Google accused of spying on students in FTC complaint

Google is still spying on students, the Electronic Frontier Foundation has claimed.

The EFF on Tuesday filed a complaint with the US Federal Trade Commission (FTC) in which it said that Google is breaking a pledge to keep students’ personal information private and is using things like a student’s entire browsing history to build profiles to use for its own purposes.

The EFF said in a release that it uncovered Google’s data mining of schoolchildren’s personal information while researching its Spying on Students campaign, which launched the same day the EFF filed the complaint.

The campaign’s goal is to educate parents and school administrators about the risks to student privacy posed by digital devices.

Those devices collect “far more information on kids than is necessary,” the EFF says, and store it “indefinitely,” sometimes even uploading it to the cloud automatically.

From the campaign’s site:

In short, [digital devices are] spying on students - and school districts, which often provide inadequate privacy policies (or no privacy policy at all), are helping them.

The EFF examined Google’s Chromebook and Google Apps for Education (GAFE), a suite of educational cloud-based software programs used in many US schools by students as young as 7.

This isn’t the first time that Google’s been called out on GAFE spying.

It was dragged into court in March 2014 for scanning millions of students’ email messages and allegedly building “surreptitious” profiles to target advertising at them.

At the time, the company had argued that it had already turned off ads by default in GAFE services, but that still left the option for users to turn them back on.

So in April 2014, it killed that option, permanently removing all ads scanning in GAFE, meaning that it couldn’t collect or use the services’ student data for advertising purposes.

But even after all that, the EFF claims that Google’s still getting at children’s data.

The group says it found that Google’s “Sync” feature for the Chrome browser is enabled by default on Chromebooks sold to schools.

That gives Google all the access it needs to build profiles on students, the EFF said, all without permission from students or their parents.

From the release:

[The default "sync" feature in Chromebooks] allows Google to track, store on its servers, and data mine for non-advertising purposes, records of every internet site students visit, every search term they use, the results they click on, videos they look for and watch on YouTube, and their saved passwords.

While many of us can choose to stay away from Google’s scanning clutches by avoiding use of its email, students don’t have that choice, given that some schools require them to use Chromebooks.

All of this flies in the face of the commitments Google made by signing the Student Privacy Pledge, the EFF said.

That’s a legally enforceable document whereby companies promise to refrain from collecting, using, or sharing students’ personal information except when needed for legitimate educational purposes or if parents provide permission.

Google’s one of 200 companies that have signed the pledge, which holds the companies accountable to:

• Not sell student information
• Not behaviorally target advertising
• Use data for authorized education purposes only
• Not change privacy policies without notice and choice
• Enforce strict limits on data retention
• Support parental access to, and correction of errors in, their children’s information
• Provide comprehensive security standards
• Be transparent about collection and use of data

The Guardian quoted a Google spokesperson who said that Google’s hands are clean:

Our services enable students everywhere to learn and keep their information private and secure. While we appreciate EFF’s focus on student privacy, we are confident that these tools comply with both the law and our promises, including the Student Privacy Pledge.

The EFF says that Google told the organization that it plans to disable the setting on school Chromebooks that allows Chrome Sync data, such as browsing history, to be shared with other Google services.

That’s a “small step in the right direction,” the EFF says, but it “doesn’t go nearly far enough” to correct Google’s violations of the Student Privacy Pledge currently inherent in Chromebooks being distributed to schools.

Namely, according to the complaint the EFF filed with the FTC:

• When students are logged into their Google for Education accounts, student personal information in the form of data about their use of non-educational Google services is collected, maintained, and used by Google for its own benefit, unrelated to authorized educational or school purposes.
• Google for Education’s Administrative settings, which enable a school administrator to control settings for all program Chromebooks, allow administrators to choose settings that share student personal information with Google and third-party websites in violation of the Student Privacy Pledge.

EFF Staff Attorney Nate Cardozo:

Despite publicly promising not to, Google mines students’ browsing data and other information, and uses it for the company’s own purposes. Making such promises and failing to live up to them is a violation of FTC rules against unfair and deceptive business practices.

Minors shouldn’t be tracked or used as guinea pigs, with their data treated as a profit center. If Google wants to use students’ data to ‘improve Google products,’ then it needs to get express consent from parents.

Image of Google on cork board courtesy of rvlsoft / Shutterstock.com