Canvas is one of the most widely-used learning management systems (LMS) to date, and recently became the flagship LMS on University of Colorado campuses. It has been adopted widely by faculty, who use it as a platform for storing course content, reviewing student submissions, administering quizzes, and grading assignments. For this reason, information in this document concerning the privacy and security of sensitive student information and course content at CU campuses solely addresses Canvas.
Though often viewed as a singular entity, Canvas is actually owned by Instructure, a company that develops learning and employment management software. Along with Canvas, Instructure also oversees an employee development and engagement program called Bridge. Instructure’s privacy policy outlines the rights that the company has to any data stored on its systems, and goes into some detail about the kinds of data they collect, as well as what they use it for. Instructure’s privacy policy states:
“We collect information from you, such as first and last name, gender, e-mail and mailing addresses, phone number, professional title, company name, educational institution or organization name, and password when you provide such information to our Site or to an Instructure employee, or otherwise provide this information to Instructure, such as via email. When you participate in one of our surveys, we may collect additional profile information, such as information indicating your interest in specific Instructure services. We collect information about you when you apply for positions within Instructure. We also collect other types of personal data and demographic information that you provide to us voluntarily. This includes information provided to Instructure employees in the course of routine interactions with them or provided in response to an email from Instructure.”
It should also be noted that Instructure personnel have access to any and all material posted on Canvas, including that which we would regard as being sensitive, or having “high impact”, such as student submissions, grades, discussion posts, and feedback. Additionally, Instructure collects technological data such as browser types, IP addresses, operating systems, domain names, geographic location, and date/timestamp of visit. Instructure uses cookies, web beacons, and URLs to gather information regarding a user’s date and time of a visit and the “solutions and information for which a user has viewed.” As well as the above, Instructure uses analytics software such as Google Analytics to “improve the performance of the site for analytics and marketing purposes.” The sort of information collected from analytics software includes “how often users visit the Site, what pages they visit, and what other sites they used prior to coming to the Site.” Instructure claims that they do not tie the information gathered using third-party analytics sources to personally-identifiable information. In terms of data use, Instructure’s policy is as stated below:
“In general, personal information you submit to us is used either to respond to requests that you make, or to aid us in serving you better. Instructure uses your personal information in the following ways: to create and maintain your account; to identify you as a user in our system; to operate, maintain, and improve our Site, Apps, and Services; to personalize and improve your experience; to send you administrative e-mail; to respond to your comments or inquiries; to protect, investigate, and deter against fraudulent, unauthorized, or illegal activity; and to make telephone calls to you, from time to time, as a part of secondary fraud protection or to solicit your feedback with your permission.”
Instructure may share personal information with affiliates (though they do not have any at the moment), third-party service providers, and/or legal authorities, if necessary. Affiliates who receive this information are subject to conditions identical to those laid out by Instructure’s privacy policy in order to protect sensitive information. In terms of information security, Instructure states that they take “reasonable” steps to help protect personal information, but that no service is able to eliminate the risk of a security breach by 100%.
The majority of survey questions posed to students, faculty, and administrators at University of Colorado schools explore three, distinct themes. These themes include who is able to access certain information on LMSs, the tracking of user activity through the LMS, and the security of information stored within the LMS.
University of Colorado Boulder (CU Boulder), University of Colorado, Colorado Springs (UCCS), and University of Colorado, Denver (CU Denver) will be compared across each theme. The next section of this write-up deals with the first of the themes listed above, in outlining the various roles and permissions at each CU campus as mentioned by its corresponding interviewee, as well as exploring which roles are able to access certain areas/features of Canvas, and how this compares across campuses.
CU LMS Privacy Survey Data Visualizations 