Privacy complaints against Google raise questions about student data

A leading privacy watchdog has charged that Google is collecting and using students’ data through software installed on laptops marketed especially to schools, in violation of the company’s stated commitment to protecting student privacy.

The Electronic Frontier Foundation alleged in a complaint filed Tuesday with the Federal Trade Commission that Google’s Chromebooks and its cloud-based Google Apps for Education, which the company says are used by more than 40 million students, teachers, and school administrators, are pre-installed with a feature that allows the company to monitor the websites that students visit.

“Despite publicly promising not to, Google mines students’ browsing data and other information, and uses it for the company’s own purposes. Making such promises and failing to live up to them is a violation of FTC rules against unfair and deceptive business practices,” EFF staff attorney Nate Cardozo says in a statement. “Minors shouldn’t be tracked or used as guinea pigs, with their data treated as a profit center. If Google wants to use students’ data to ‘improve Google products,’ then it needs to get express consent from parents."

The company argues that it hasn't gone back on its promises to protect student privacy. "Our services enable students everywhere to learn and keep their information private and secure," Google says in a statement. "While we appreciate EFF's focus on student privacy, we are confident that these tools comply with both the law and our promises, including the Student Privacy Pledge."

The watchdog’s complaint comes nearly a year after Google agreed to sign a Student Privacy Pledge saying it would be transparent about how it used students’ data, it would not track students digital movements in order to advertise products through the software, and it would use students’ data only for educational purposes.

The company originally balked at signing the pledge, which was endorsed by President Obama, saying its own privacy policies were already comprehensive. But it relented in January after the pledge – created by a Washington-based privacy think tank and a software industry trade group – gained further support. Initially, about 75 companies signed the pledge, while the number has now grown to more than 200.

There's also been a growing debate over student data privacy as more schools around the country have begun embracing classroom technology.

“By and large, parents have been pretty trusting of schools with respect to the delivery of education and the necessity of collecting data,” says Doug Levin, an education technology consultant who previously served as executive director of the State Educational Technology Directors Association from 2009 until earlier this year.

But with several high-profile data breaches and leaks over the past few years, such as the NSA spying program disclosed by Edward Snowden or the recent hack of toymaker V-Tech, he says, “I think parents in general are much more aware about the collection of data – and the exposure of data – than they ever were before... What’s changed is parents’ level of trust in the system doing right for their kids.”

While many states have passed laws aimed at protecting students’ data, the EFF’s complaint marks the first time the FTC’s enforcement over technology companies has been directly challenged, Mr. Levin says.

The EFF has also alleged that the software’s administrative settings, which can control several Chromebooks at once, allows an administrator to choose a setting that sends students’ information to Google and other websites, which violates the Privacy Pledge, the group says.

Despite the outcry from the privacy watchdog, for schools that have invested heavily in the technology, perspectives on students’ privacy rights vary.

A spokesman for the Boston Public Schools, which is using Google’s Chromebooks and educational software in many of its classrooms, declined to comment on the EFF’s complaint. Previously, the principal of a technology-focused school in the district said teachers aimed to increase students' awareness of how their data was being used online, though she did not address the Google software specifically.

“Talking with students even about their digital footprint, what they’re leaving out there on things they’re very familiar with has been eye-opening for our kids,” Lisa Gilbert-Smith, principal of Dearborn STEM Academy, a public school in Boston’s Dorchester neighborhood that has made computer science courses a focus, said in an interview last month. “Just making sure they can utilize technology in an appropriate manner, and that they actually know what it is, and why it is, and where it came from, those are things that [our teachers] are working on."

At schools in the suburban district of Burlington, Mass., which also use the Google software, officials say students are not entitled to privacy rights for devices provided by the school. The district’s superintendent told Passcode’s Malena Carollo that it monitors what students do with the technology in order to ensure their safety.

"It’s not their device," Burlington superintendent Eric Conti said. "Are we monitoring or filtering your use? Yes," he added. "We’re providing the device, and you’re using content we’re delivering through that device."

The Future Privacy Foundation, the think tank that developed the privacy pledge, says it was skeptical of the watchdog’s complaint against Google.  "We don’t believe the complaint raises any issues about data use that are restricted by the Student Privacy Pledge," Jules Polonetsky, the group’s executive director, says in a statement.

Mr. Polonetsky noted that the Google software did not use students’ data to create so-called behavioral ads, while the Chrome Sync feature that allows such data collection was sold in all Chromebooks, not just those marketed to schools.

Jeremy Gillula, a staff technologist at EFF, responded in a blog post on Wednesday, saying the group was also concerned about the company's tracking of students who move from an educational app to another Google product while still logged into their educational account, a practice, he argued, violates the privacy pledge.

But for privacy groups, whether the claim violates the pledge may be beside the point, says Levin, the education technology consultant.

“In some respects, this is also a fight being fought in the court of public opinion,” he says, noting that the debate over student data privacy has also spurred some schools to begin developing their own “Good Housekeeping seals” governing how they handle such data.

The group’s complaint also comes amid a debate over whether to include privacy protections in an upcoming rewrite of the Bush-era No Child Left Behind Act standards, known as the Every Student Succeeds Act.

“I think it does lead — whether it’s companies or schools — down a path of [asking] ‘How much are we collecting? Do we really need all this information? How transparent have we been? Who are all the entities that have we have contractual arrangements with?' ” Levin adds.