Google denies illegally slurping data off free student Chromebooks

New Mexico Attorney General Hector Balderas is suing Google over its alleged slurping of students’ data off of the free Chromebooks it passes out to needy schools and from its free G Suite for Education products, including Gmail, Calendar, Drive, Docs, Sheets, and other apps.

According to the complaint, which was filed in the US District Court for the District of New Mexico on Thursday, Google has marketed its suite – formerly known as Google Education – to schools, parents and children as a “free and purely educational tool”, but in actuality, it comes “at a very real cost that Google purposefully obscures.”

Balderas said in a statement that Google has secretly collected information including students’ geolocation information, internet history, terms that students have searched for on Google, videos they’ve watched on YouTube, personal contact lists, saved passwords, voice recordings, and more, in violation of federal law. The Children’s Online Privacy Protection Act (COPPA) requires that companies such as Google obtain verifiable parental consent before collecting personal data from children under the age of 13.

The AG is also accusing Google of violating one of the state’s consumer protection laws, the Unfair Practices Act.

Balderas also released a copy of a letter that he sent to Google CEO Sundar Pichai on Wednesday. In that letter, Balderas said that his office had conducted an investigation that concluded that Google’s alleged data siphoning appears to be active and ongoing.

My investigation has revealed that Google tracks children across the internet, across devices, in their homes, and well outside the educational sphere, all without obtaining verifiable parental consent.

Google has used its access to collect “massive” amounts of data from young children, Balderas said, not to benefit the schools with which Google has contracted, but to profit off it. It’s not just that Google’s sucked it all up into its own gaping maw, the AG said, but that the data can spread “across the globe” in ways both legitimate and otherwise.

He called on Google to immediately cease and desist its alleged data collection, bringing up the specters of having children’s data used to market to them or having it wind up for sale on the dark web, “hosted in countries well beyond the reach of law enforcement.”

Well, it’s not as if it hasn’t happened in the past. In September 2019, the Federal Trade Commission (FTC) fined Google $170 million for illegally sucking up kids’ data so it could target them with ads.

In response, Google’s YouTube subsidiary decided to sit out the thorny task of verifying age, instead passing the burden on to content creators, leaving them liable for being sued over COPPA violations, even if the creators themselves think that their content is meant for viewers over the age of 13.

According to the New Mexico lawsuit, Google Education is now used by more than 80 million educators and students in the US, including more than 25 million who use Chromebooks in school. To drive up adoption in schools, Google has publicly promised that it takes students’ privacy seriously and that it will never mine student data for its own commercial purposes, the lawsuit says.

It’s broken those promises, the lawsuit says, pointing to Google’s response to a Congressional inquiry into the privacy practices associated with Google Education, in which it admitted to using students’ data – extracted and stored in profiles – for “product improvement and product development.”

The New Mexico Office of the Attorney General filed a similar lawsuit against Google and several other tech companies in September 2018, alleging illegal data collection from child-directed mobile apps. The companies have denied wrongdoing, and the case is awaiting a decision by a federal judge in Albuquerque.

Balderas has let New Mexico schools know that nobody’s going to yank Chromebooks out of students’ hands – at least, not in the short term: there’s “no immediate harm to the continued use of these products,” according to the statement from the AG’s office, and “this lawsuit should not interrupt daily instruction in our schools.”

Google’s response: Horsefeathers!

This is all nonsense, Google said in a statement about the lawsuit’s claims being “factually wrong.” From a statement that spokesperson Jose Castaneda sent to media outlets:

G Suite for Education allows schools to control account access and requires that schools obtain parental consent when necessary. We do not use personal information from users in primary and secondary schools to target ads.

According to Google’s G Suite for Education information page, it contractually requires that schools get parental consent in order to use the services – consent that’s required by COPPA.

Latest Naked Security podcast