Cybersecurity Policy Report, N.Y. AG Settles With App Developer in Student Privacy Probe, (Mar 7, 2025)
By Tony Foley
New York Attorney General Letitia James (D.) today announced that her office had reached a settlement with app developer Saturn Technologies to resolve allegations that the company failed to protect young user’s privacy.
In an announcement of the settlement, the AG said the company’s Saturn app was used by high school students to create a personal calendar, message other app members, share social media accounts, join groups, and know where other students are located based on shared calendars.
Saturn Technologies claimed that the app only allowed students from the same high school to interact with one another, but the AG’s investigation found that the company failed to verify users’ school e-mail accounts and ages to ensure that they were high school students and allowed users from different schools to interact.
Specifically, in 2021, Saturn Technologies made e-mail-based user certification optional without informing users of the change and turned off user verification for more than 4,000 high schools between 2021 and 2023, allowing anyone to join the student’s high school community and access their schedules and other personal information, the AG said.
The AG’s investigation also found that Saturn Technologies began to use unproven and untested user verification methods after making school e-mail verification optional. For example, the company attempted to verify a user as a member of a high school community by checking whether they appeared in the phone contacts book of as few as three other users or by confirming that a user was accepted as a SaturnApp “friend” by as few as one other user.
The AG further determined that Saturn Technologies did not screen users based on birth date to confirm that they were high school students until 2023, promoted the Saturn app through other high school students without disclosing that the students were compensated for their promotions, made copies of users’ contact books and continued using them even if the user changed phone settings to deny the app access to their contact books, and failed to keep sufficient records on data privacy, data permissions, user verification, and user privacy.
The settlement requires Saturn Technologies to pay $650,000 in penalties, with $200,000 payable immediately and $450,000 suspended to ensure that the company complies with the settlement terms. In addition, the settlement requires Saturn Technologies to implement a variety of remedial measures, including the following:
Notify current users regarding verification changes to the app and provide users with options to modify their privacy settings;
Provide all current and future users with specified enhanced privacy options;
Prompt users under age 18 to review their privacy settings every six months;
Establish a reasonable basis based on competent and reliable evidence prior to making future claims about user safety or verification;
Limit the visibility of information about students who don’t use the app that other Saturn users may enter into the app;
Allow teachers to block their name, initials, or other personal identifiers from appearing in the app’s class schedule feature;
Delete retained copies of the phone contact books of specified users; and
Hide the personal information of current users under age 18 until Saturn Technologies obtains informed consent to the app’s new terms.
“The Saturn App helps students stay up to date with school-related events, sports, exams, and homework, but it failed to protect young users’ safety and privacy,” said AG James. “Saturn Technologies should have strictly verified users to ensure that they were actually high school students and should have made sure students were interacting with others in their high school, not strangers. With this settlement, Saturn Technologies will have to update its practices, better protect users, and keep its promises.”
News: StateLegislation LitigationEnforcement DataPrivacy DataSecurity