New Mexico Attorney General Sues Google Over Kiddie Privacy

By Jerri-Lynn Scofield, who has worked as a securities lawyer and a derivatives trader. She is currently writing a book about textile artisans.

New Mexico attorney general (AG) Hector Balderas sued Google last week for violating children’s privacy, presenting claims under the federal Children’s Online Privacy Protection Act (COPPA) and New Mexico’s Unfair Practices Act.

See the complaint here.

“Google has infiltrated more than half the nation’s primary- and secondary-schools by offering a“free” web-based service called G Suite for Education,” according to the AG’s complaint.

The NY Times notes that Google has emerged as the top tech brand in schools, toping rivals Apple and Microsoft, by offering a suite of cheap, user-friendly tools, according to New Mexico Sues Google Over Children’s Privacy Violations.

From the complaint:

4.               To drive adoption in more schools – and to alleviate legitimate concerns about its history of privacy abuses – Google has been making public statements and promises that are designed to convince parents, teachers, and school officials that Google takes student privacy seriously and that it only collects education-related data from students using its platform. Google has also publicly promised never to mine student data for its own commercial purposes.

5.               Unfortunately, Google has broken those promises and deliberately deceived parents and teachers about Google’s commitment to children’s privacy. In direct contradiction of its numerous assurances that it would protect children’s privacy, Google has used Google Education to spy on New Mexico children and their families by collecting troves of personal information, including:

• their physical locations;
• websites they visit;
• every search term they use in Google’s search engine (and the results they click on);
• the videos they watch on YouTube;
• personal contact lists;
• voice recordings;
• saved passwords; and
• other behavioural information.

Oops!

Don’t be evil indeed!

Until 2014, Google also mined students’ email accounts.

The complaint minced no words on the seriousness of the privacy violations:

7.         These privacy concerns – and the effects of Google’s misrepresentations and exploitation of information asymmetry between itself, on one hand, and parents and teachers, on the other – cannot be overstated. While Google publicly positions Google Education as a benign tool that is an answer to resource-deprived schools nationwide, it secretly uses Google Education as a means to monitor children while they browse the Internet, including in their private homes, on their private computers and phones, and on their private networks.This is particularly concerning considering that teenagers turn to the Internet to search for  issues they otherwise would be too embarrassed or afraid to ask  friends, parents, or relatives, such as general health information, sex education, diet advice, how to deal with bullying, anxiety and depression, puberty, and more. In fact, as many as four out of five teenagers turn to the Internet to learn about health information, such as anxiety, ADHD, and sexually transmitted diseases. [citations omitted]

As Vox reports in Google’s education tech has a privacy problem:

COPPA says that any companies that collect online data about children under the age of 13 must have their parents’ consent first. (This is why Facebook, for example, does not allow  children under 13 to have accounts.) The day before filing the lawsuit, Balderas wrote a letter to Alphabet and Google CEO Sundar Pichai demanding Google stop what Balderas referred to as “active, ongoing, and illegal data collection.”

“My investigation has revealed that Google tracks children across the internet, across devices, in their homes, and well outside the educational sphere, all without obtaining verifiable parental consent,” Balderas wrote. “Google has used this access to collect massive quantities of data from young children not to benefit the schools you have contracted with, but to benefit Google’s own commercial interests.”

Other states have also brought similar privacy claims against Google.In September 2019, the company agreed to pay a $170 million settlement to the Federal Trade Commission and New York state to settle allegations that it was harvesting YouTube data collected from underage children without the consent of their parents.

In addition, New Mexico has brought other COPPA claims against Google. As per Voc:

This also isn’t the first time Google has been in trouble over COPPA with New Mexico’s attorney general. In 2018, Balderas sued the company along with a mobile gaming app maker that Balderas said was making child-specific apps packed with trackers that harvested their young users’ data. Among Balderas’s claims was that Google did not act despite being notified that games offered through its Google Play Store were potentially violating federal law. (Google banned the mobile app company from Google Play a few days before the lawsuit was filed.) That lawsuit is still pending.

Now, I should note that Google denies the latest claims advanced by Balderas. So it will be necessary for the lawsuit to proceed before we learn what the facts of the case actually are. Google’s denial, as reported by Vox:

Google says its educational products comply with COPPA and industry standards, that it does not own or sell G Suite data, and that it does not use any personal information to target ads in G Suite school products. It also says schools must obtain parental consent before allowing users under the age of 18 to use Google’s services, according to its contract with schools.

“These claims are factually wrong,” Jose Casteneda, a spokesperson for Google, told Recode. “G Suite for Education allows schools to control account access and requires that schools obtain parental consent when necessary. We do not use personal information from users in primary and secondary schools to target ads.”

As Entrepreneur notes, in Google Is Getting Sued for Collecting Data From Kids’ Educational Chromebooks:

However, Balderas’ lawsuit claims the company never obtained any verifiable parental consent from an online form, a toll-free number, or a video-conference call with parents. “Furthermore, the pop-up notifications that Google displayed to students when first accessing their Google Education accounts are not intended nor available for review by the child’s parent,” the lawsuit adds.

Balderas and Big Tech

So far, Google is the only Big Tech company in the crosshairs of Balderas. Yet Vox notes that other tech companies, including Apple and Microsoft, also supply “free” products for use by young students. Perhaps their activities may also come under increased scrutiny:

Apple and Microsoft both offer their own versions of educational software and hardware — along with accompanying benefits, such as discounts. These agreements have concerned parents and privacy advocates for years; this new lawsuit in New Mexico may show that their worries were not unfounded.

Seems that first law of thermodynamics I learned so many years ago apply more widely. There ain’t no such thing as a free lunch – or free educational hardware and software. Balderas also seems to have learned this lesson.