Caribou High School: Student Privacy

In February 2024, we learned that Caribou High School was in the final stages of implementing a plan to fingerprint students to "assist with attendance." We immediately requested all related public records.

Personal data is susceptible to data breaches, but some types of personal information are far more sensitive than others. Biometric identifiers are things like eye scans and fingerprints. These identifiers can be used in many ways, from unlocking a phone to investigating whose fingerprints may be at a crime scene.

Unlike a stolen credit card or email password, you cannot replace your biometrics.

This sensitive information should only be collected when absolutely necessary and only with the person's consent. Any time this information is collected, it must have strong security protections to keep it safe and it should never be stored longer than needed. The risks of identity theft, stalking, and other harms increase when companies store data for long periods or sell people's information to anyone who will buy it, such as advertisers. For example, the ACLU sued ClearView AI after it collected and sold millions of internet users’ information that buyers then used to stalk former partners.

Caribou High School is a public school of roughly 460 students in Regional School Unit (RSU) 39. The district planned to contract with Pennsylvania-based identiMetrics to use its students’ most sensitive information: their biometrics.

A letter from the school's principal announcing the plan did not elaborate on what, if any, data storage protections would be in place, how exactly leaders of the 460-student school believed this would improve operations, or if parents and students would have the choice to opt-in or opt-out.

We promptly filed an open records request under Maine's Freedom of Access Act and alerted media outlets. Within just one day, the school rescinded its plans in response to widespread dissent from across the political spectrum and throughout Maine's urban and rural communities.

We did not retract the records request despite the district's swift action. Caribou High School was the first known school with plans to fingerprint Maine students, so we wanted to learn more about what indentiMetrics may have offered the school and what tactics the company may be using to entice schools to use their surveillance products. Analyzing and sharing this information will prepare parents and districts throughout Maine for similar efforts in their communities.

After reviewing over 200 pages of documents, we found vague privacy guidelines, inconsistent policies around who could access student data, and deceptive marketing practices. View the documents and our records request in the PDFs at the bottom of this page.

1. The contract between identiMetrics and the school was unclear and inconsistent about what student data would be shared with the company and on what terms (Sections 1 and 9).

The signed contract between identiMetrics and RSU 39 explicitly contemplates that student data will be provided to identiMetrics in exchange for services rendered (pages 3-14). The contract also includes exhibits that specify how long identiMetrics will retain student data and what kind of data will be shared, including a student's name, grade level, and ID number (pages 196-198, 201). And the contract includes an exhibit stating that identiMetrics can enter into agreements with other school districts in Maine to change what kinds of data are provided to the company (page 202).

However, the contract also includes exhibits stating that the student data used in the identiMetrics software is hosted by the school district and maintained behind its firewall and that there is no data sharing with identiMetrics (pages 194, 203).

Any time student data is collected for any reason, there must be clear policies stating what information is collected, why it is collected, how it is used, how it is securely stored, how long it will be stored, and how it will be handled when no longer needed.

2. identiMetrics used marketing tactics that supported the school-to-prison pipeline (Section 2, page 16).

The company framed its fingerprint scanners as a tool for "juvenile justice," immediately placing their product in the context of criminalizing children for misbehaving. identiMetrics asserts that working with a school resource officer (SRO) is one way to keep kids out of the pipeline, but numerous studies have proven SROs lead to more students getting entangled in the legal system.

The “school-to-prison pipeline" is a disturbing national trend that funnels students out of public schools and into the juvenile and criminal legal systems. These children disproportionately are Black or Brown, have disabilities, or have histories of poverty, abuse, or neglect. All children misbehave, and they need access to violence intervention, after-school programming, and counselors. Instead, the school-to-prison pipeline isolates, punishes, and pushes kids out. Read more about the school-to-prison pipeline here.

3. Fingerprinting students would cost thousands (page 144).

The school paid $5,135 in upfront costs and planned to pay an additional $2,460 each year after. This money would have been better spent supporting students, teachers, staff, and school facilities. It is particularly concerning that district leaders chose to spend money this way while at the same time writing that it was "budget cut time," according to a March 29, 2024, email (page 28).

4. The school declined a system that would not have used biometrics (page 66).

identiMetrics informed the school of an attendance system that would have used bar codes and names instead of students' biometrics. The school opted for the system that uses students' biometric information.

5. District leaders acknowledged privacy concerns and identiMetrics had talking points to respond to backlash (pages 82-91).

District staff explicitly acknowledged that students, parents, community members, and local elected officials had serious concerns about student privacy. To help RSU 39 respond to the backlash, identiMetrics shared links to resources created by the company asserting the fingerprinting technology is secure and effective.

Across the EdTech industry, many companies use deceptive marketing practices that play upon fears of bullying, school shootings, student self-harm, and more. These are all real dangers that must be addressed, but spying on our students will never be the answer. Read more about these tactics here.