Supporters say this kind of data analysis is legal and can be performed with students' interests in mind. Timothy Renick, the vice president for enrollment management and student success at Georgia State, said the university is "resoundingly confident" that it's complying with the Family Educational Rights and Privacy Act, federal legislation that addresses the collection and use of student data in higher education. Using information to benefit students, he said, "is exactly why we have access to the data in the first place."

But the practice still raises privacy and ethics concerns, according to Joel Reidenberg, the founding academic director of Fordham University's Center on Law and Information Policy. Even when colleges collect aggregate data and scrub it of personally identifiable information, that still counts as surveillance if they use it to guide individual students, he said: "You have to do the data-mining to be able to profile the individual. And you're taking action based on the data-mined profile."

Renick said that Georgia State has considered whether students should be told that universities are mining their data. If a student were to complain, he said, the university would stop tracking them. But so far, according to Renick, the university's received nothing but positive feedback from students.

It is now routine for all kinds of websites to customize users' experiences based on data analytics. Young people have different expectations of privacy than do older generations; after all, they grew up sharing personal information on social media. "What's happening now with the university's interaction with them is not that different from what's been happening on Facebook and other places—Amazon, and so forth," Renick said.

The average college has nothing close to the analytic capacity of Facebook or Amazon. But colleges in theory could data-mine almost every aspect of a student's life. Institutions can track what students say in online class forums, who downloads the lecture notes, and how long they spend reviewing online material. Institutions can record when and where students swipe their ID cards to follow their physical movements, from the dining hall to the health center.

To engage in these practices, institutions typically build or purchase software—the Knewton Platform, for example—that analyzes every keystroke a student makes to figure out his or her learning style. "The NSA has nothing on the ed tech start-up known as Knewton," Politico wrote earlier this year. Some of the data these learning applications collect doesn't fall under the federal government's definition of "educational record," and thus doesn't fall under laws that restrict the kind of information colleges can and cannot share with third parties.

But some experts are starting to question how this type of universal data collection could affect the educational experience. One of them is Matt Pittinsky, the technology entrepreneur who cofounded the learning-management system Blackboard and currently serves as the CEO of Parchment, another education technology company. Though Pittinsky, who also teaches sociology at Arizona State University, believes that most colleges analyze too little data (and thus fail to address completion and quality issues), he's sometimes troubled by what he hears at ed-tech conferences about the big-data movement. Last year, he even challenged a fellow panelist on comments made about the potential of universal data collection in higher ed: "I just sort of stopped and said, 'I think you're describing a state of education where every interaction a learner is having with a faculty member and with each other [online] is tracked and used to form judgments about them, to form judgments about people like them, to form judgments about the next group of people like them.'"