What should a college say when a student asks, "How did you get my information?"
A college should be able to explain where a student's contact information came from, why it is reaching out and what choices the student has about future messages.
Our take on this week's coverage: answering those questions matters more than adding another layer of inferred personalization. That is an editorial judgment, not a research result or a legal rule.
College recruitment data privacy can sound like a question for a policy page. Admissions staff also need an answer they can give directly to a student, using the actual contact record.
What changed this week?
A Boston Globe opinion piece by Jon Marcus, published November 5, 2026, describes how recruitment businesses collect and use prospective student information. It brings the question of where that information comes from to a family audience.
The piece includes critics concerned about families' awareness of those practices. It also presents an industry defense: unsolicited outreach can introduce students to colleges they might not otherwise consider.
That tension deserves a plain answer. Recruiting a student does not require pretending the student already knows the school. The opinion is not evidence that every college misuses data.
What did students actually report?
The supporting survey is older than the coverage. In its 2024 vendor research, CollegeVine surveyed 3,009 high school students with CollegeVine accounts. The report gives a combined median of 1,300 college emails and print mail pieces received over the previous 12 months.
In that same vendor survey of 3,009 students, 13.6% said college outreach is a strong motivator to submit an application. That is a reported perception, not an application conversion rate.
The survey concerns volume and perceptions among the vendor's users, not a representative national sample. It did not test disclosure or data privacy practices. It cannot establish that transparency raises enrollment.
Can your team trace a contact to the message it receives?
Use this as editorial practice guidance, not a compliance checklist. Pick a current recruitment segment and follow its records from the original source through the CRM to the first message.
Complete the blank audit below from records, not staff assumptions. A segment label alone may not explain how an individual contact arrived.
Audit fields. What the record shows.
- Source of contact
- When and how it was obtained
- Recorded permission or preferences
- Actual message reason
- Person who can answer a question
- How changes or stop requests reach every relevant sending team
Unknown provenance is a data quality problem to resolve. It is not permission to invent a friendlier origin story.
Ask the privacy or legal owner to review permissions for the actual use and channel. Buying a name should not be treated as proof of permission to send text messaging.
What should you explain without pretending to know the student?
Name the actual source in language a family can understand. Explain why this message is relevant without presenting an inference as something the student said.
A recorded preference can support an accurate reference to that preference. An inferred interest cannot support "you told us" language. If staff cannot distinguish the records, fix that distinction before using it in copy.
A composed response outline, not a tested script:
We received your contact information through [actual source]. We are contacting you about [actual reason for this message]. You can reach [real person and contact route] with questions. To change future messages, [actual preference or stop option].
Replace each bracket with a verified detail. Do not use the outline when the record cannot support the answer.
After explaining the relationship, staff can ask a useful question rather than assume an interest. Survey led student search covers that separate method.
What can you check before the next send?
Have admissions and marketing staff answer the data question from the same record. Resolve conflicting explanations before they become conflicting replies to families.
Test where a reply goes and who owns the answer. Then trace a preference change or stop request through the relevant tools and sending teams. Ask privacy staff to review that actual workflow, not merely the footer.
This audit does not settle how many names to buy or prescribe a universal message cadence. For the separate buying decision, see is student search worth it.
A recognizable sender still needs a truthful explanation.
CS Enrollment Pathways uses branded, verified text messaging so students can recognize the school reaching out. That does not replace an accurate explanation of where a contact came from or the student's choice about future outreach. Sender recognition does not grant permission to contact someone.
Frequently asked questions
Is this a new 2026 survey? No. The current opinion coverage uses older supporting research. The CollegeVine survey was published in 2024.
Does a recognized sender settle a student's privacy concern? No. Knowing who sent a message does not explain how the sender obtained the contact information or what choices the student has.
Is the audit a legal compliance checklist? No. Privacy and legal staff must assess the actual use, permissions and channel. This is editorial guidance for tracing records and giving accurate answers.
If a student asked where you got their information today, could your team give the same accurate answer?
To see branded messaging from the student's side, request a walkthrough.
Sources
- Jon Marcus, Boston Globe opinion, College applicants, beware: This is peak season in the shadowy world of online recruiters. Context and commentary, not the primary source for survey figures.
- CollegeVine, Traditional marketing efforts aren't cutting it for the modern-day student. Vendor research, anonymous survey of 3,009 high school students with CollegeVine accounts. Figures on p. 7; methodology on p. 32. Not a representative national sample.
