Data Privacy

EFF Complaint Charges Google with Collecting Student Data Despite Privacy Pledge

• By Dian Schaffhauser
• 12/02/15

Schools are handing over student data in exchange for access to free apps and low-cost computers. That's what one might conclude based on a complaint just filed by the Electronic Frontier Foundation (EFF) with the Federal Trade Commission (FTC) against Google. Alongside the complaint, the organization also introduced a new site that addresses the challenges of maintaining student privacy.

In the complaint, the organization accused the search company of violating the terms of the Student Privacy Pledge, which it signed alongside 204 other companies. The pledge, a voluntary program put together by the Future of Privacy Forum and the Software & Information Industry Association, is intended to allow companies to show their commitment to safeguarding student privacy related to the collection, maintenance and use of student personal information. Among those rules is one that holds school service providers accountable for using data "for authorized education purposes only."

However, EFF said Google's practices related to Google for Education and Chromebook laptops "fly in the face" of the privacy commitment in three ways:

• When students are logged in to their Google accounts, data tied to their use of non-educational Google services is collected, maintained, and used by Google "for its own benefit, unrelated to authorized educational or school purposes";
• The "Chrome Sync" feature of Google's Chrome browser is turned on by default on all Google Chromebook laptops — including those sold to schools as part of Google for Education — enabling Google to collect and use students' entire browsing history and other data for its own benefit; and
• Google for Education's administrative settings, which allow staff to control settings for school Chromebooks, also allow them to choose settings that share student personal information with Google and third-party sites without prior consent from the student or his or her family.

EFF has also launched a site, "Spying on Students," to educate district administrators and families about the use of school-issued technology and the impact it can have on student privacy. "It's great to see technology embraced in the classroom, but some of these devices can jeopardize students' privacy as they navigate the Internet — including children under the age of 13," the site noted in a frequently asked questions page about the new program.

In 2014 Google publicly claimed 30 million users for its education suite, Google Apps for Education. The EFF campaign was created, the organization asserted, to raise awareness about the privacy risks of that software as well as the devices issued by schools to run it.

EFF said that when it examined Google's Chromebook and its applications, it found numerous ways in which student personal information was being collected and used by the company for its own benefit. For example, the Sync feature for the Chrome browser "allows Google to track, store on its servers, and data mine for non-advertising purposes, records of every Internet site students visit, every search term they use, the results they click on, videos they look for and watch on YouTube, and their saved passwords, no matter whether they're using the Chromebook or some other device for that access." Google does all of this, the complaint stated, without first obtaining permission from the student or the student's family. And because "some schools require students to use Chromebooks," parents can't prevent the data collection from happening.

The EFF is pursuing its complaint through the FTC because the commission has in the past taken actions against companies that have made privacy-related guarantees to customers and "then violated those promises." In fact, the FTC has a page on its site that addresses that very point: "When companies tell consumers they will safeguard their personal information, the FTC can and does take law enforcement action to make sure that companies live up these promises."

"Despite publicly promising not to, Google mines students' browsing data and other information, and uses it for the company's own purposes. Making such promises and failing to live up to them is a violation of FTC rules against unfair and deceptive business practices," said EFF Staff Attorney Nate Cardozo in a prepared statement. "Minors shouldn't be tracked or used as guinea pigs, with their data treated as a profit center. If Google wants to use students' data to 'improve Google products,' then it needs to get express consent from parents."

According to the EFF, Google told the organization that it would soon disable the default Chromebook Sync data setting, "a small step in the right direction." But, the EFF added, "It doesn't go nearly far enough to correct the violations of the Student Privacy Pledge currently inherent in Chromebooks being distributed to schools."

According to the complaint, Google has "represented" to EFF that collection of certain kinds of data was necessary to provide a "seamless experience" for the student across devices. However, the EFF wrote, because students also use computers and access the Internet for "non-academic reasons," Google was in the position to collect, maintain and use data such as student browsing history and passwords for purposes beyond the educational ones.

The complaint concludes with several requests: The EFF asks the commission to "order Google to destroy ALL personal student information collected"; to let students and their parents know what data was collected; to stop Google from collecting and using student data for educational purposes without getting prior permission first; or to withdraw from the Student Privacy Pledge altogether.

Google did not respond to a request for comment before publication of this article. Should the FTC pursue the complaint, it won't be the first time the company has faced the ire of the commission. In 2011, Google paid a "record" $22.5 million civil penalty to settle an FTC charge that it misrepresented to users of Apple's Safari Internet browser that it wouldn't run tracking "cookies" or serve targeted ads to them. In that case the fine was related to violation of an earlier privacy settlement between the company and the FTC in which Google was charged with misrepresenting the extent to which consumers could "exercise control over the collection of their information."