a Creative Commons Attribution 4.0 International (CC BY 4.0) License. You are free to share and adapt the material for any purpose, even commercially, provided you give appropriate credit to the original author(s) and the source.
ჟურნალი უზრუნველყოფს დაუყოვნებელ ღია წვდომას მის შინაარსზე იმ პრინციპით, რომ კვლევის შედეგების საჯაროდ ხელმისაწვდომობა ხელს უწყობს ცოდნის გლობალურ გაცვლას.
ჟურნალში გამოქვეყნებული სტატიები ვრცელდება Creative Commons Attribution 4.0 International (CC BY 4.0) ლიცენზიით. თქვენ უფლება გაქვთ გაავრცელოთ ან გამოიყენოთ მასალა ნებისმიერი (მათ შორის კომერციული) მიზნით, იმ პირობით, რომ მიუთითებთ ავტორ(ებ)ს და პირველწყაროს.
