Google’s commitment to student data privacy is again under scrutiny, this time over allegations that the company is violating a state consumer-protection law.
Last week, Mississippi state attorney general Jim Hood filed a lawsuit alleging that Google’s policies and practices regarding online tracking of students remain unclear, despite the company’s public pledge to not collect and use student data for commercial purposes, such as targeting advertisements to students.
The suit seeks to force Google to be more transparent about its free, web-based G Suite for Education service, used by tens of millions of students worldwide, including more than half of the roughly 500,000 K-12 students in Mississippi.
“Through this lawsuit, we want to know the extent of Google’s data mining and marketing of student information to third parties,” Hood said in a statement. “I don’t think there could be any motivation other than greed for a company to deliberately keep secret how it collects and uses student information.”
Google officials have not issued a response. They declined a request to be interviewed.
The Mississippi attorney general and Google have tangled before. Hood previously sought to investigate whether the company was aiding illegal music pirating and drug sales, an effort the company said was part of a smear campaign coordinated by Hood’s financial backers.
Some state lawmakers have also sought to limit Hood’s ability to file civil lawsuits.
In a letter to Mississippi superintendents, the attorney general asked schools to preserve evidence that could be relevant to the state’s suit, including contracts and communications with Google. Hood said schools will be left to determine for themselves whether to continue using G Suite for Education.
Concerns surrounding Google and privacy, involving both students and consumers, are nothing new, Danielle Citron, a law professor and privacy expert at the University of Maryland, said in an interview.
More transparency can’t hurt, she said.
“Google has a history with tracking people when they don’t want to be tracked,” Citron said. “This lawsuit appears in some respects designed to force clarity, by uncovering through discovery and depositions what the company is actually doing.”
A history of privacy complaints
Google is one of hundreds of companies to sign the Student Privacy Pledge, making a voluntary public commitment to not use students’ personal information collected through educational services for any kind of non-educational, commercial gain.
That commitment applies to its wildly popular G Suite for Education, or GSFE. Previously known as Google Apps for Education, the service includes student versions of widely used online applications such as Gmail, Docs, and Sheets.
In 2014, during a federal class-action lawsuit that was ultimately settled, Google acknowledged to Education Week that it inappropriately “scanned and indexed” the email messages of millions of students using the service. Google officials say the company has since stopped that practice.
It remains unclear, however, what happens to student users who login through GSFE, then venture out into non-educational sites and services—especially those operated by Google, such as YouTube and the company’s online search engine.
In 2015, the privacy-advocacy group Electronic Frontier Foundation filed a complaint against Google with the Federal Trade Commission, alleging the company’s handling of such situations violated the commitments it made when signing the Student Privacy Pledge. Minnesota Senator Al Franken followed up with a request for information from Google leaders.
In response, Google acknowledged that it does collect and data-mine the personal information of students who ventured from Google’s education services out to its consumer services, such as YouTube. The company said such information was not used to target ads, however. Its response left open the possibility that such student data might be used for other commercial purposes.
The FTC has not publicly taken up the complaint against Google.
A new lawsuit
That’s where the Mississippi attorney general’s office comes in.
In its lawsuit, filed in Lowndes County Chancery Court, the state alleged that Google uses student GSFE accounts to track Mississippi K-12 students in order to build profiles that can be used for advertising. The state also accuses Google of failing to abide by its own privacy policies, terms of service, contracts, and agreements, as well as the public commitment it made in signing the Student Privacy Pledge. And it echoes a common complaint that Google requires schools and families to navigate a tangled web of policies and statements if they hope to understand what is being done with student data under different circumstances.
“Due to the multitude of unclear statements provided by Google, it is impossible to know exactly what student information it is collecting and how Google is using that information,” attorney general Hood said in a statement.
As a result, the Mississippi attorney general concluded, Google is engaged in “unfair and deceptive trade practices.”
The state is seeking a court order that Google cease those practices and fully disclose its handling of student data.
The suit also says that Google’s alleged violations justify civil fines of up to $10,000 for every G Suite for Education account opened in the state.
A push for more transparency
Some observers expressed skepticism about the suit.
The Future of Privacy Forum, the industry-affiliated Washington think tank responsible for the Student Privacy Pledge, reiterated its belief that “Google’s practices are consistent with its obligations under the pledge.” In a blog post, the group noted that Google clearly states that no ads are served to students using G Suite for Education services. It also pointed out that school administrators must choose to let students use their school accounts to access Google’s consumer services.
The Mississippi attorney general’s office, meanwhile, has provided only limited information about how it determined that Google is tracking students, using their data to build profiles, and targeting them with ads. Officials “tested” several student accounts and a staff member’s account, according the office’s public information officer. But they declined to provide any details about the nature of those tests, citing their ongoing investigation. The lawsuit itself contains no information demonstrating that any of Google’s allegedly deceptive practices actually occur.
As a result, the suit’s legal prospects are unclear.
But even if the Mississippi attorney general’s office doesn’t win, its legal action could still prove significant, by calling fresh attention to lingering concerns about whether Google is being as transparent as possible.
For more than two years, the company has declined requests from Education Week to clarify its student-data-privacy practices.
And Hood’s claim that Google’s privacy policies for schools are confusing is “spot-on,” said Bill Fitzgerald, the director of the Education Privacy Initiative at Common Sense Media. “There is a maze of overlapping and sometimes contradictory claims in Google’s policies,” Fitzgerald said. “It requires technical and legal expertise to navigate through this web, and even then a lot remains unclear.”
Streamlining those policies would be a great first step, Fitzgerald said. The company could also resolve a great deal of uncertainty, he said, by publicly explaining how it collects, stores, protects, and uses the data students generate when they venture out to sites and services beyond G Suite for Education.
Right now, he said, the company is essentially asking for schools’ trust.
“I am always behind anything that brings additional clarity and encourages companies to be more transparent,” Fitzgerald said. “Whether this lawsuit is a good vehicle to make that happen, we’ll have to see.”
Photo: Mississippi Attorney General Jim Hood addresses reporters last June in Jackson, Miss.--Rogelio V. Solis/AP-File
A version of this news article first appeared in the Digital Education blog.