Ranking Member Cassidy Launches Inquiry into Tutor.com Over Data Privacy Concerns, Potential Targeting by CCP

Recently, U.S. Senator Bill Cassidy, M.D. (R-LA), ranking member of the Senate Health, Education, Labor, and Pensions (HELP) Committee, launched an inquiry into Tutor.com amid concerns that its users’ sensitive data could be used and exploited by the Chinese Communist Party (CCP). Tutor.com is owned by Primavera Capital Group, a Chinese investment firm that also has ownership stake in TikTok and Bytedance.

Tutor.com provides tutoring services to school districts in approximately half of all U.S. states. According to its privacy policy, Tutor.com collects data on its users, including names, addresses, IP addresses, and recordings of tutoring sessions. Some state and local education agencies pay for Tutor.com using federal funds, including COVID-19 Elementary and Secondary School Emergency Relief (ESSER) funds. The company also has a contract with the U.S. Department of Defense (DoD) to provide services to members of the U.S. military and their families.

According to Chinese law, companies based in China are required to “support, assist, and cooperate with state intelligence work,” meaning that a company can be compelled to share information with the CCP. There are concerns that Tutor.com could be compelled to pass along Americans’ sensitive data to the CCP, including U.S. military personnel, which could be used to target these citizens. National security experts echo these concerns, stating that this information could be collected to create files on individuals and families.

Due to concerns about the company’s China-based owner and its troubling ties to Bytedance and TikTok, Cassidy is urging Tutor.com to provide information on its policies to secure users’ personal information, and how it is ensuring that Americans’ sensitive data does not fall into the hands of the CCP regime.

“These contractual arrangements, some of which are funded by federal taxpayer dollars, raise highly significant student data privacy concerns because Chinese law requires companies based in China to ‘support, assist, and cooperate with state intelligence work,’ meaning that a company can be compelled to share information with the Chinese Communist Party (CCP) if asked to do so,” wrote Dr. Cassidy. “Since these matters concern students’ online safety and privacy, the stakes could not be higher. Accordingly, Congress requires, and the American people deserve, full transparency regarding Tutor.com’s policies and monitoring arrangements.”

Read the full letter below.

Dear Mr. Park:

It has come to my attention that your company, Tutor.com, which is owned by Primavera Capital Group, a China-based investment firm, has contracted with a number of state and local education agencies and state library systems to provide tutoring services for students in the United States.] These contractual arrangements, some of which are funded by federal taxpayer dollars, raise highly significant student data privacy concerns because Chinese law requires companies based in China to “support, assist, and cooperate with state intelligence work,” meaning that a company can be compelled to share information with the Chinese Communist Party (CCP) if asked to do so. The U.S. Senate Committee on Health, Education, Labor, and Pensions (HELP) is investigating these federally funded arrangements with Tutor.com in order to assess any and all threats they pose to students’ online safety and privacy. Accordingly, I write to request a thorough and complete accounting of Tutor.com’s relationship with its owners in China, its reported contractual arrangements with public schools and libraries in at least 25 states, and its policies for collecting and managing student data.

Tutor.com was purchased in 2022 by China-based private-equity firm, Primavera Capital Group (Primavera). Any company based in China is a potential threat to U.S. interests and national security. Primavera’s ownership interest in Tutor.com, however, poses a heightened risk due to its ownership interest in ByteDance, the company that currently owns TikTok. ByteDance engineers have been accused of accessing U.S. data, spying on journalists and obtaining their IP addresses, and using TikTok’s algorithm maliciously to influence children and young adults in the U.S. Congress recognized this risk and recently passed a law requiring ByteDance to divest TikTok or face a U.S. ban of the platform. Therefore, it is imperative that all companies associated with ByteDance receive the strictest of scrutiny by the U.S. government.

Like ByteDance, Tutor.com is similarly situated to collect sensitive information on a broad range of U.S. student populations, including the children of our military service members. One Tutor.com customer, Antelope Valley High School in Lancaster, California, is located less than thirty miles from Edwards Air Force Base, the country’s second largest Air Force base and home to over 10,000 military, federal civilian, and contract personnel.” Another Tutor.com customer, San Antonio Independent School District, is located near Joint Base San Antonio,“[t]he largest and most diverse joint base in the Department of Defense” and home to 70,000 service members. In these geographic areas, it is likely that students using Tutor.com’s services are children of service members, meaning that information on the students and their families could be of strategic value to the CCP and therefore pose risks not only to student privacy but also our national security.

The amount of user information collected by Tutor.com that is at risk of being compromised appears to be extensive. Under the company’s policies, “all communication between tutors and students is conducted in [Tutor.com’s] recorded online classroom environment.” The company openly states that it retains and reviews these recordings to ensure high standards. Additionally, the company’s privacy policy indicates that it collects biographical information on users, including address and parental or guardian information, as well as information on educational and employment backgrounds such as academic interests, transcripts, college application materials, and the names of employers. The policy also states that Tutor.com collects information from third parties and automatic information from the user’s browser, including IP addresses and machine IDs.

Tutor.com’s website provides veiled assurances regarding data privacy and security. The company states that it has a “commitment to data protection,” that it “abide[s] by U.S. state and federal laws,” and that “all student data is housed in the U.S.” It further states that it “voluntarily initiated a rigorous federal review by the Committee on Foreign Investment in the United States (CFIUS) to ensure that stringent safeguards would be put in place to protect customer and student data, together with mechanisms that provide for constant monitoring and compliance.” The company claims to have a “binding legal commitment to the U.S. government regarding the security of personal data and . . . IT systems.” It says that there is a “designated data security officer, vetted and approved by the U.S. government, to continuously monitor and ensure compliance with data-protection measures, as well as two independent directors on the Tutor.com board of directors, also vetted and approved by the U.S. government, whose foremost duty is to ensure that personal data is appropriately safeguarded.” However, details concerning the scope and findings of the CFIUS review, the terms of Tutor.com’s legal commitment, and the job responsibilities of its data security officer and independent directors are not publicly available.

Veiled assurances are not enough. TikTok similarly assured Congress and the American people that its parent company, ByteDance, is a “private company” and “commit[ed] to be free of all and any government manipulation.” Yet, in a recent court filing, TikTok and ByteDance stated that “the Chinese government . . . made it clear that it would not permit a divestment of the recommendation engine that is a key to the success of TikTok in the United States.” There are also news reports linking Fred Zuliu Hu, the Chairman and CEO of Primavera Capital, to the Hunan National Committee of the Chinese People’s Consultative Conference, an organization that reportedly “helps disseminate [Chinese Communist Party] messaging.”

Taxpayers are footing the bill for many of the services that Tutor.com provides to American students. Press reports and publicly available records show that some of the contracts between state education agencies and Tutor.com are funded by COVID-19 Elementary and Secondary School Emergency Relief (ESSER) funds. Some states also use federal funds received through the Library Services and Technology Act (LSTA) grant program, which is administered by the Institute of Museum and Library Sciences (IMLS), a member of the National Foundation on the Arts and Humanities which is an agency directly under HELP’s jurisdiction, to purchase Tutor.com’s services for state residents. It is unclear how many state libraries continue to contract with Tutor.com.

Since these matters concern students’ online safety and privacy, the stakes could not be higher. Accordingly, Congress requires, and the American people deserve, full transparency regarding Tutor.com’s policies and monitoring arrangements. As such, please respond to the following, on a question-by-question basis, no later than June 5, 2024.

Please provide a complete list of all state and local educational agencies and libraries that have signed new agreements with Tutor.com, and all other educational agencies and libraries that have continued to use Tutor.com’s services under previously executed agreements, since the company was purchased by Primavera in January 2022. Please provide all related records pertaining to Tutor.com’s arrangements with these public clients. The information provided should include, but not be limited to, copies of all contractual agreements.

Please describe the relationships between Primavera Capital Group, Primavera Holdings Limited, and Tutor.com. In your response, please list all members of Tutor.com’s leadership team and staff who interact with Primavera Capital Group and Primavera Holdings Limited and their agents, and fully describe the nature and extent of their interactions.

Please provide a list of all biographical information and other user data that Tutor.com collects from libraries, educational agencies, schools, and student users during its signup and login processes. Please specify whether the information collected varies based on client and location, whether and for how long the information is saved by the company, the reasons why the data is collected, saved, and stored by the company, and all other related details.

Please explain whether data collected as part of a contract between Tutor.com and a school or school district is considered an education record and subject to regulation under the Family Educational Rights and Privacy Act (FERPA). If not, please explain why not.

Please explain how Tutor.com stores user data, and provide the names and locations of all parties who have the ability to access the data.

Please describe all changes that Tutor.com has made to online processes, including, but not limited to signup, login, search, and tutoring sessions, since it was acquired by Primavera in January 2022. The list should include any changes to information that users are required to enter, changes in format, changes to the type and manner of user data stored, and changes to the ways that tutoring sessions are conducted, recorded, and monitored by Tutor.com staff.

Please provide a detailed description of all policies relating to Tutor.com’s “recorded classroom environment” and specify whether, and for how long, content from tutoring sessions is saved and retained in audio, audiovisual, and/or written formats. The description should also explain who reviews the recorded material and a description of how the files are stored, saved, and managed.

Please provide all company records relating to Tutor.com’s request for a CFIUS review of its purchase by Primavera, including, but not limited to, information relating to Tutor.com’s request for the review, a description of what Tutor.com alleges are “safeguards . . . put in place to protect customer and student data,” a description of the company’s “binding legal commitment to the U.S. government regarding the security of personal data and . . . IT systems,” and “mechanisms that provide for constant monitoring and compliance.”[22]

Please describe in detail the responsibilities of Tutor.com’s self-described “designated data security officer” who “monitor[s] and ensures compliance with data-protection measures.”[23] The response should include a description of the data protection measures being enforced, as well as the methods that the officer uses to monitor compliance with those measures.

Please provide names and biographical details relating to the independent directors who sit on Tutor.com’s board of directors. In addition, please explain how these directors “ensure that personal data is appropriately safeguarded” and which U.S. government agency “vetted and approved” the directors.[24]

Do all of the monitoring protocols that Tutor.com claims are in place to ensure data protection pertain equally to all of Tutor.com’s U.S.-based clients, including libraries and educational partners? If not, please explain which protocols apply to which clients.