EFF Complaint Charges Google with Collecting Student Data Despite Privacy Pledge -- THE Journal

Policy & Funding

EFF Complaint Charges Google with Collecting Student Data Despite Privacy Pledge

By Dian Schaffhauser
12/02/15

Schools are handing over student data in exchange for access to free apps and low-cost computers. That's what one might conclude based on a complaint just filed by the Electronic Frontier Foundation (EFF) with the Federal Trade Commission (FTC) against Google. Alongside the complaint, the organization also introduced a new site that addresses the challenges of maintaining student privacy.

In the complaint, the organization accused the search company of violating the terms of the Student Privacy Pledge, which it signed alongside 204 other companies. The pledge, a voluntary program put together by the Future of Privacy Forum and the Software & Information Industry Association, is intended to allow companies to show their commitment to safeguarding student privacy related to the collection, maintenance and use of student personal information. Among those rules is one that holds school service providers accountable for using data "for authorized education purposes only."

However, EFF said Google's practices related to Google for Education and Chromebook laptops "fly in the face" of the privacy commitment in three ways:

When students are logged in to their Google accounts, data tied to their use of non-educational Google services is collected, maintained, and used by Google "for its own benefit, unrelated to authorized educational or school purposes";
The "Chrome Sync" feature of Google's Chrome browser is turned on by default on all Google Chromebook laptops — including those sold to schools as part of Google for Education — enabling Google to collect and use students' entire browsing history and other data for its own benefit; and
Google for Education's administrative settings, which allow staff to control settings for school Chromebooks, also allow them to choose settings that share student personal information with Google and third-party sites without prior consent from the student or his or her family.

EFF has also launched a site, "Spying on Students," to educate district administrators and families about the use of school-issued technology and the impact it can have on student privacy. "It's great to see technology embraced in the classroom, but some of these devices can jeopardize students' privacy as they navigate the Internet — including children under the age of 13," the site noted in a frequently asked questions page about the new program.

In 2014 Google publicly claimed 30 million users for its education suite, Google Apps for Education. The EFF campaign was created, the organization asserted, to raise awareness about the privacy risks of that software as well as the devices issued by schools to run it.

EFF said that when it examined Google's Chromebook and its applications, it found numerous ways in which student personal information was being collected and used by the company for its own benefit. For example, the Sync feature for the Chrome browser "allows Google to track, store on its servers, and data mine for non-advertising purposes, records of every Internet site students visit, every search term they use, the results they click on, videos they look for and watch on YouTube, and their saved passwords, no matter whether they're using the Chromebook or some other device for that access." Google does all of this, the complaint stated, without first obtaining permission from the student or the student's family. And because "some schools require students to use Chromebooks," parents can't prevent the data collection from happening.

The EFF is pursuing its complaint through the FTC because the commission has in the past taken actions against companies that have made privacy-related guarantees to customers and "then violated those promises." In fact, the FTC has a page on its site that addresses that very point: "When companies tell consumers they will safeguard their personal information, the FTC can and does take law enforcement action to make sure that companies live up these promises."

"Despite publicly promising not to, Google mines students' browsing data and other information, and uses it for the company's own purposes. Making such promises and failing to live up to them is a violation of FTC rules against unfair and deceptive business practices," said EFF Staff Attorney Nate Cardozo in a prepared statement. "Minors shouldn't be tracked or used as guinea pigs, with their data treated as a profit center. If Google wants to use students' data to 'improve Google products,' then it needs to get express consent from parents."

According to the EFF, Google told the organization that it would soon disable the default Chromebook Sync data setting, "a small step in the right direction." But, the EFF added, "It doesn't go nearly far enough to correct the violations of the Student Privacy Pledge currently inherent in Chromebooks being distributed to schools."

According to the complaint, Google has "represented" to EFF that collection of certain kinds of data was necessary to provide a "seamless experience" for the student across devices. However, the EFF wrote, because students also use computers and access the Internet for "non-academic reasons," Google was in the position to collect, maintain and use data such as student browsing history and passwords for purposes beyond the educational ones.

The complaint concludes with several requests: The EFF asks the commission to "order Google to destroy ALL personal student information collected"; to let students and their parents know what data was collected; to stop Google from collecting and using student data for educational purposes without getting prior permission first; or to withdraw from the Student Privacy Pledge altogether.

Google did not respond to a request for comment before publication of this article. Should the FTC pursue the complaint, it won't be the first time the company has faced the ire of the commission. In 2011, Google paid a "record" $22.5 million civil penalty to settle an FTC charge that it misrepresented to users of Apple's Safari Internet browser that it wouldn't run tracking "cookies" or serve targeted ads to them. In that case the fine was related to violation of an earlier privacy settlement between the company and the FTC in which Google was charged with misrepresenting the extent to which consumers could "exercise control over the collection of their information."

E-Mail this page

Printable Format

Featured

Iteach Bringing AI to Teacher Curriculum via Khanmigo Partnership

Users of the iteach educator certification platform now have access to the Khanmigo AI teaching assistant at no additional cost.
FCC Expands E-Rate to Support Loaner WiFi Hotspots for Students

The Federal Communications Commission has officially approved an expansion of the E-Rate program that will allow schools and libraries to utilize E-Rate resources to loan out WiFi hotspots to students, school staff, and library patrons who lack internet access at home.
NIST's U.S. AI Safety Institute to Collaborate with Anthropic and OpenAI on AI Research

The U.S. AI Safety Institute, part of the National Institute of Standards and Technology (NIST), is partnering with AI companies Anthropic and OpenAI to collaborate on AI safety research, testing, and evaluation.
OpenAI Launching AI-Powered Search Engine

OpenAI has unveiled SearchGPT, a new AI-powered search engine designed to access information from across the internet in real time. The much-anticipated prototype will provide more organized and meaningful search results by summarizing and contextualizing information rather than returning lists of links.