Docs and interviews show that ~44 US universities work with outside companies to data mine and rank prospective students, including tracking their web activity
using surveillance software on their websites to secretly track Web browsing activity and by collecting info on household income & zip codes to “score” potential applicants https://www.washingtonpost.com/ ... @stanvard_u : Here @Stanvard_U we share everyone's shock that some colleges use “enrollment management” to look for rich people who can pay full tuition, fees, room, and board. Aren't full tuition, fees, room, and board the floor, not the ceiling? https://twitter.com/... Tessa Weinberg / @tessa_weinberg : .@TCU in Fort Worth is on this list and “says it complies with applicable laws and follows industry best practices to identify prospective students.” Other schools collected data on everything from test scores to family income to how long a prospective student spent on a page. https://twitter.com/... David Carroll / @profcarroll : Universities caught cookie-matching prospective students, effectively de-anonymizing them. This is literally what Cambridge Analytica and Breitbart did. Possible #FERPA violation. Relieved that @TheNewSchool was not on the list of 33 offending schools. https://www.washingtonpost.com/ ... @hypervisible : At least 44 unis “...work with outside consulting companies to collect and analyze data on prospective students, by tracking their Web activity or formulating predictive scores to measure each student's likelihood of enrolling.” https://www.washingtonpost.com/ ... ht @douglevin Doug MacMillan / @dmac1 : College admissions departments are collecting a surprising amount of data on prospective students — including web browsing habits and financial history — before they even submit an application. New story in @washingtonpost w/ @wpnick https://www.washingtonpost.com/ ... John Paczkowski / @johnpaczkowski : this is some invasive, nefarious bullshit https://twitter.com/...
Context & Ripple Effects
The Washington Post's reporting lands in the middle of an arc the corpus has been building for years: universities quietly expanding surveillance from applicants to enrollees. Months after this story, Syracuse U. and other schools were tracking students' phones to monitor class attendance, and by 2023 The Markup documented a California college layering homework trackers, e-proctoring, and license plate readers on top.
The applicant-side data flows also connect to federal infrastructure: a later study found the FAFSA page itself shared applicants' names, zip codes, and emails with Meta via a tracking pixel, and students have since reported colleges weighing their social media posts on mental health in admissions. With observers calling the 1974 FERPA law outdated, the ~44 universities named here are operating in a regulatory gap rather than a clear rulebook.
First-order effects
- The ~44 named universities — TCU among them, per the coverage — face immediate reputational and legal exposure, with privacy advocates flagging possible FERPA violations over undisclosed tracking of minors' browsing and household-income data.
- Prospective students and families lose the assumption that college websites are neutral information sources; browsing there is now scoring input, shifting disclosure obligations onto schools that currently treat the software as ordinary enrollment management.
Second-order effects
- Ed-tech vendors selling 'enrollment management' analytics gain a recurring revenue line tied to tuition-maximization, giving universities a financial incentive to widen data collection beyond web tracking into the phone-tracking and e-proctoring tools the later coverage documents.
- Competing institutions that don't score applicants face pricing pressure in merit-aid bidding, since rivals can target full-tuition families precisely — pushing more schools toward the same vendors to stay competitive on discount rates.
Third-order effects
- If the pattern holds, admissions becomes a surveillance market: the same tracking stack applied to applicants, then enrollees (Syracuse's attendance tracking), then campus movement (license plate readers), normalizing data collection across the full student lifecycle.
- The regulatory gap becomes the story — FERPA, written in 1974, doesn't clearly cover prospective-student data held by outside contractors, so pressure for a legislative rewrite grows with each disclosure, and vendors' university contracts become the test cases that define the new boundary.
The trend: US higher education is converging on a continuous surveillance model — applicant scoring, enrolled-student phone tracking, and campus monitoring supplied by the same outside vendors — running ahead of a student-privacy law written decades before the data economy.