Many online proctoring companies claim GDPR compliance. It is worth asking what that claim actually means, and whether it can be verified.

The short answer is that GDPR compliance claims are largely self-reported. There is no mandatory third-party verification process that a company must pass before making the claim. For organizations choosing a proctoring vendor on the basis of GDPR compliance, this creates a significant due diligence gap.

The US Patriot Act Problem

Many proctoring companies are registered in the United States or store data within US jurisdiction. This creates a direct conflict with GDPR that no privacy policy can resolve.

Data protection laws across the EU prohibit the disclosure of personal data without a data subject's consent or knowledge. The US Patriot Act gives the US government the ability to compel data disclosure from US-based companies or companies storing data on US infrastructure, without that consent and without notifying the individual.

A proctoring company that stores learner data on US servers and claims GDPR compliance is operating under two conflicting legal obligations. When those obligations conflict, US law governs US-based companies. The GDPR claim does not change that.

The Privacy Shield Failure

Many US-based organizations attempted to address this conflict by certifying under the EU-US Privacy Shield program, which was designed to provide a legal mechanism for transatlantic data transfers that satisfied GDPR requirements.

On July 16, 2020, Europe's top court invalidated the EU-US Privacy Shield, finding that the transfer mechanism did not ensure compliance with the level of protection required by EU law. The certification that many companies had pointed to as evidence of GDPR compliance was rendered invalid overnight.

The EU-US Data Privacy Framework: A Replacement With Familiar Weaknesses

Following the 2020 decision, negotiations between the EU and the US produced a new framework. On July 13, 2023, the US Department of Commerce launched the Data Privacy Framework program, intended to allow eligible US companies to self-certify their participation in the EU-US Data Privacy Framework.

The mechanism for self-certification is a short questionnaire and a fee to the US International Trade Administration, ranging from $375 to $4,875 USD depending on the company's revenue.

Critics have already noted that the new framework faces the same fundamental shortcomings as its Privacy Shield predecessor, including the unresolved tension between US surveillance law and EU privacy rights. Self-certification through a paid questionnaire does not resolve the underlying Patriot Act conflict.

What Meaningful GDPR Compliance Actually Requires

For a proctoring vendor's GDPR compliance claim to be substantive rather than self-reported, it needs to rest on something more than a certification program that can be obtained by filling out a form and paying a fee.

The most reliable indicator is where the data actually lives. If learner data is stored outside US jurisdiction, on infrastructure not subject to US government compelled disclosure, the conflict between the Patriot Act and GDPR does not arise.

Integrity Advocate's GDPR compliance is grounded in the same Privacy by Design architecture that underpins GDPR itself. All data is hosted in GDPR-designated jurisdictions, out of reach of governments with compelled data access authority. Integrity Advocate collects only what is necessary to confirm a learner's identity and compliance with exam rules, most of which is automatically deleted within 24 hours of session completion.

This is not a self-certification. It is an architectural position.

Questions to Ask Your Proctoring Vendor

Before accepting a GDPR compliance claim at face value, organizations should be able to answer the following:

• Where is learner data physically stored, and in which legal jurisdiction?
• Is the vendor registered in the United States or storing data on US infrastructure?
• Is the GDPR compliance claim based on self-certification, third-party audit, or architectural design?
• Has the vendor's compliance been reviewed independently, or is it self-reported?
• What happens to learner data if the vendor receives a government data request?

If the answers are not clearly documented, the GDPR compliance claim deserves further scrutiny.

{{post-cta}}

Consider two scenarios.

In the first, security cameras in a school record a student walking through the hallways and interacting with friends. The school stores the recording indefinitely as part of the student record and shares it with other organizations.

That feels wrong.

In the second scenario, cameras capture the same student bullying a younger student. Only the portion of the recording showing the behavior is retained, and it is shared with the organizations responsible for taking appropriate action.

That feels reasonable. There is a legitimate purpose, a proportionate response, and a clear limit on what gets shared and why.

Remote proctoring technology is an extension of the same principle. The question is whether the companies providing it are applying that principle, or ignoring it entirely.

What Proctoring Companies Are Actually Collecting

Most people assume online proctoring captures what it needs to verify identity and monitor an assessment session. The reality, based on the privacy policies of many proctoring providers, is considerably broader.

Many proctoring services collect, intentionally and unintentionally, personal information that includes:

• Social security numbers, driver's license numbers, and passport numbers
• Biometric information including facial geometry, physiological and behavioral characteristics, and genetic data
• IP addresses and device identifiers
• Full browsing history, search history, and records of interactions with websites and applications
• Medical information including physical and mental health conditions
• Drug use history and political affiliations
• Footage of children, spouses, and other individuals who happen to be in the same space as the person being proctored

This is not a hypothetical. This is what the privacy policies say.

Four Things You Will Find in Proctoring Privacy Policies

The following are real excerpts from proctoring company privacy policies currently in use. Read them carefully.

1. "By accessing and using our Services, you consent to allow free exchange of proctoring information between [Proctoring Service Company] and your educational institution. We, or vendors on our behalf, may track the websites you visited before and after our websites as part of the traffic data described above for our internal business purposes."

2. "If your institution has consented, we may also use third-party solutions to process selected data."

3. "We may disclose information, including video and audio recording of your exam session, to your educational institution/certifying entity upon request. Your information may be sold or transferred as part of that transaction."

4. "We cannot ensure or warrant the security of any information you transmit to us or store on the Services, and you do so at your own risk."

Students and workers taking online assessments are required to submit to proctoring. They do not have the option to choose a different provider or opt out. That disparity in power makes these policies more than a legal formality. It makes them an ethical issue.

Why Privacy by Design Is the Only Acceptable Standard

The school camera analogy holds here too. We expect schools to share footage of students only when there is a legitimate reason and only to the extent necessary. We should expect the same from proctoring technology.

Privacy by Design is not a compliance label. It is an architectural commitment — the decision to build data minimization, purpose limitation, and deletion into the product from the start, rather than adding privacy language to a policy document after the fact.

That is how Integrity Advocate is built.

What Integrity Advocate Collects and What It Deletes

Integrity Advocate collects only what is necessary to verify a learner's identity and confirm whether they followed the rules set by the organization running the assessment. Nothing more.

The approach is similar to how PayPal operates as an intermediary in a financial transaction, protecting both parties without either side needing to expose more than is required. Integrity Advocate sits between the organization and the test taker's personal data, sharing only what is needed and only when there is a documented reason.

In practice, that means:

• With the exception of a single identity photo, all recordings of the user and their desktop are deleted within 24 hours if no rule violations are found
• When a session is flagged, only the minimum information required to document the concern is shared with the organization
• As a Canadian company, Integrity Advocate operates outside US government jurisdiction. In the unlikely event of a compelled disclosure, the data available on the vast majority of users would be limited to a first and last name and a facial image represented as a string of code

Read the privacy policies of other proctoring providers and ask how many of them can say the same.

What to Look for Before Choosing a Proctoring Provider

Before signing a contract with any proctoring platform, your organization should be able to answer the following questions from their privacy policy and data processing documentation:

• What personal information is collected, and is collection limited to what is necessary?
• Is data sold, transferred, or shared with third parties beyond the assessment organization?
• How long is data retained, and what triggers deletion?
• Is the vendor subject to US government data requests, and what would they be required to disclose?
• Is there a human review process, or are automated findings shared directly with the institution?

If the answers are not clearly documented, that is an answer in itself.

{{post-cta}}

The US Department of Education's Privacy Technical Assistance Center published a presentation titled Security Threats: Education Systems in the Crosshairs, in which security advisor Mike Tassey documented how data breaches, hacks, and privacy incidents have affected organizations across virtually every sector, from NASA and Citigroup to local school systems.

The warning is directly relevant to any organization using online proctoring. The data that proctoring services collect, including names, government-issued ID, biometric images, and session recordings, is exactly the kind of information that makes education systems a target.

The Threat Landscape Has Changed

Cyber-theft has become fully commoditized. There is an active black market for personal data, and an underground economy where over two million pieces of malware are built and sold every year. This malware is designed to gather precisely the kind of information proctoring platforms collect: Social Security numbers, addresses, birth dates, and identity credentials.

Tassey specifically noted that children's identities are particularly valued by data thieves because they are, in his words, fresh. A child's identity may go undetected for years before the theft is discovered, making it a high-value target for long-term fraud.

The alarming part is how malware typically gets onto devices. It is not usually through pirated software or poor security settings. It enters through plugins and browser extensions that users install themselves, often for legitimate purposes. The installation is the vector.

Why Proctoring Plugins Create Specific Risk

Most online proctoring services require users to install browser extensions or plugins to enable monitoring. Each of these installations represents an opportunity for malware to enter the device, either during the initial installation or through a subsequent update, without the user's knowledge or permission.

Tassey's research notes that on average there are one to five bugs for every 1,000 lines of code. For organizations that have not completed independent code reviews of the proctoring software they deploy, those bugs represent an unexamined attack surface. Malware can be introduced into code updates without detection, meaning a plugin that was clean at installation may not remain so.

At minimum, organizations should be instructing learners to disable or uninstall proctoring plugins and extensions immediately after use. The risk does not end when the exam does.

What a Code Review Should Cover

Organizations that require learners to install proctoring software should conduct, or require their vendor to provide evidence of, a code review that addresses:

• Potential malware embedded in the plugin or extension code
• Errors or vulnerabilities that could be exploited by third parties
• Whether the software receives automatic updates, and what review process governs those updates
• What data the software transmits, to where, and under what conditions

If a vendor cannot provide clear answers to these questions, the software should not be deployed on learner devices.

The Case for No-Installation Proctoring

The most effective way to eliminate installation-based security risk is to remove the installation requirement entirely. Integrity Advocate's platform is browser-based and requires no plugin, extension, or application installation in most cases. There is nothing to install, nothing running in the background after the session ends, and no update mechanism that could introduce malware without the user's knowledge.

For use cases that do require a lockdown browser, Integrity Advocate's solution uses fully open source code, does not accept automatic updates after installation, and does not transmit data beyond what is required for the session. The code is publicly available for inspection.

The US Department of Education's guidance on protecting student privacy points to the same principle: the safest data handling approach minimizes what is collected, minimizes how long it is retained, and minimizes the software footprint on learner devices.

{{post-cta}}