“So, where else are you applying?”

It’s a question—sneaky, disquieting, and likely familiar to anyone who’s applied for a job—that used to be asked by many of America’s 4,800 colleges. Nervous applicants’ answers could be taken, sometimes unfairly, as indicators of how likely they were to accept an offer of admission; colleges might then make strategic acceptances to maintain high enrollment rates.

Good news for applicants: that’s no longer allowed. New federal rules, announced Sept. 14, prohibit colleges from peeking at kids’ financial aid forms to see where else they’re applying, and the National Association for College Admission Counseling (NACAC) barred member colleges from directly asking, too, earlier this month.

But it’d be wrong to think this means colleges won’t get an extensive amount of other data on their applicants. As a Sept. 28 story in the Chronicle of Higher Education (paywall) noted, colleges are increasingly trying out new practices—and new tools—to “get inside” students’ minds.

Some schools tally how many times an applicant visits its web site; others sell themselves with personally targeted messages. Logging students’ internet-wide browsing is another option being explored.

Several of these practices toe an ethical line. And if the quiet tracking of students across the web seems uncannily similar to the data-mining behavior of giants like Facebook and Amazon, that’s because it is.

Creeping competition…

A handful of decades ago, an applicant’s visit to a college campus was a surefire sign of interest.

But the nature of the game has changed. High school students today, bombarded by brochures and advertisements, are applying to more colleges than ever before. The centralized Common Application allows as many as 20 applications per student. Students cherrypick schools after raking in acceptance letters, and it makes colleges antsy.

The high-ranking elites—Harvard, Stanford, and the like—don’t need to worry much, because most kids would pick them in a heartbeat. But for a lesser-known school, it’s imperative that the thick envelopes go to committed students, not the ones tossing in applications as an afterthought. Otherwise, the school’s yield rate dips and it seems undesirable or mediocre (not to mention that it hemorrhages money). Who, after all, wants to go to a college that everyone else rejects?

Such concerns have led to the rise of educational data mining. Armed with sophisticated software and huge data sets, low- or mid-ranking colleges can track loyal fans and grab students’ interest with customized messages, just like how Amazon mines customer data to sell tailored products. Some call it a much-needed advancement—while others see it as sinister.

Todd Rinehart, the chair of the NACAC’s admission practices committee, tells Quartz that it is “perfectly acceptable” for a school to probe its applicants’ interest levels, as long as they don’t use ”unfair” information, like the now-banned questions about other colleges. The question, then, is whether unsuspecting students’ online habits are fair game. While many schools look at kids’ social media, browsing activity is quite different.

“Is data mining bad? I’m not sure. But students are applying to 10, 14 schools now and they used to apply to two or three—so schools need to have some way to predict who’s going to enroll,” Robert Massa, senior vice president for enrollment and institutional planning at Drew University, tells Quartz. Drew’s enrollment office uses multiple data points to make predictive models. “In order for colleges to continue fulfilling their mission, they need to have students,” Massa adds.

It’s smart business, certainly. But the practice risks turning schools from educational institutions into just that—businesses.

…and competitive creeping.

If the “why” to the issue is muddy, the “how” is even trickier.

Capture Higher Ed, a Kentucky-based start-up, is one of several companies that sell data-pulling software to colleges, helping them develop better enrollment strategies by tracking young users’ activity on their websites.

“We take all this fire hose of data and generate predictive algorithms for enrollment,” Thom Golden, Capture’s vice president of data science, says to Quartz. “The technology is certainly out there … [college admissions] is an industry that needs change. The way I describe it, we’re trying to bring Amazon to higher education.”

Online shopping giant Amazon is notorious for collecting user data—such as order history, geographic location, and time spent on pages—to develop personalized relationships with its millions of consumers and predict future purchases. Although successful, retail data mining has also drawn its share of backlash for being uncomfortably invasive.

Capture Higher Ed’s software is similarly built. In a demo to Quartz, the company showed how anonymous visitors to a school’s website are given an “engagement score,” which rises depending on how often, or how long, the person browses. Then, if an applicant clicks on the school’s page from a customized email, their IP address is connected to their “anonymous” activity, and school administrators can see exactly who that person is—their email, their location, their engagement ranking, and more.

Capture’s customized software ranges from $60,000 to $120,000 and has already been sold to 20 schools in the US, including the University of Iowa and the University of Pittsburgh. The proliferation of data-mining software highlights just how much colleges care about admitting students who show the most interest.

Golden stresses that all his company’s client schools are encouraged to be transparent to high school students, since privacy—especially that of children and teenagers—is a priority. Still, whether or not to disclose data-mining activities is up to the colleges themselves, he says.

Rinehart and Massa both note that most data-mining colleges use the information to make overall enrollment guesses, not to kick out individual applicants. Golden says that to his knowledge, none of Capture’s clients use his software in the actual admissions process—only as a way to better understand and reach their applicants. But it’s an honor code to which colleges aren’t really bound, legally or otherwise.

A game in which all the rules have changed

“The system,” says David Petersam, an admissions consultant in Washington D.C., “has been gamed for a long time.”

Petersam tells Quartz that the college admissions process has never been ideal, since schools have always drawn their own private conclusions on applicants. ”As an advocate for the applicant, I’m wildly happy colleges can’t ask students to rank [their other choices] anymore,” he says. But taking information without students’ knowledge, through quiet digital methods, still tilts the playing field a mighty amount.

What’s more, Petersam says, is that data-mined information poses the risk of being wrong. A student might obsess over a college, but stay away from its website out of anxiety. Others may wistfully check their dream school’s site every day, all the while knowing that parental or financial pressure will force them to go elsewhere. Cases like these are bound to result in inaccurate software predictions, possibly leading to flawed admissions decisions.

But software-based enrollment modeling isn’t likely to slow, especially when it brings a flood of new data to an industry previously stumbling in the dark. It seems the responsibility of students, now, to learn to game this new system, showing—whether through web clicks, or traditional media like essays and interviews—that they’re die-hard passionate about a school.

“If you’re really interested, you’ve got to show [colleges] you’re interested,” Massa emphasizes. ”And data’s being collected by everyone—I think [applicants] know that. I don’t think this generation would be particularly surprised.” He falls back on the example used by many others: “Just go on Amazon, and see what happens.”

Alternatively, students could delete all their digital accounts and mail in paper applications. But that would probably raise more suspicion than it’s worth.