LTI PII Sharing in Open edX
Purpose
The Open edX platform can share Personally Identifiable Information (PII) to an LTI tool through three distinct paths:
Resource Link launch (a normal tool launch)
Deep Linking launch
Names and Role Provisioning Services (NRPS)
These 3 paths are governed by different settings and consent collection.
Current implementation
Interaction | Information potentially shared | Sharing control | User consent |
|---|---|---|---|
Resource Link launch | Username, full name, and email | XBlock-level sharing settings | Always collected before the launch |
Deep Linking launch | Username, full name, and email | XBlock-level sharing settings | Not collected |
NRPS request | Names and email addresses | Course-level PII flag and the platform-wide | Not collected |
For Resource Link launches, if any of XBlock-level sharing settings are enabled, the learner is shown a confirmation prompt before the launch. The launch only happens after the learner accepts that prompt.
CourseAllowPIISharingInLTIFlag controls whether the XBlock’s PII settings are visible in Studio.
For Deep Linking launches, the same XBlock settings determine whether the PII of the user initiating the Deep Linking request is sent to the tool. However, no consent is collected prior to deep linking launch.
NRPS follows a separate policy. It does not consult the XBlock’s username, full-name, or email settings and does not depend on a user’s response to the launch confirmation prompt. Instead, name and email in roster responses depend on CourseAllowPIISharingInLTIFlag and the LTI_NRPS_DISALLOW_PII flag. NRPS can return information about all course members, including people who have never launched the tool.
The diagram below summarizes the stuff above.
The table below summarizes the current state:
Interaction | XBlock PII fields enabled |
|
| Learner consent | PII shared | Result |
Resource Link | None | Not used | Not used | Not requested | None | Tool launches automatically (iframe) |
One or more | Not used | Not used | Accepts | PII fields enabled in XBlock | Tool launches after consent | |
One or more | Not used | Not used | Declines | None | Tool does not launch | |
Deep Linking | None | Not used | Not used | Not requested | None | Deep Linking proceeds |
One or more | Not used | Not used | Not requested | PII fields enabled in XBlock | Deep Linking proceeds | |
NRPS | Not used | ON or OFF | ON | Not requested | None | Roster returned |
Not used | OFF | OFF | Not requested | None | Roster returned | |
Not used | ON | OFF | Not requested | Name and email | Roster returned |
Problems with the current implementation and proposed solution
The table below summarizes the outcome of proposed state:
Interaction | Reusable config PII fields enabled |
| Learner consent required in config | Learner consent | PII shared | Result |
Resource Link | None | ON/OFF | ON/OFF | Not requested | None | Tool launches automatically (iframe) |
Resource Link | One or more | OFF | ON/OFF | Not requested | None | Tool launches automatically (iframe) |
Resource Link | One or more | ON | OFF | Not requested | PII fields enabled in reusable config | Tool launches automatically |
Resource Link | One or more | ON | ON | Accepts | PII fields enabled in reusable config | Tool launches after consent |
Resource Link | One or more | ON | ON | Declines | None | Tool does not launch |
Deep Linking | None | ON/OFF | Not used | Not requested | None | Deep Linking proceeds |
Deep Linking | One or more | OFF | Not used | Not requested | None | Deep Linking proceeds |
Deep Linking | One or more | ON | Not used | Not requested | PII fields enabled in reusable config | Deep Linking proceeds |
NRPS | None or username only | ON/OFF | Not used | Not requested | None | Roster returned |
NRPS | Name and/or email | OFF | Not used | Not requested | None | Roster returned |
NRPS | Name and/or email | ON | Not used | Not requested | Name and email | Roster returned |
The table below summarizes problems with current implementation and proposed solution:
| 1 | Current problem or rationale | Proposed solution |
| 2 | Resource Link, Deep Linking, and NRPS use different PII controls. Resource Link and Deep Linking use settings on individual XBlock placements, while NRPS uses course- and platform-level settings. Course teams cannot inspect one configuration to determine what a particular tool will receive. |
|
| 3 | CourseAllowPIISharingInLTIFlag is not an effective course-level control. It currently controls NRPS and hides the XBlock settings in Studio, but it does not stop previously saved values from being shared through Resource Link or Deep Linking. |
|
| 4 | User confirmation is applied inconsistently. Resource Link requires confirmation before sharing configured PII, while Deep Linking and NRPS do not. It is also unclear whether the interface represents legal consent, a privacy notice, or an acknowledgement. | Open for community discussion. No change is proposed in the current design. |
| 5 | Open question: Is learner consent ever required for NRPS roster disclosure? NRPS may return names and email addresses for course members who have never launched the tool. | Open for community discussion. No change is proposed in the current design. |
| 6 | Resource Link learner consent is mandatory and cannot reflect different organizational arrangements. Every Resource Link launch that shares PII requires learner consent. On a multi-organization platform such as http://edx.org , the prompt may be needed when a tool is not covered by an existing agreement. On a single-institution installation, an approved tool may already be covered by an institution-wide agreement, making the prompt unnecessary. |
|
| 7 | NRPS PII sharing cannot be configured per tool. |
|
| 8 | LTI_NRPS_DISALLOW_PII would overlap with the new controls. Retaining it would introduce another setting that could silently override the course and reusable configurations. |
|