A nine-year-old child sits down at their desk at the start of the day, and logs on to their school's education technology system.
Within moments, a host of companies are tracking them.
Louise Hooper witnessed this exchange in a new investigation into two products widely used in UK schools and how they are used there.
"Once the link was clicked, they exited the safer classroom environment and at that point their interaction was tracked by 42 third parties including various ad services and analytics," said the UK human rights lawyer.
Hooper is co-author of a new 86-page report from London's 5Rights Foundation, part funded by the London School of Economics.
Denmark's data protection agency recently clamped down on Google services in some schools. Chromebooks linked to the services are widely used in its schools, but the agency ruled that processing of students' data is not up to Europe's General Data Protection Regulation (GDPR).
The foundation told RNZ small countries like New Zealand should follow the likes of the Netherlands, and look to curb education technology that spies on children.
Its investigation concludes that just how exposed kids are varies between schools, but in general digital classrooms are flouting data protection laws to exploit children's data "for commercial gain".
"Data collection is so extensive that we think that once, combined, it's likely to be sufficient to construct a full profile of each individual child, including their identity, location, biometrics, preferences and abilities," Hooper said in a webinar.
Her team looked at two products in-depth, from Google and UK company ClassDojo which are widely used in UK schools, as representative of dozens of EdTech services flooding schools.
ClassDojo says on its website it is "built on lots of love" and connects more than 50 million teachers and families. RNZ has approached Google and ClassDojo for comment.
Another of the report's co-authors, Sonia Livingstone said like in New Zealand, Britain had promoted edtech partly to compensate for Covid-19 school lockdowns.
But pinning down just what is going on, there as here, is difficult.
"Schools are so keen that children do have access to EdTech that EdTech is being provided as part of a deal really - that they get the children's data" in a "Faustian deal", said professor Livingstone, who is also on the UK's Digital Futures Commission.
"We have spent a year with lawyers trying to understand what is happening to that data, and the companies make it really impossible."
There was also surprisingly little evidence of the educational benefits of EdTech, she said.
Livingstone and Hooper found the technology is blurring the lines between school and home, so that families' data can be surveilled.
Parents were feeling powerless, and deserved help, Livingstone said.
"A country like New Zealand can look at the good practice in other countries," Livingstone said.
"The Dutch government did a big investigation and required Google Classroom now to operate to a higher standard than we're seeing in the UK.
"So the authorities clearly can take action, but I am dismayed that they're not giving it the priority that it should have."
Hooper said regulation needed to be global and enforceable.
UK schools had limited means to keep a check on the big companies despite the contracts they had with them, the investigation found.
In this country, schools can shelter behind the two big EdTech contracts the Education Ministry has, with Microsoft and Google.
However, even those have had limited independent scrutiny.
Netsafe has not checked them.
"We don't give advice to the ministry on collective contracts around software that they purchase ... because they don't ask us for advice on that," its chief online safety officer Sean Lyons said.
"I don't work for the Ministry of Education."
It puts the onus back on schools, though they may lack expertise and resources, to do their own assessment of any EdTech tools' privacy impacts.
"Schools should be engaging in that process, and I think, mostly do," Lyons said.
The lead agency that connects schools to the internet, the Crown-owned N4L, refused to comment.
Asked for its view of the ministry recently signing up to Australia's Safer Tech for Schools initiative, N4L said: "We are not yet in a position to provide public statement on this programme right now."
It referred all of RNZ's questions to the Education Ministry.
The Privacy Foundation has been asking questions for months of the ministry, Privacy Commissioner, Netsafe and School Trustees Association, and said its preliminary findings show the government needed to intervene to protect children.
Dr Caroline Keen of Orewa, who is also calling for tighter regulation, said the UK work showed "the complexity involved in reviewing EdTech, as they only attempt two here".
Students themselves have sometimes rebelled against invasive tech but the 5 Rights investigation found it many cases students, and their families, and teachers have little way of knowing how they are being surveilled and their data harvested.
A Google spokesperson told RNZ that education technology needs to be private and secure.
This was "why Google's services for schools are governed by clear privacy policies and have sophisticated security and encryption technology built-in", they said.
Schools owned their data and had "technical and administrative control" over how Google processes it.
"We do not use Google Workspace for Education customer or service data for ads targeting, or sell it to third parties."
Privacy International says people want control over their data but don't know how, so it has put out a guide.
RNZ
