Students' personal information has become a bargaining chip for black and gray industry. Reporters found that harassing calls were frequent after registering on campus dating apps.

Recently, public security agencies in Sichuan, Shanxi and other places have successively uncovered major cases of illegal reselling of students' personal information: "insiders" on campus exported data in violation of regulations, operation and maintenance personnel supervised theft, and intermediaries resold it at higher prices. A dark and gray industry chain of illegal reselling of students' personal information has emerged.

At the same time, reporters from the "Rule of Law Daily" conducted real-name registration tests on a number of campus dating software, using an exclusive surname tracing method to investigate the source of leaks. Soon after registering, they received numerous harassing calls related to credit and part-time jobs.

How does students' personal information flow out of campuses, platforms, and institutions, and how is it resold in the black and gray industry chains? The reporter conducted an interview on this.

Harassing phone calls come one after another

Many students interviewed said that they frequently use a variety of campus walls, campus social networking, and student-specific dating apps on a daily basis. This type of platform focuses on functions such as campus friendships, mutual aid in the same city, and campus tree holes, and is very popular among students. In order to test the information security of the platform, the reporter conducted real-name registration experiences on a number of popular campus dating software; when registering for different software, the reporter deliberately reserved exclusive surname information with different degrees of distinction to investigate information leakage channels and eliminate other interfering factors.

In just a few days after the registration was completed, the reporter's mobile phone received frequent harassing calls from strangers. The types were highly concentrated and were mainly divided into two categories:

One type is credit loan sales calls. The callers have uniform speech skills, repeatedly ask whether they have financial needs, and actively promote various loan businesses, claiming that "if you have a bad credit report and no credit record, you can still apply for a loan." The other type is part-time recruitment harassment calls. The other party frequently pushes various unfamiliar part-time positions and constantly asks if they need part-time work.

Many college students from different universities have also encountered troubles caused by the leakage of personal information.

Jiang, a student majoring in journalism and communication at a university in Beijing, filled in his mobile phone number on a certain platform to receive postgraduate entrance examination preparation materials. After submitting the form, the number of harassing calls increased significantly, and a platform staff member repeatedly promoted postgraduate entrance examination training courses to her. She contacted customer service and asked to stop calling, but it didn't work. It wasn't until she was informed clearly that she would initiate a complaint that the harassing calls finally stopped.

Zhang, a first-year graduate student majoring in finance at another university, receives harassing phone calls every half month or so. He had browsed fitness-related content, and since then the calls from the gym started coming. "It is possible that the platform collected my browsing behavior data and gave the fitness requirement tags and contact information to the merchants." Zhang said, "Many small programs and apps now require mobile phone number authorization, and it is difficult to confirm which operation caused the information leakage."

Liu, a senior student at a university who is currently looking for a job, will receive harassing phone calls every three or four days. Some callers can even accurately report his name, school, and age. The clues to the information leakage pointed to an offline interview: He truthfully filled out the paper personal information registration form on the spot. After the interview, a large number of sales calls for skills training under the banner of "guaranteing employment" continued for half a month.

Information leaks don't stop at college campuses. Many parents of primary and secondary school students are also frequently harassed by agents because their children's personal information has been leaked.

A parent of a student from Hunan recalled to reporters that when his child was in his third year of high school, he frequently received calls from unknown people. The other party used the gimmick of "guaranteing admission quota" to persuade parents to pay relevant fees in advance.

A parent from Zhejiang said that his child, who is in the fourth grade of elementary school, often receives text messages and harassing phone calls from various marketing companies. He blocked the caller number, but a steady stream of virtual numbers and real mobile phone numbers still came in.

Case uncovers information black market

The leakage of students' personal information is not an isolated case. Reporters combed through public reports and found that in recent years, many cases of extremely serious infringement of citizens’ personal information have been uncovered. The common feature is that the source of leaks is often internal personnel of the organization who take advantage of their positions to "steal and steal".

For example, the Cyber ​​Security Bureau of the Ministry of Public Security released a typical case of cracking down on citizens’ personal information infringement crimes in August 2026. It showed that the Taiyuan Public Security Cyber ​​Security Department in Shanxi Province cracked the case of Wang Moujie and others infringing citizens’ personal information by starting with “precision sales” calls from education and training. After investigation, Wang Moujie illegally exchanged and sold student data with multiple education and training institution staff members during his tenure at the education and training institution, and purchased a large amount of student personal information from staff at multiple eye hospitals and schools in order to meet enrollment targets, forming a criminal industry chain of "insider theft, industry reselling, and precision marketing." Wang Moujie and others illegally obtained more than 500,000 pieces of citizens' personal information, involving more than 300,000 yuan. 12 criminal suspects have been prosecuted in accordance with the law.

Why has student personal information become the “hot meat” of black and gray products? Zhang Jihong, a specially invited researcher at the Internet Rule of Law Research Institute (Hangzhou), analyzed that students’ personal information is highly complete and has great commercial value. It usually covers multi-dimensional content such as name, gender, ID number, household registration, student status, school and class, guardian contact information, home address, etc. The data integrity and accuracy are far better than ordinary user information, and can accurately match various marketing needs.

"Secondly, schools lack professional data security capabilities. The core function of schools is education and teaching, and it is not a professional data processing and management institution. There is a common problem of the absence of information security systems. Some colleges and universities do not have full-time personal information security managers, and the information security configuration of primary and secondary schools is even weaker; some schools do not regularly invest in special funds for campus network operation and maintenance, data security protection, etc., and lack complete information storage, Permission management and risk prevention and control mechanisms have led to security loopholes in the storage, transmission, operation and maintenance of students' personal information, which can easily be illegally stolen, leaked and abused. "Zhang Jihong said, "In addition, the leakage of student personal information has the characteristics of concealment and lag, making it difficult to detect infringement in time; ordinary students and guardians generally lack the technical ability to trace the source and obtain evidence, and cannot accurately locate the information leakage link and fix the evidence of infringement. "

Gao Pan, a member of the Lawyer Expert Database of "Rule of Law Daily" and a lawyer at Beijing Jiarun Law Firm, told reporters that the illegal and criminal chain of students' personal information trafficking can be divided into three links: the front, the middle, and the back. At the front end, schools and training institutions excessively collect student and parent information, and internal staff's self-monitoring is an important inducement for leaks; at the middle end, the information is aggregated and processed, and then disseminated and sold on relevant platforms; at the back end, training institutions, enrollment agencies and even fraud gangs use this information for precision marketing or telecommunications network fraud.

Work together to build a closed loop of governance

Students’ personal information is frequently leaked, what is the path to governance? The interviewed experts put forward suggestions from multiple dimensions such as system construction and department coordination.

Zhang Jihong believes that it is urgent to build a full-process closed-loop governance system. The first is to implement the registration access mechanism and comprehensively implement the registration management system for educational apps. Apps that have not been registered or have failed to pass the registration are strictly prohibited from being used in campus settings. The "necessary personal information list" for educational scenes will be further refined to include schools, platforms, operation and maintenance service providers, education and training institutions and other entities within the scope of the list. The second is to improve the normalized compliance audit mechanism and fully include outsourcing operation and maintenance and other related service links into the scope of compliance audit. The third is to strengthen special supervision and spot inspections and multi-party co-governance, strictly implement the personal information protection responsible person system, and at the same time link up the procuratorial public interest litigation system, integrate school management, parent supervision and other social forces to build a multi-dimensional co-governance pattern.

Gao Pan suggested from the perspective of departmental collaboration that education, industry and information technology, public security, market supervision and other departments need to form institutional synergies at every key node. The education department is at the forefront of the governance chain and should promote schools to establish internal data management systems and implement education data classification and grading requirements; industry and information technology departments should strengthen the management of telemarketing links, handle harmful information in accordance with the law, and strengthen the monitoring and disposal of batch outbound call numbers and labeled harassing marketing numbers; public security agencies should insist on a full-chain crackdown, not only cracking down on middlemen who resell information, but also tracing the source of "insiders" who leak secrets.

In terms of long-term improvement of the system, interviewed experts mentioned that there is still room for optimization of the existing personal information protection framework. The notification and authorization mechanism can be further optimized, differentiated protection rules can be established for students of different ages, and the tilted protection of the information rights of minors can be strengthened.

The experts interviewed agreed that the management of student personal information leakage is a systematic project from source collection to end use. Only by consolidating the responsibilities of schools, training institutions, Internet platforms, etc., public security agencies cracking down on "insiders" who leak secrets and middlemen who resell information throughout the chain, and multiple departments working together to cut off the entire black and gray industry chain can the personal information security of young people be protected. (Reporters Han Dandong and Wen Lijuan)