Understanding How University Guidelines Address Privacy and Security Issues of Generative AI in Academic Settings
Authors: Bei Yi Ng (University of Edinburgh), Jiarui Li (University of Edinburgh), Xinyuan Tong (University of Edinburgh), Kevin Ye (University of Illinois Urbana–Champaign), Gauthami Yenne (University of Illinois Urbana–Champaign), Varun Chandrasekaran (University of Illinois Urbana–Champaign), Jingjie Li (University of Edinburgh)
Volume: 2026
Issue: 4
Pages: 1055–1071
DOI: https://doi.org/10.56553/popets-2026-0159
Abstract: Generative artificial intelligence (GenAI) is transforming the educational landscape by augmenting learning paradigms. However, state-of-the-art GenAI systems driving this transformation are predominantly developed and controlled by a small number of private companies; there is little clarity about their data retention practices and limited user control over inputs and outputs. In the context of education, end-users lack the awareness of how to safely adopt GenAI in learning. This raises significant concerns, particularly when proprietary or personally identifiable educational information may be shared with external GenAI platforms. In response to these concerns, universities are developing their own usage guidelines and policies to balance innovation with academic integrity, privacy, and security. Our research seeks to understand these emerging guidelines, with a particular focus on the privacy and security implications of integrating GenAI tools into academic environments -— an area that has received little attention to date. We conducted an in-depth qualitative analysis of GenAI-usage guidelines from 43 universities across 12 countries. Our findings reveal several key challenges, including barriers faced by universities in deploying privacy measures and adopting existing security frameworks. These insights lay the groundwork for designing more robust, privacy-aware GenAI guidelines for higher education.
Keywords: Generative AI, higher education, privacy, security, AI governance
Copyright in PoPETs articles are held by their authors. This article is published under a Creative Commons Attribution 4.0 license.
