NSF Privacy Program

Senior Agency Official for Privacy: Dorothy Aronson

This is the central resource page for the privacy program of the U.S. National Science Foundation. It highlights how NSF collects, uses and shares information about individuals and how to contact NSF about this information and other privacy-related issues.

On this page

Web Privacy Policy

The NSF Web Privacy Policy explains what information NSF collects from you when you visit NSF.gov or subscribe to NSF e-newsletters, alerts and other email updates.

If you are visiting NSF.gov to browse, read pages or download information, we use session cookies and persistent cookies (see OMB M-10-22) to automatically gather and store certain information about your visit. This information does not identify you personally.

Session cookies last only as long as your browser is open. Persistent cookies expire after two years (if you don't clear your cookies).

How to opt out:

You can opt out of the cookies on our site by disabling cookies in your web browser. Instructions for disabling cookies in popular desktop browsers are provided on USA.gov. Opting out of the cookies on our site will not prevent you from accessing any of the information or services on our site.

We automatically collect and store only the following information about your visit:

  1. The internet domain (for example, "xcompany.com" if you use a private internet access account or "yourschool.edu" if you connect from a university's domain) from which you access our website.
  2. The IP address (a number that is automatically assigned to your computer whenever you are on the web) from which you access our website.
  3. The city you connect from.
  4. The type of browser, operating system and device used to access our website.
  5. The date and time you access our website.
  6. The pages you visit and the links and buttons you click on our website.
  7. If you were directed to NSF.gov another website, the address of that referring website.
  8. Anonymous demographic information about our visitors such as gender, age range, areas of interest and language for adults over the age of 18.

Our website team uses this information to help us make NSF.gov more useful to visitors.

Please note that NSF does not collect personal information about you when you visit our website unless you choose to provide that information to us. All information submitted by visitors is voluntary.

If you request information or services from NSF over our website and submit personal information to facilitate response to your request, we use the information provided to respond to your message. Pressing the "submit" button indicates your consent to use the information you provide for this purpose. We will not share the information you give us with another government agency unless your inquiry relates to that agency or as otherwise provided by law.

NSF uses the following third-party measurement and customization tools to understand how the public uses NSF.gov and to make improvements to the website's content and design.

Crazy Egg

NSF uses JavaScript provided by Crazy Egg to obtain information on how visitors are interacting with specific NSF webpages. The data Crazy Egg collects include information about how visitors navigate around a webpage and the most clicked links on a specific webpage. Crazy Egg does not collect personally identifiable information.

Read the Crazy Egg Privacy Policy.

 

Google Analytics (Digital Analytics Program)

NSF participates in the government-wide Digital Analytics Program (DAP), which uses JavaScript-based tools provided by Google Analytics to collect the website visitor information listed in the "Information we gather" section above. NSF and the Digital Analytics Program do not collect personally identifiable information. The DAP code anonymizes IP addresses at the earliest available point and the original IP address is not stored at any point.

In addition to DAP, NSF uses non-DAP Google Analytics to understand which links, buttons, tabs and search filters are most popular so that we can develop site features and improve our visitors' user experience. As with DAP, IP addresses are anonymized and never stored.

Anonymous demographic information is gathered using Google Demographics reports. When you visit a website that has partnered with the Google Display Network, Google stores a number in your browser using a persistent cookie to remember your visits. This number uniquely identifies a web browser, not a specific person. Browsers may be associated with a demographic category, such as gender or age range, based on the sites that were visited.

You can opt out of all Google Analytics tracking by installing a browser extension available for most major browsers. 

Read the Google Privacy Policy.

 

Webtrends

NSF uses software provided by Webtrends to collect and analyze visitor data for some of its website properties. Data collected from embedded JavaScript is sent to an internal NSF server. No personally identifiable information is collected or stored.

Although nsf.gov discontinued use of Webtrends analytics, some NSF sites, such as research.gov, continue to use it.

Read the Webtrends Privacy Policy.

NSF uses GovDelivery to send e-newsletters, alerts and other messages to individuals who subscribe to them. To subscribe to receive these emails, you must provide an email address and indicate your subscription preferences, including the items you want to receive.

NSF's email subscriber lists are password protected by GovDelivery. Only the NSF managers who send newsletters, alerts or memos via GovDelivery and the staff members who monitor the results of email initiatives have access to the subscriber lists. GovDelivery never allows access to the subscriber lists to anyone outside of NSF for any purpose.

GovDelivery collects and provides non-identifying information about the number of messages sent, clicks and open rates. This information is password protected and only available to NSF managers, system owners, communications staff, web teams and other designated staff who require this information to perform their duties.

Read the GovDelivery Privacy Policy.

NSF uses third-party social media websites to disseminate mission-related information that has been collected and approved for public dissemination.

NSF does not own, manage or control the applications used on third-party social websites. NSF does not collect, maintain or disseminate personally identifiable information from individuals who interact with the agency's accounts on third-party social websites. Although some social websites, such as YouTube, Facebook and X (formerly Twitter), may request information, such as a name, email address and birth date, at the time of registration, the agency does not collect, maintain or disseminate personally identifiable information from individuals who interact with the agency's account.

Links to NSF accounts on third-party social websites and the privacy policies of those social websites can be found on NSF's Social Media page.

The "Children's Online Privacy Protection Act" (COPPA) governs information gathering online from or about children under the age of 13. Verifiable consent from a child's parent or guardian is required before collecting, using or disclosing personal information from a child under the age of 13.

We collect no information about you or your child, other than that detailed above, when you visit our website unless you choose to provide information to us. If an NSF website needs to collect information about a child under 13 years old, COPPA-required information and instructions will be provided by the specific webpage that collects information about the child. The webpage will specify exactly what the information will be used for, who will see it and how long it will be kept.

There are several exceptions that permit collection of a child's email address without receiving parental consent in advance:

  • To provide the parents with notice and to seek consent for communications with the child. Note: this may require collection of the parent's email address as well.
  • To respond to a one-time request from a child.
  • To respond more than once to a child's request (i.e., subscription to a newsletter). However, parental consent is required prior to the second communication.
  • To protect the safety of a child who is participating on the site (i.e., in a chat room).
  • To protect the site or to respond to law enforcement (i.e., in the case of a website compromise).

Personal information about children under 13 years of age may be needed to respond to their communication to us, such as to receive a publication.

Personal information about your child will be destroyed immediately upon completion of its intended purpose.

Finally, we provide many online tools and services in support of NSF's mission. A child under 13 years old may inadvertently provide personal information to one of these services. If this should happen, the information about the child will be deleted immediately upon discovery.

For website security purposes and to ensure that NSF.gov remains available to all users, NSF employs software programs to monitor network traffic to identify unauthorized attempts to upload or change information, or otherwise cause damage to the information on our websites. Unauthorized attempts to upload information or change information on NSF.gov are strictly prohibited and may be punishable under the "Computer Fraud and Abuse Act of 1986" and the "National Information Infrastructure Protection Act of 1996."

System Of Record Notices

A system of records is a group of records controlled by an agency from which information can be retrieved by the name of an individual or other personal identifier. Such agency record systems are protected by the "Privacy Act of 1974." NSF publishes a System of Records Notice (SORN) in the Federal Register whenever it creates, modifies or decommissions a system of records.

For a particular system of records, a SORN provides information on:

  • The types of information contained in the records.
  • The legal authority for collecting and maintaining these records.
  • How NSF uses the records.
  • The purposes (known as "routine uses") for which NSF may disclose the records.
  • Whether any records are exempt from certain "Privacy Act" requirements.

Standard routine uses where NSF may disclose records

The following standard routine uses apply, subject to the "Privacy Act of 1974," except where otherwise noted, to each system of records maintained by NSF:

Information from a system may be disclosed to congressional offices in response to inquiries from these offices made at the request of the individual to whom a record pertains.

Information from a system may be disclosed to the Department of Justice or the Office of Management and Budget in order to obtain advice regarding NSF's obligations under the "Freedom of Information Act" and the "Privacy Act."

Information from a system may be disclosed to NSF's legal representatives, including the Department of Justice and other outside counsel, where the agency is a party in litigation or has an interest in litigation, including when any of the following is a party to litigation or has an interest in such litigation:

  1. NSF, or any component thereof;
  2. any NSF employee in his or her official capacity;
  3. any NSF employee in his or her individual capacity, where the Department of Justice has agreed to, or is considering a request to, represent the employee; or
  4. the United States, where NSF determines that litigation is likely to affect the agency or any of its components.

Information from a system may be disclosed to representatives of the General Services Administration and the National Archives and Records Administration (NARA) during the course of records management inspections conducted under the authority of 44 U.S.C. 2904 and 2906.

Information from a system may be disclosed to appropriate agencies, entities, and persons when:

  1. NSF suspects or has confirmed that the security or confidentiality of information in the system of records has been compromised;
  2. NSF has determined that as a result of the suspected or confirmed compromise there is a risk of harm to economic or property interests, identity theft or fraud, or harm to the security or integrity of this system or other systems or programs (whether maintained by NSF or another agency or entity) that rely upon the compromised information; and
  3. the disclosure made to such agencies, entities, and persons is reasonably necessary to assist with NSF's efforts to respond to the suspected or confirmed compromise and prevent, minimize, or remedy such harm.

Information from a system may be disclosed to the Department of Justice or other agencies in the event of a pending court or formal administrative proceeding, when records are relevant to that proceeding, for the purpose of representing the government, or in the course of presenting evidence, or they may be produced to parties or counsel involved in the proceeding in the course of pre-trial discovery.

Information from a system may be disclosed to contractors, agents, experts, consultants, or others performing work on a contract, service, cooperative agreement, job, or other activity for NSF and who have a need to access the information in the performance of their duties or activities for NSF.

Information from a system may be disclosed to government agencies and other entities authorized to perform audits, including financial and other audits, of the agency and its activities.

Information from a system may be disclosed to appropriate federal, state, or local agencies responsible for investigating, prosecuting, enforcing, or implementing a statute, rule, regulation, or order, to disclose pertinent information when NSF becomes aware of an indication of a violation or potential violation of civil or criminal law or regulation.

Information from a system may be disclosed to federal, state, or local agencies which maintain civil, criminal, or other relevant enforcement information or other pertinent information, such as current licenses, if necessary, to obtain information relevant to an agency decision concerning the hiring or retention of an employee, the issuance of a security clearance, the letting of a contract, or the issuance of a license, grant, or other benefit.

  1. a matter has become public knowledge;
  2. the NSF Office of the Director determines that disclosure is necessary to preserve confidence in the integrity of NSF or is necessary to demonstrate the accountability of NSF's officers, employees, or individuals covered by this system; or
  3. the Office of the Director determines that there exists a legitimate public interest in the disclosure of the information, except to the extent that the Office of the Director determines in any of these situations that disclosure of specific information in the context of a particular case would constitute an unwarranted invasion of personal privacy.

NSF's SORNs are detailed below:

Privacy Impact Assessments

A Privacy Impact Assessment is an analysis of how personally identifiable information is being collected, used, shared and maintained.

These assessments, which are required by the "E-Government Act of 2002," help ensure that privacy protection is incorporated throughout the development of an NSF program or system.

Information Technology SystemPrivacy Impact Assessment"Privacy Act" System of Records Notice
Electronic Jacket (eJacket)Electronic Jacket (eJacket) PIA

NSF-12: Fellowships and Other Awards

NSF-50: Principal Investigator/Proposal File and Associated Records

NSF-51: Reviewer/Proposer File and Associated Records

FastLaneFastLane PIA

NSF-12: Fellowships and Other Awards

NSF-50: Principal Investigator/Proposal File and Associated Records

NSF-51: Reviewer/Proposer File and Associated Records

Health RecordsHealth Program Records PIANSF-79: NSF-Health Program Records
iTRAKiTRAK PIA

NSF-10: Employee Payroll Jacket

NSF-13: Fellowship Payroll

NSF-22: NSF Payroll System

NSF-53: Public Transportation Subsidy Program

NSF-57: Delinquent Debtors File

NSF-65: NSF Electronic Payment File

GOVT-3: Travel Charge Card Program

GOVT-4: Contracted Program Travel Services

MyNSFMyNSF PIA

NSF-12: Fellowship and Other Awards

NSF-50: Principal Investigator/Proposal File and Associated Records

NSF-51: Reviewer/Proposal File and Associated Records

Research.govResearch.gov PIANSF-72: Research.gov
Scientist and Engineers Statistical Data System (SESTAT)SESTAT PIA

NSF-43: Doctorate Work History

NSF-58: National Survey of Recent College Graduates

Social MediaSocial Media PIA 
Staff and Visitor Medical InformationStaff and Visitor Medical Information PIANSF-78: NSF Staff and Visitor Medical Information
Survey of Doctorate Recipients (SDR)SDR PIA 

Additional "Privacy Act" information

Making a "Privacy Act" request

Visit the NSF "Freedom of Information Act" (FOIA) and "Privacy Act" page for instructions on submitting a "Privacy Act" request for access to NSF records that may contain personal information about yourself. (You will be required to verify your identity.)

  • Your request will be processed under the "Privacy Act of 1974" to see if there are any NSF records that NSF maintains and retrieves from an NSF "Privacy Act" system of records (see above SORNs) by your name or other personally assigned identifier.
  • NSF will also conduct a search under the FOIA for any other NSF records that may contain information about you but are not maintained in a "Privacy Act" system of records retrieved by your name or other personally assigned identifier.

If you have any questions about making a "Privacy Act" request or the status of your request, please contact NSF's FOIA/Privacy Act Officer at foia@nsf.gov.

"Privacy Act" exemptions

"Privacy Act" implementation rules

How to contact us

If you have a question, complaint, or suggestion relating to NSF's privacy program, please contact us at privacy@nsf.gov.

Top