Edtech is under attack from every direction but sadly some of the criticism does not go far enough. Similarly, some of the bodies I normally have little regard for are doing some good work. Such is the case with the UK Information Commissioner’s Office (ICO) and England’s Department for Education (DfE).
I have previously written that the ICO is about as concerning for edtech companies as an inflatable tiger would be to a serial burglar. However, two days ago the ICO put out a good report, Edtech Examined, that is well worth reading. It covers case studies of 28 ’consensual audits’ of UK edtech companies undertaken during 2024/25, covering:
- management information systems
- safeguarding tools
- behaviour management platforms
- learning management systems
- classroom app
- data integration services
Their findings uncovered these issues:
- providers didn’t always correctly identify whether they were processors or controllers, especially when they used children’s information for product development or analytics
- insufficiently detailed contracts with schools
- incomplete data flow mapping
- weak application of data minimisation and storage limitation principles
- outdated or inaccessible privacy information
- gaps in data protection impact assessments.
The ICO team then went on to make 596 recommendations; an average of 21.2 per product examined, along with 139 advisory notes!
It’s a good effort from the ICO but let’s get real. There are many, many edtech products, especially student-facing learning apps that the ICO should be prosecuting, not just nudging. This is where the DfE comes in. They have published a good starting point set of product standards for generative AI.
My wish is that the ICO would work with the DfE and the edtech community more actively to weed out not just bad actors, but those whose products either don’t work as claimed or who hide behind semi-spurious claims of support and authority. Sadly, the image of the ICO as a toothless tiger regulator, was reinforced by the sudden resignation of the Information Commissioner, John Edwards a week ago for ‘inappropriate humour’.
I saw one example of the problems around AI, the ICO and DFE guidelines last week via a Linkedin post by Francesca de Garis (Writer & Researcher, AI in Education & Ethics, AI Training & Development Lead @ Elizabeth College). She gushed about the media coverage of the trial and ‘informal accreditation” of the AI tutoring company inkling at the independent school on Guernsey where she works.
I love startups and think there are a few who are using AI well but many are just generative AI wrappers with a pinch of pedagogy and almost zero business model. inkling seems to have been developed in collaboration with Clifton College, Bristol (the school’s campus is their business address but it’s unclear from their Companies House filings if they are an actual shareholder). inkling’s claim is that it, ‘brings personalised,1-to-1, relationship-driven, tutoring to every student, powered by thoughtful AI’. That’s marketing spin for what is an avatar-presented, voice response AI tutor. It’s a legitimate product but my concerns are:
- Their call to authority by their work with Clifton College and claims they are ‘Supported by industry experts including: Sir Anthony Seldon, leading British educationalist, author of The Fourth Education Revolution, creator of AI in Education (previous supporter of CenturyTech whose claims used to include that their product could predicting autism with 96% accuracy). Nor are their academic credentials at Cambridge and Harvard unique in the world of edtech startups.
- The lack of published independent evidence for their claims of ‘+26.6% scores on tutored subjects and +1 GCSE grade improvement after 2 hours’ (not an RCT (randomised control trial) so I’m calling bullshit here)
- What is inkling beyond being just another gen AI wrapper, with no proprietary AI model/LLM? It’s mostly a system-prompt/orchestration layer plus retrieval (with curriculum content aligned to AQA/Edexcel/CIE specs) that sits on top of a 3rd party model
- To be a GDPR-compliant edtech tool handling children’s voice and conversation data they must disclose its sub-processors, i.e. exactly which US AI vendors student data flows to in its DPIA and Privacy Policy. ll they state (Terms of Service Clause 11 & Privacy Policy Clause 6) is that the platform, ‘may integrate with or rely on third-party services (such as hosting, analytics, authentication, or AI providers)’, but names none of them and disclaims responsibility for all of them.
Given they created the company less than a year ago, inkling was not part of the ICO’s Edtech Examined programme. Their lack of GDPR and other compliance (their website displays a logo claiming GDPR compliance) may make them a case study for serious investigation by the ICO and the DfE for being outside their mandated AI guidelines.
Now inkling link, or display the logos of the following schools on their website:
- Clifton College
- The Leys School Cambridge
- Epson College
- Princethorpe College
- Putney High School
- Lord Wandsworth College Hampshire
- Backwell School
- Apex2100
- Cotham School
- Wellingborough School
I’d love to know what the contract between inkling and these schools says and whether any of them have done a data protection impact assessment (DPIA) on inkling? If not, then they had better do so PDQ, just as the founders should be immediately reviewing their T&C/Privacy Policy.
I hope inkling is even partially as good educationally as they claim but it will take time, serious money (for an RCT) and more before I’d recommend any school use it as is. I also hope they succeed commercially but for now they are a complete fail for my POPEYE model of investable edtech.
Leave a Reply