Google watches students' web habits without parental permission

More and more school districts around the country are integrating web-based technology that lets students search, create, share, collaborate, and store their documents and other work on the “cloud,” a remote server accessible from anywhere.

But with the growth of that technology comes concerns that Google, and perhaps other technology companies, are keeping tabs on the computer habits of America’s elementary, middle, and high-school students without permission from the students or their parents.

Many school districts are outsourcing tech support to technology companies that—as in the case of Google, with its Google Apps For Education suite of software and inexpensive Chromebook computers—can provide technical resources and assistance much more cheaply. Google Apps For Education is free.

But during the past couple of years, an increasing number of parents have grown concerned that companies providing these “turnkey” technology solutions also have collected personal information about their kids.

“In the last 12 months in particular, the frequency with which we have gotten inquiries has skyrocketed,” said Nate Cardozo, an attorney with the Electronic Frontier Foundation (EFF), a 25-year-old San Francisco nonprofit advocating for technology users’ privacy rights. EFF started an investigation into how cloud providers of educational software handle students’ data. They began with Google because it represents more than half the cloud software installations in schools around the country, Cardozo said.

EFF found Google was collecting a lot more information about students than it claimed, including what students did when they went to Google sites other than the core education apps. The core Google Apps for Education are email, calendar, Google Drive, Google Docs, and Google Classroom.

“Google Search is not a core educational app. Neither is YouTube, neither is Blogger, neither is Google Maps, stuff like that,” Cardozo said. “So if a student is logged in using their student account, and goes to Google search and types in a search query, Google logs what they’ve typed, what they’ve searched for, and what they clicked on and associates that with their student account.”

And if students are using the inexpensive Chromebooks Google provides to schools, the company can collect their entire browsing history using something called Google Sync. Even if a student is using another device, such as a home computer, browsing history is logged and can be used by Google to build a user profile of the student, as long as he or she is using a Google account.

If Google disclosed its data collection from the beginning, that would be another matter. But like hundreds of other companies that provide educational software, Google signed a “Student Privacy Pledge,” a promise to schools, parents, and students that a company won’t collect, use, maintain, or share personal information about students unless there’s either a valid educational purpose or the company gets prior student or parent consent.

“So when we took a look at that pledge and when we took a look at what we’d been able to figure out about how [Google] was collecting data about students, we saw a disconnect,” Cardozo said. EFF filed a formal complaint in December with the Federal Trade Commission.

Cardozo and the EFF are asking Google to provide some kind of electronic “terms of service” screen that allows students and parents to grant permission to use any data collected while a student is using his or her Google account. It seems like a simple fix, but it’s a bit more complicated. Google’s educational software and hardware suite appeals to districts strapped for cash, and many school districts have made its use mandatory, giving parents no chance to opt out if they have privacy concerns.

Cardozo and EFF don’t really have any problem with Google’s Apps For Education as a tool—just the privacy issue: “There’s a lot of benefit to be had from using things like [Google Apps for Education]. It’s cool. And in some senses, at least from a security standpoint, I trust Google to be running a school’s email server a lot more than I would trust most school district IT guys. … But that doesn’t excuse Google’s cavalier attitude toward privacy.”

Listen to Michael Cochrane’s report on student computing privacy on The World and Everything in It.