Third Parties and Internet Trackers on College Board Websites

These results were independently reproduced by other individuals, with multiple devices and programs.

When I visited this College Board AP Exam Day Experience (with Coronavirus updates) webpage, I clicked on Demo which brought me to this webpage: https://ap2020examdemo.collegeboard.org/.   I visited only these 2 College Board public facing websites, which according to Lightbeam had multiple third parties including YouTube (there was a video tutorial on the AP exam day experience webpage), Google Ads (Doubleclick), Bing Ads (Microsoft), Adobe digital marketing, a Geolocation detector, and multiple analytic tools including an interesting site called LuckyOrange, found on the AP Demo test page. Lucky Orange claims to let you see everything a visitor did on your webpage, offers recordings, ability to see where visitors use their mouse, and behavior tags.  Again, this was on the public page, and if I had not been using an add-on to detect web traffic, I would have had no way of knowing this information was being collected.  Did College Board disclose this invasive data tracking to users? How long does Lucky Orange track a user’s computer -- an hour, a day, or until an unsuspecting user clears their cache?

Here is the Lightbeam list of third parties associated with the College Board Exam Day Experience website and AP Demo website I visited:  

https://apcoronavirusupdates.collegeboard.org/students/taking-ap-exams/exam-day-experience

AP Exam Day Experience AP Coronavirus updates, Lightbeam found these Third Parties:

          "assets.adobedtm.com",

          "dpm.demdex.net",

          "collegeboard.tt.omtrdc.net",

          "www.youtube.com",

          "mango.collegeboard.org",

          "atlas.collegeboard.org",

          "fonts.gstatic.com",

          "static.doubleclick.net",

          "googleads.g.doubleclick.net",

          "bat.bing.com",

          "cdn.cookielaw.org",

          "widgets.getsitecontrol.com",

          "yt3.ggpht.com",

          "i.ytimg.com",

          "ajax.googleapis.com",

          "optanon.blob.core.windows.net",

          "thecollegeboard.demdex.net",

          "geolocation.onetrust.com",

          "js-agent.newrelic.com",

          "bam.nr-data.net",

          "strack.collegeboard.org"

https://ap2020examdemo.collegeboard.org/

AP 2020 exam Demo, Lightbeam found these Third Parties:

          "assets.adobedtm.com",

          "atlas.collegeboard.org",

          "polyfill.io",

          "cdnjs.cloudflare.com",

          "cdn.jsdelivr.net",

          "d10lpsik1i8c69.cloudfront.net",

          "optanon.blob.core.windows.net",

          "widgets.getsitecontrol.com",

          "ajax.googleapis.com",

          "geolocation.onetrust.com",

          "js-agent.newrelic.com",

          "strack.collegeboard.org",

          "bam.nr-data.net",

          "settings.luckyorange.net"

We have also seen Facebook connecting to College Board websites in the past. In February 2019 while registering for the SAT via the College Board website, this student had 36 different third parties interacting, including Facebook.

https://collegereadiness.collegeboard.org/sat/register

Here is the Lightbeam list of third parties I saw associated with the College Board websites for this 2019 online SAT registration session:

          “firstParty": true

"nsat.collegeboard.org”

             “account.collegeboard.org",

          "pps.collegeboard.org"

        "thirdParties":

          "assets.adobedtm.com",

          "mango.collegeboard.org",

          "ajax.googleapis.com",

          "bsauth-pine.vpc.collegeboard.org",

          "cdn.cookielaw.org",

          "optanon.blob.core.windows.net",

          "bat.bing.com",

          "geolocation.onetrust.com",

          "www.googletagmanager.com",

          "connect.facebook.net",

          "widgets.getsitecontrol.com",

          "strack.collegeboard.org",

          "www.googleadservices.com",

          "www.google-analytics.com",

          "st.getsitecontrol.com",

          "googleads.g.doubleclick.net",

          "www.google.com",

          "www.facebook.com",

          "stats.g.doubleclick.net",

          "bid.g.doubleclick.net",

          "collegeboard.tt.omtrdc.net",

          "public.cbapis.org",

          "staticxx.facebook.com",

          "store.collegeboard.org",

          "d1eoo1tco6rr5e.cloudfront.net",

          "pixel.advertising.com",

          "pps.collegeboard.org",

          "ss1.zedo.com",

          "dsum-sec.casalemedia.com",

          "Ds-aksb-a.akamaihd.net"

              thirdParties":

          "assets.adobedtm.com",

          "mango.collegeboard.org",

          "request.eprotect.vantivcnp.com",

          "cdn.cookielaw.org",

          "bsauth-pine.vpc.collegeboard.org",

          "ajax.googleapis.com",

          "optanon.blob.core.windows.net",

          "geolocation.onetrust.com",

          "ecom-apis.ecom-prod.collegeboard.org",

          "bat.bing.com",

          "strack.collegeboard.org",

          "www.google.com",

          "www.gstatic.com",

          "nsat.collegeboard.org"

This Lightbeam tracings of the College Board AP and SAT websites were repeated and confirmed by other users with other devices.  Additionally, using Ghostery, another open source tool to monitor internet trackers and block ads, we were also able to record traffic on the AP websites as well as the SAT registration website.

Ghostery blocked 4 Advertising trackers: Adobe Audience Manager, Adobe Test and Target, Bing Ads [Microsoft], DoubleClick [Google] and 1 Analytics Tracker : New Relic on the College Board  AP Exam Day Experience AP Coronavirus updates webpage. https://apcoronavirusupdates.collegeboard.org/students/taking-ap-exams/exam-day-experience

Ghostery blocked 1 Advertising tracker: Adobe Audience Manager and 2 Site Analytics Trackers: New Relic and Lucky Orange on the College Board AP DEMO webpage. https://ap2020examdemo.collegeboard.org/

Ghostery blocked 5 Advertising Trackers: Adobe Audience Manager, Adobe Test and Target, Yahoo.DOTtag, Bing Ads [Microsoft], Facebook Custom Audience and 1 Social Media Tracker:  Facebook Connect and 1 Unknown Google Tracker on the College Board SAT registration website. https://collegereadiness.collegeboard.org/sat/register