Governance & Risk Management , Privacy , Standards, Regulations & Compliance
New Mexico Sues Google Over Children's Privacy
State Alleges Data About Young Students Is Illegally Collected
New Mexico is suing Google, alleging the company violates federal child privacy law by collecting personal data of students younger than age 13 without their parents’ consent.
See Also: Live Webinar | Breaking Down Security Challenges so Your Day Doesn’t Start at 3pm
In a lawsuit filed Thursday in federal court, New Mexico alleges that Google collects from children their physical locations, browsing histories including YouTube videos, search terms, personal contact lists, voice recordings, saved passwords and behavioral data.
At issue is the company’s G Suite for Education, its web-based product for schools that includes Gmail, Calendar, Drive, Docs and other applications such as Slides and Sheets. Some schools across the U.S. also equip students with Google's Chromebook, a laptop.
New Mexico Attorney General Hector Balderas says that the data collection violates the federal Children’s Online Privacy Protection Act. COPPA requires service providers to obtain verifiable parental consent before collecting data of users younger than age 13.
“Tracking student data without parental consent is not only illegal, it is dangerous, and my office will hold any company accountable who compromises the safety of New Mexican children,” Balderas says.
Balderas says that the data collection doesn’t benefit schools, but rather Google’s commercial interests. But New Mexico has told schools in the state that “there is no immediate harm to the continued use of these products and that this lawsuit should not interrupt daily instruction in our schools.”
A Google spokesman tells Information Security Media Group that the claims in the lawsuit are “factually wrong.” Google says it doesn’t use personal information from primary and secondary school students to target ads.
“G Suite for Education allows schools to control account access and requires that schools obtain parental consent when necessary,” the spokesman says.
Outside the Classroom
New Mexico’s lawsuit contends that the data collection occurs not only in the classroom, but bleeds over into children’s activities at home. It alleges that students are encouraged to access their Google Education accounts at home.
Use of a syncing feature could mean that Google could end up with more personal and browsing information, the lawsuit states. An option called Google Sync will link the family computer’s usage data to the child’s Google Education account, it adds.
“By tracking and cataloging everything children do online and in their digital lives, Google has unprecedented visibility into the online lives of children across the country, and specifically, in the State of New Mexico,” it says.
By collecting young students’ data, there is a risk that they could be targeted by age-inappropriate advertising, Balderas writes in a letter to Google CEO Sundar Pichai. Also, data brokers and marketing technology firms that acquire data from Google have suffered data breaches, Balderas writes.
Recent Settlement
Until 2015, Google saw student data as fair game. But in that year, it signed onto the Student Privacy Pledge created by the Future of Privacy Forum. The pledge includes such tenets as not selling student data, not using data beyond purposes authorized by a student or parent, and not keeping data beyond a period required for educational services.
Google says that it does not use data collected from its education product for targeted advertising. But Balderas argues that Google is still collecting data that goes beyond educational purposes.
New Mexico's lawsuit comes about six months after Google reached a $170 million agreement with U.S. Federal Trade Commission and New York’s attorney general over the company’s tracking of children’s YouTube activity (see: Privacy Advocates Criticize FTC's Google Settlement).
The agencies alleged that Google violated COPPA by using cookies to track what videos children younger than age 13 were watching and then target them with advertising. Google did this without gaining consent from their parents, the agencies alleged.
