New changes to Instructure Privacy Policy

This post is adapted from 12 tweets I made on December 5th, 2019.

Welcome to my fun and chill evening, which I spent diving into the Instructure privacy policy because I like to feel bad 😬

You are now entering the privacy zone! bEwArE

On October 28th, 2019, Instructure updated their Privacy Policy for the first time in a long time. The previous update was on November 17th, 2017. GDPR became law in between these two dates, but the policy wasn’t modified then. So what changed?

Well, they decided to put themselves up for sale. And private data is very valuable! Phil Hill On Ed Tech: Instructure Considering Sale Options

This archive.org link compares the current privacy policy with the previous one: https://web.archive.org/web/diff/20190831203445/20191028201924/https://www.instructure.com/policies/privacy

Really cool new feature by the way, wow!

Worth noting is that they have split up their previous policy into two.

  1. Instructure Product Privacy Policy
  2. Instructure Marketing Privacy Policy

This makes it clearer to bidders how much the data is worth. Which was the point.

So let’s get into it! The changes are not lengthy, and the new archive.org comparison feature has done a wonderful job highlighting what they are. Yellow indicates content deleted, blue indicates content added. Here’s an example screenshot. I only have one more to share.

This screenshot compares changes between the Instructure Privacy Policy before and after October 28th. 2019.

Here’s the big one! 😠

Two things are clarified:

  1. Instructure can use Product data for “its own use” (no more indiscriminate sharing).
  2. Product data (i.e. learning data) won’t be used for advertising or marketing purposes.

This screenshot compares the changes to the "Other Disclosures" area of Instructure's Privacy Policy.

But what has me the most concerned is something that has not changed at all, ever. If Instructure is acquired, all bets are off. They’ll let us know what the new rules are when the time comes.

This screenshot shows the part of Instructure's Privacy Policy which allows them to share personal information in the event of a merger or sale.

That time is now.

Instructure sold itself yesterday for two billion dollars. This is uncharted and treacherous. Previous LMS acquisitions like WebCT and Blackboard were of companies that sold self-hosted LMS products. They didn’t have our data.

Instructure has all our Canvas data, at least for those of us that license the cloud version from them. Soon a private equity firm will have it.

Instructure has 34 days to solicit higher bids before the sale is finalized, so maybe it’ll be Google instead.

It is now almost midnight and this is scarier than ghosts to me. So I will depart with a creepy screenshot from Instructure’s webpage, which emphasizes Openness as a value. Open up, Instructure.

The educational technology community has a LOT of questions for you.
This screenshot from Instructure's About Page states a commitment to transparency.

Leave a Reply

Your email address will not be published. Required fields are marked *