Google announced earlier today that it will stop automatically scanning student and teacher emails sent through Google Apps for Education and will no longer use the platform to deliver any advertising.
This is a positive development for student privacy and means that if the media questions and reports on troubling and illegal corporate practices positive change may occur. I initially blogged about this issue on January 24, 2014. At that time I stated, “[I]t does not appear that students, parents, and/or teachers have been informed and provided consent that would enable their digital interactions and the content sent and received on school contracted Gmail services to be utilized for advertising purposes.”
Soon after I wrote about this tremendous threat to student privacy, I spoke to Education Week about this huge privacy and safety risk to our children. I told Education Week that I saw “major FERPA violations” in Google’s activities and suggested that the Education Department should investigate the company. The Federal Trade Commission, which is responsible for monitoring deceptive business practices, should also take note and….[t]he personal safety of students are at risk when commercial entities obtain access to student data and act upon the information.”
While I believe this is a good first step for protecting student privacy, why did it take Google years to make this change? Absent multiple lawsuits and the investigative reporting from Education Week would Google have changed its practices? Will Google also turn off its scanning and behavioral advertising functions for its other services such as YouTube, Google Plus, etc…in a school setting? Will Google also change its Android and Chromebook policies to better protect student privacy? Will Google change its Terms of Service and Privacy Policies that govern all of its education offerings? Will Google revise all of its school contracts to reflect this announcement?
Will Google delete all of the personal and highly monetizable personal information that it has been collecting on students, parents, teachers, and their families? Since Google has been caught misrepresenting its practices once again should we as President Regan stated when describing the Soviet Union trust but verify? Who will do the verifying? The U.S. Department of Education, state departments of education, state attorney generals, the FTC? What about better protecting non-student users such as consumers?
Google’s announced impending policy change appears to be an admission that it was violating Article 5 of the FTC Act that bans “unfair and deceptive acts”. According to a 2011 FTC Consent Decree related to the Google’s Buzz matter, it appears the FTC has wide latitude to investigate what appears to be an intentional privacy violation and fine Google accordingly. Under the consent agreement, it appears that Google may be fined up to $16,000 for each violation. Since Google has publicly stated that it has 30 million users, Google’s legal liability may reach into the billions of dollars. For example, 30 million x $16,000 for each violation is a fine of $480,000,000,000. Will the FTC open an investigation to determine if Google violated its consent decree?
While Google creates some great products and services, it has consistently refused to do the right thing when it comes to protecting the personal privacy and safety of its users. Is this announcement being done to ward off an FTC investigation into its privacy practices and to stop more potential litigants from joining the Gmail scanning lawsuit(s)?
My hope is that now that Google plans on changing its student data collection and utilization practices in its Apps For Education platform, it will also do the same for its other school offerings. The bottom line is that Google and other companies that create user/people profiles for advertising and other purposes need to not only become more transparent but stop practices that erode the public’s privacy and put them in harm’s way.
Copyright 2014 by the Law Office of Bradley S. Shear, LLC. All rights reserved.