Respondus LockDown Browser Data Collection on Mac (Server-Side Detail)

Last updated 2026-05-02 · LDBypass Editorial

The data Respondus actually receives

Per-session telemetry (always sent)

• Hostname (your Mac's name, e.g. "Jane's MacBook Pro").
• macOS version + LDB version + LMS type (Canvas, Blackboard, etc.).
• Hardware UUID (the same identifier used by Apple for device identification).
• Default browser, install language.
• Network IP at exam time.
• Session start time, end time, exam ID, your LMS account identifier.
• Process scan results (which blacklisted apps were running, if any).
• Permission grants given (Camera, Microphone, Screen Recording).

Recording artifacts (Respondus Monitor only)

• Webcam video (entire exam duration, encoded H.264 typically, 480p-720p).
• Microphone audio (entire duration, AAC encoded).
• Periodic screen captures (typically every 30s or every page transition, JPEG).
• Pre-exam ID photo (single JPEG, ~300 KB).
• Environment scan video (short MP4, 5-15 seconds).

Behavioral flags (Monitor)

• Face presence/absence flags (timestamped intervals when your face wasn't detected).
• Multiple-faces flags (when more than one person is in frame).
• Audio anomaly flags (talking, second voice, background noise).
• Window-switch attempt logs (every keyboard shortcut that tried to leave kiosk mode).
• Camera-tampering flags (covered camera, camera disconnected, camera angle drift).
• "Suspicious" overall score per session (machine-learning composite).

Where the data is stored

Per Respondus's privacy policy:

• Storage region: United States (AWS infrastructure).
• Encryption at rest: AES-256 (per Respondus's SOC 2 Type II compliance documentation).
• Encryption in transit: TLS 1.2+.
• Access controls: Role-based; institution's instructors and authorised support staff only.

Retention period

The default retention is 5 years after the academic term ends. This is configurable by each institution; some have shorter retention agreements, some have longer for accreditation purposes.

Practical implication: a webcam recording of you taking a final in your dorm room may be on Respondus's servers until 2030 or beyond, even after you graduate. Your name, student ID, and biometric data (face, voice) are associated with that recording for the entire retention window.

Who can access your data

1. Your instructors - anyone with instructor-level access to the assessment in your university's Respondus Dashboard.
2. Your university IT - Dashboard administrators.
3. Respondus support staff - when your institution opens a support ticket referencing your session.
4. Law enforcement - Respondus's privacy policy commits to responding to legal process. Subpoenas, court orders, valid warrants → access provided.
5. Your future self - you can request access to your own data via Respondus's privacy policy contact (GDPR / CCPA / FERPA right of access).

What rights you have

• Right of access (CCPA, GDPR, FERPA): request a copy of your data. Email Respondus's privacy contact (in their privacy policy).
• Right of deletion (CCPA, GDPR): request data be deleted. Note: educational records under FERPA are sometimes exempt.
• Right to know third parties: Respondus discloses sub-processors (AWS, etc.) in their privacy policy.
• Right to object to processing (GDPR): if you're an EU student, you can object on legitimate-interest grounds.

What you can do to limit collection

1. Take the exam in a private, neutral environment (your face + voice are recorded regardless; the room contents are also captured during the environment scan).
2. Don't store sensitive context near the camera (papers, screens, identifying objects).
3. Use a borrowed Mac that doesn't contain personal data.
4. After the exam, request your data via the privacy policy if you're curious about what was collected.
5. Consider in-person alternatives if your university offers them.