Students are less informed about institutional policies than they are about privacy and security in general. Though students are increasingly aware of general data privacy and information security issues, that doesn't mean they understand what data their institutions collect about them, how those data are stored and protected, and how those data are used. Respondents ranked their knowledge of general personal data privacy and security higher than their familiarity with their institution's personal data privacy and security policies (see figure 1).

In keeping with this finding, fewer than half (44%) of respondents agreed or strongly agreed with the statement "I understand relevant university policies about data use, storage, and protection" (see figure 2). Even fewer respondents agreed or strongly agreed that they understand how their institution uses their personal data or that they benefit from their institution's collection and use of their personal data (34% and 27%, respectively).

Students don't know how institutions use personal data. Open-ended responses support the finding that students lack an understanding of institutional data policies and practices. When asked how they think their institution uses the personal data collected about them, many respondents simply said they did not know or did not care. One respondent explained, "I haven't really thought about it before this survey. I'm honestly not even sure if they do collect any data about me." Some respondents replied with types of data (e.g., "demographics") rather than uses of data. Respondents who did respond with specific uses of data were typically vague:

"For educational purposes."

"Gain knowledge."

"For research."

"Analysis."

"Daily business."

"For statistics."

"Financial aid."

"For their records."

A number of respondents indicated that they don't believe their institution uses any data about them:

"I don't think they use it. Why would they need my personal data beyond identifying me for buying stuff and registration?"

"I don't think they sell it. I don't even know what kind of personal data they have."

"I don't think they use it too much."

"I think they don't really use it, but I don't trust them to keep it safe."

Finally, some respondents described specific use cases for their data:

"I would imagine that the school uses this information in the following manner: First, they may use it for marketing their programs. Second, they may use this information to improve services for students. Third, they may use the information to request or obtain state or federal funding."

"I think they take percentages and use them to help visualize goals for future students."

"To inform how they structure their curriculum, for teacher feedback, and school safety."

"I think they use it for funding and knowing what services students really use."

"There are demographic metrics used by all institutions for financial aid, to promote diversity, and to accomplish other positive goals. I believe my institution uses data for all of these."

"I think they use it to create student experiences that increase on-campus or online engagement."

"To make sure I am where I am supposed to be (in my dorm by curfew), to reach out to me about upcoming semesters, to advertise upcoming events."