Google faces state lawsuit alleging misuse of schoolkids’ private data

Adults who use Google products and services tend to know, at least on some background level, that the cost for access to "free" tools is paid in data. Google also provides low- and no-cost hardware and software tools to students and educators in school districts nationwide, and one state now says that children are also paying that privacy price, in violation of the law. New Mexico Attorney General Hector Balderas filed a lawsuit (PDF) alleging Google's collection and use of data from schoolchildren in his state is in violation violation of the Children's Online Privacy Protection Act and New Mexico's Unfair Practices Act. COPPA, one of the few US federal laws protecting data privacy, imposes certain restrictions on the collection and use of personal data associated with children under age 13. Under the law, websites, apps, and digital platforms that collect data from young users are required to post a privacy policy and have parents consent to it, to give parents the option to opt out of having their children's information shared with third parties, to let parents review their children's data, and to follow sound data storage and retention policies. The suit accuses Google of deliberately deceiving school districts and parents with regards to its data policies. A platform explicitly designed for use in elementary and middle schools, by schoolchildren, is by definition going to be associated with children under age 13. "To drive adoption in more schools—and to alleviate legitimate concerns about its history of privacy abuses—Google has been making public statements and promises that are designed to convince parents, teachers, and school officials that Google takes student privacy seriously and that it only collects education-related data from students using its platform," the suit says, adding that Google also made public promises not to mine student data for commercial purposes. Those promises, the suit alleges, were not kept. Instead, it says, "Google has used Google Education to spy on New Mexico children and their families" by collecting personal information for advertising purposes. The types of data collected from and about children, according to the suit, include sensitive information such as geolocation, browsing history, search histories, viewing histories, contact lists, saved passwords, voice recordings, and "other behavioral information." "Tracking student data without parental consent is not only illegal, it is dangerous, and my office will hold any company accountable who compromises the safety of New Mexican children," Balderas said in a statement announcing the suit. Google said the state's claims are "factually wrong," adding that it allows schools to control access and requires the schools to seek parental consent. "We do not use personal information from users in primary and secondary schools to target ads," a company spokesperson said.