Understanding How University Guidelines Address Privacy and Security Issues of Generative AI in Academic Settings

Abstract

Generative artificial intelligence (GenAI) is transforming the educational landscape by augmenting learning paradigms. However, state-of-the-art GenAI systems driving this transformation are predominantly developed and controlled by a small number of private companies; there is little clarity about their data retention practices and limited user control over inputs and outputs. In the context of education, end-users lack the awareness of how to safely adopt GenAI in learning. This raises significant concerns, particularly when proprietary or personally identifiable educational information may be shared with external GenAI platforms. In response to these concerns, universities are developing their own usage guidelines and policies to balance innovation with academic integrity, privacy, and security. Our research seeks to understand these emerging guidelines, with a particular focus on the privacy and security implications of integrating GenAI tools into academic environments - an area that has received little attention to date. We conducted an in-depth qualitative analysis of GenAI-usage guidelines from 43 universities across 12 countries. Our findings reveal several key challenges, including barriers faced by universities in deploying privacy measures and adopting existing security frameworks. These insights lay the groundwork for designing more robust, privacy-aware GenAI guidelines for higher education.