EFF Sues Google for Snooping on Students

The Electronic Frontier Foundation on Tuesday filed a complaint with the Federal Trade Commission, alleging that Google has used personal student data mined from its school Chromebook distribution, and requesting an investigation and an injunction against the practice.

The EFF also on Tuesday launched its Spying on Students Campaign, an effort to educate parents and school administrators about the risks of data collection by companies supplying technology tools for students’ use. The campaign website offers parents and school officials tips for improving privacy.

The actions followed EFF’s reviews of Google’s Chromebook and Google Apps for Education, its suite of educational cloud-based software programs.

EFF asked the FTC to halt Google’s use of students’ personal information for its own purposes, and to order the company to destroy all collected information that does not support educational purposes.

The complaint responds to growing concerns voiced by parents of school children, said Sophia Cope, an EFF staff attorney who, along with Nate Cardozo, also a staff attorney, submitted the complaint. [*Correction – Dec. 3, 2015]

“Over the last year or two, we have been getting complaints from parents of mostly elementary school children — but we know this is also happening in K-12 schools,” Cope told the E-Commerce Times.

Cause for Concern

The intensity of the parental complaints made it obvious to EFF that the situation needed more investigation, according to Cope.

“We focused on Google because it became obvious that Google was the dominant player in the marketplace,” she said.

Under FTC rules, if a company promises to do something and then fails to do it, that becomes a case for unfair trade practices and is actionable in court, Cope noted.

“‘Privacy’ is a vague term. If a child shares something with someone in confidence and it ends up on Facebook or any other public forum, that worries me. However, Google does not track who does what in a way that would violate what most of us consider relevant privacy,” observed Michal Ann Strahilevitz, associate professor of marketing at the Victoria University of Wellington.

It is merely a case of Google wanting to send the right information to the right user, she told the E-Commerce Times. So Google tracks information that suggests what content would be relevant and effective for a given user, as well as what generally works in the aggregate.

Scope and Sequence

Google does not use student data for targeted advertising on Google sites, EFF acknowledged in its complaint.

However, Google’s practice of enabling the Chrome browser’s sync feature by default on Chromebooks sold to schools is a problem, in EFF’s view.

As a result of that default setting, Google can track students’ movements on the Internet, store the results on its servers, and abstract personal information for non-advertising purposes, the complaint notes. That spying process lets Google track every Internet site students visit and every search term they use.

Included in Google’s data mining are the search results, videos searched and viewed on YouTube, and saved passwords. The privacy invasion is worsened because Google does not first obtain student or parental permissions, according to the complaint. Since some schools require students to use Chromebooks, many parents are unable to prevent Google’s data collection.

More to It

EFF’s privacy concerns extend beyond the auto syncing feature in the Chrome browser, noted Staff Technologist Jeremy Gillula. The way Google tracks and builds behavioral profiles on students when they navigate to Google-operated sites outside of Google Apps for Education is a larger problem.

Google divides its services between Google Apps for Education, or GAFE — Gmail, Calendar, Talk/Hangouts, Drive, Docs, Sheets, Slides, Sites, Contacts and the Apps Vault — and everything else, which includes Google Search, Blogger, Bookmarks, Books, Maps, News, Photos, Google+ and YouTube.

“Google has promised not to build profiles on students or serve them ads only within Google Apps for Education services,” Gillula explained. “When a student goes to a different Google service, however, and they’re still logged in under their educational account, Google associates their activity on that service with their educational account, and then serves them ads on at least some of those non-GAFE services based on that activity.”

Policy Assessment

Google violated the privacy commitments it made when it signed the Student Privacy Pledge, which is a legally enforceable document, EFF asserted.

Companies that made the pledge agreed not to collect, use or share students’ personal information except when needed for legitimate educational purposes, or if parents provided permission.

Google initially did not sign the agreement in 2014, when “Microsoft and numerous other developers of digital curriculum and classroom management software” did, the complaint notes.

Google said its “policies and contracts already demonstrated a commitment to student privacy,” according to the complaint. Google finally did sign the agreement in early 2015.

Google did not respond to our request to comment for this story.

A Matter of Intent

What Google intended when it signed the agreement may be a deciding factor, said Stephen Moy, a software developer at Nulite Behavior Tracker.

“It’s important to look at exactly what Google promised. If it promised not to even touch the data, that’s one thing, but if it promised to not use any personally identifiable data in its collection, it may be sticking to its promise,” he told the E-Commerce Times.

The gray area is the extent to which Google uses the data, and what exactly it collects, according to Moy. If the EFF were able to produce evidence of the misuse of data, it would support its case.

At the heart of the privacy issue is Google’s customization of the services it provides based on data about user responses, noted Victoria University’s Strahilevitz.

There is nothing in that process that would result in embarrassing, shaming or humiliating a child, she maintained.

“The main risk is that they might just get better search results, ads for things they actually like, and more videos they will enjoy watching on Youtube,” she said. “This does not sound dangerous to me.”

*ECT News Network editor’s note – Dec. 3, 2015: Our original published version of this story incorrectly attributed Sophia Cope’s remarks to Nate Cardozo. We regret the error.