The way in which privacy settings are applied in the Users REST API will change in the September 2026 release (4001.0) of Blackboard LMS. Name and avatar information is considered directory information and handled slightly differently than other sensitive personal information. Going forward, users' individual privacy settings will apply to these data fields similarly to the way it's applied to other personal information fields.

On their profile page, users can select their privacy level as one the following: only instructors, anyone in my courses, and anyone on the platform. When a student has selected "only instructors" as their privacy setting, the directory information (name and avatar) will still be available to classmates so that communication and engagement tools work correctly. However, other users who aren’t classmates will now be restricted access to directory information unless the privacy setting “anyone on the platform” is selected. Other personal information data will continue to be restricted according to the selected privacy level.

This change is to improve the security stance for institutions that have data overlap between this directory information and user credentials. REST API applications that expect users to have access to basic directory information could be impacted. Application and integration owners using the Users REST API should review their solutions for potential impact.

Applications that use individual users' privileges to retrieve name and avatar data may need to be adjusted. A non-privileged user will only be able to retrieve some users' data depending on privacy settings managed by other users. If broader access is needed, the application should be updated to use a privileged REST application user. This is a Blackboard user with system role privileges that include read access to all users: "Administrator Panel (Users) > Users."

See developer documentation for more details.

Note: This is a behavior change, not an API version change. Existing integrations calling current endpoints may receive fewer data after the update. No endpoint paths or HTTP status codes change.

Previously, REST application users would have access to very basic directory information, specifically avatar and name. This behavior was akin to the way many social media websites work, from LinkedIn to Instagram. This allowed developers to create tools that also had social elements where users could discover and connect with each other using only very basic information. Other more sensitive personal information is constrained to privacy settings individual users can control on their profile page.

In social media sites, login user credentials typically have no relationship to name information. In educational settings, the username for a person is sometimes derived from name information. The pattern for the usernames at an institution is often easy to determine from public sources. It is a security best practice to minimize exposure of any part of an access credential, including username.

This change will harden the Blackboard security stance for institutions who leverage name data as part of an authentication credential and will give users broader control over the exposure of this data.

For developers who have social connection features in their tools, they should transition their apps to use a privileged REST application user. See developer documentation for more details.