The Electronic Frontier Foundation (EFF) is known for its work to fight government surveillance. But over the last six to eight months, the foundation received more complaints from parents about the types of data that technology companies collect from students on school-issued mobile devices. So it launched the first missile in its campaign for students' and parents' digital rights at school: A complaint against Google filed with the Federal Trade Commission on Dec. 1.
"We started with Google because they're the 800-pound gorilla in this space," said Nate Cardozo, a staff attorney for the Electronic Frontier Foundation who jointly filed the complaint. "Even for districts that buy other hardware, often they're using it with Google Apps for Education."
One of the complaints centers around Chrome browser history, specifically the Chrome Sync tool that allows students to log into their education account from multiple Chromebooks or Chrome browsers and see the same frequently used apps, extensions, bookmarks and websites. The tool itself is not the problem; it's the fact that Chrome Sync does not ask students' or parents' permission before it runs.
While Chrome Sync doesn't collect students' personally identifiable information, it by nature links students' browsing history to an account that contains that kind of information, including their birthdate, full name and address.
"All we want is for Google to throw up a dialog box to say, 'Can we do this, do you want Chrome Sync on? Yes or no," Cardozo said.
Another complaint revolves around what students do in general services that are not part of Google Apps for Education, including Search, YouTube and Blogger. The foundation contends that Google builds profiles based on students' activity in these services, and then attaches those profiles to serve students' ads.
In a Student Privacy Pledge that 206 organizations including Google signed, school service providers commit not to collect, use or share student personal information that hasn't been authorized by the parent or student. And they promise not to build a personal profile of a student unless it's for educational purposes or to use student information for behavioral targeting of advertisements to students.
"While we appreciate the EFF’s focus on student data privacy, we are confident that our tools comply with both the law and our promises, including the Student Privacy Pledge, which we signed earlier this year," Jonathan Rochelle, director of Google Apps for Education, wrote in a blog post.
The foundation argues that Google is going back on its word, but Google disagrees. In education accounts, Google doesn't dispute that it's collecting student information, but rather says that personally identifiable Chrome Sync data is not used for advertising purposes and is used only for the data owner's benefit. It also reiterated that schools determine what outside services students can access through their education account, including YouTube, Maps and Blogger.
In fact, the company says that students who use Google Search don't see any ads as long as they're logged in, and other services don't always show ads either. Google argues that it's committed to making sure that student information is not used to target ads in its general purpose services.
Regardless of how this complaint pans out, the pledge that two technology industry groups created has been criticized as weak and not doing enough to protect student privacy.
"We have said from the beginning and continue to say that a pledge is insufficient to protect the privacy interests of students and their families," said Jim Steyer, CEO of Common Sense Media, via email. "Without passing judgement on the specific EFF complaint against Google, we have no question that what is needed, and preferably at the federal level, are laws that protect student data privacy while allowing for continued growth and innovation in the field of education technology."
The creators of the pledge both released statements in support of Google. The Future of Privacy Forum argued that school IT administrators, parents and students can choose whether to enable Chrome Sync, which could bypass the issue. And the Software & Information Industry Association contended that because Search is part of the company's general services, it does not fall under the pledge's protection of education-specific services.
The Federal Trade Commission has not responded to the complaint yet, but it's done hearing from the Electronic Frontier Foundation. Sometime early next year, the foundation plans to launch investigations into other companies including Microsoft and Apple in an ongoing effort to fight for student data privacy.
