Privacy & Security

Google Questioned on Student Data Privacy By U.S. Senator Franken

By Benjamin Herold — January 14, 2016 7 min read
  • Save to favorites
  • Print

Democratic Senator Al Franken of Minnesota wants answers from online-services giant Google about its handling of student data.

“Google is a dominant player in the ed-tech industry, and they offer affordable, accessible services and devices, which is great for students,” Franken told Education Week. “But I want to make sure that parents know what is happening with their children’s information.”

Earlier this week, the senator sent a letter sent to Google CEO Sundar Pichai, requesting that the company respond to questions about how it collects and uses data gathered on students. Of specific interest to Franken: What does the company do with information gleaned from students who are using school-issued Chromebooks or are logged into school-issued Apps for Education accounts, but have ventured into company services that are not education-specific, such as YouTube? And what does Google do with the aggregated information of student users of Chrome Sync (a tool to keep users’ browsing experience consistent across multiple platforms)?

Both questions are driven by a complaint filed last month with the Federal Trade Commission by electronic-privacy advocacy group the Electronic Frontier Foundation. The group alleges that in the scenarios described above, Google is collecting and using information in ways that violate the voluntary Student Privacy Pledge, which Google and 200 other education technology companies have signed.

Google issued the following statement: “We’ve responded to the EFF in detail and we’re very happy to provide Senator Franken with more information.”

The company has also denied that it is violating the Student Privacy Pledge. That stance is backed by the Future of Privacy Forum, an industry-aligned think tank that is a prime mover behind the pledge initiative.

Still, more transparency around the company’s practices would be beneficial, said Jules Polonetsky, the group’s executive director.

“Clearly, when it comes to the general issue of what’s collected, where, and why by Google and other companies, getting more information is always useful,” Polonetsky said in an interview.

Student data privacy concerns persist

Student data privacy has in recent years become a hot-button issue in education. Dozens of states have passed new laws, and a number of proposals have been floated in Congress. In 2014, Google found itself in hot water after Education Week reported that the company had acknowledged “scanning and indexing” student email messages sent using its popular Apps for Education tool suite. The company says it has since stopped that practice.

But concerns about Google’s practices persist. At the heart of the current conflict are questions about how the company (and others) should handle information gleaned from student users of products and services that are not specifically designed or marketed to schools.

It’s a legal and technical gray area.

What is clear is that under the terms of many state laws (such as California’s SOPIPA statute, which has been copied elsewhere) and the Student Privacy Pledge, companies may not take information gathered on students who are using educational products and services and employ that information for non-educational purposes outside of those services. So Google, for example, can’t take what it learns about students who are using Apps for Education services and employ that information to target ads to those students when they later use Google Search or Google Maps.

What’s less clear, however, is what companies are permitted to do when student users are moving freely between educational and non-educational services. Imagine, for example, one of the millions of students who use a school-issued Chromebook or Apps for Education account to do schoolwork. That student may very well take breaks to peek at YouTube videos, conduct Internet searches, or check a personal Gmail account. Should the company be allowed to collect the same information on that student’s YouTube, Search, and Gmail usage that it collects on general consumers?

On that question, there are significant differences of opinion.

In its complaint to the FTC, the Electronic Frontier Foundation alleges that Google is collecting studentsnon-educational data that is stored away and “used by Google for its own benefit, unrelated to authorized educational or school purposes.” The group claims that such practices violate the Student Privacy Pledge.

Polonetsky of the Future of Privacy Forum, however, said that even if the company is employing such practices, they would not constitute a violation of the pledge or most relevant state laws, which he said were written specifically to ensure that uses of commercial services were not covered.

“The reason the language is very focused on products designed and marketed for education is you don’t want schools barred from buying computers that aren’t structured solely for student use, or from being able to go to Amazon,” Polonetsky said.

Google ‘committed to keeping student information private’

Google, for its part, has defended its practices. In a December blog post, Jonathan Rochelle, the director of Google Apps for Education, or GAFE, wrote: “We have always been firmly committed to keeping student information private and secure... Schools can control whether students or teachers can use additional Google consumer services” by establishing settings on student GAFE accounts.

“We are committed to ensuring that K-12 student personal information is not used to target ads in these services,” Rochelle also wrote.

But the company has been less than forthcoming in detailing its actual practices. There are potential non-commercial uses of student information other than targeted advertising, including the construction of behavioral profiles of users. Google has repeatedly declined requests to specify whether it is using information collected on students in non-GAFE services for such purposes.

Sen. Franken, who has not taken a position on whether Google is violating the Student Privacy Pledge, said he hopes to be the one who finally gets answers from the company.

“As the top Democrat on the Senate Subcommittee on Privacy, Technology and the Law, I think it’s really important to ask those questions,” he told Education Week.

“I believe that consumers have a fundamental right to know what information is being collected, how it is used, and who it is being shared with.”

The complete list of Sen. Franken’s questions for Google:

  1. When a student is signed in to their GAFE account but is not using one of the GAFE services, what kind of data does Google collect on an individual student?
  2. When a student is using a Chromebook but is not using one of the GAFE services, what kind of data does Google collect on an individual student?
  3. If Google does collect any individualized data on a student, such as browsing information or viewing habits, when a student is using a Chromebook or is logged in to their GAFE account but is not using one of GAFE services, please address the following questions:

    1. For what purposes does Google collect this information?
    2. Is it necessary to collect all of this information for the provision of GAFE services or to deliver other valuable features that may be relevant for educational purposes?

    3. Has Google ever used this kind of data to target ads to students in Google services, either in the GAFE services or other Google services, such as Google Search, Google News, Google Books, Google Maps, Blogger, or YouTube?
    4. Has Google ever used this kind of data for its own business purposes, unrelated to the provision of Google’s educational offerings
    5. Is it possible to make this data collection opt-in?
    6. Does Google share this information with additional parties?
  4. Google has indicated that it compiles data aggregated from student users of Chrome Sync, anonymizes the data, and uses it to improve its services. Can you expand on how the aggregated information is treated? For example, does this include sharing the aggregated data with third parties for research purposes or otherwise?
  5. Can you describe Google’s relationship with school districts and administrators that choose to use Google for Education products and services? Apart from publicly available privacy policies, does Google offer any explanation to parents, teachers, and education officials about how student information is collected and used?
  6. Can you describe all the contexts and ways in which both school administrators and parents of students using Google for Education products and services have control over what data is being collected and how the data are being used?

Photo: U.S. Sen. Al Franken chats with the media in a 2014 photo.--Jim Mone/AP-File

See also:

A version of this news article first appeared in the Digital Education blog.