New Mexico Sues Google Over Children’s Privacy Violations
New Mexico’s attorney general sued Google on Thursday, saying the tech giant used its educational products to spy on the state’s children and families.
Google collected a trove of students’ personal information, including data on their physical locations, websites they visited, YouTube videos they watched and their voice recordings, Hector Balderas, New Mexico’s attorney general, said in a federal lawsuit.
“The consequences of Google’s tracking cannot be overstated: Children are being monitored by one of the largest data mining companies in the world, at school, at home, on mobile devices, without their knowledge and without the permission of their parents,” the lawsuit said.
Over the last eight years, Google has emerged as the predominant tech brand in American public schools, outpacing rivals like Apple and Microsoft by offering a suite of inexpensive, easy-to-use tools.
Today, more than half of the nation’s public schools — and 90 million students and teachers globally — use free Google Education apps like Gmail and Google Docs. More than 25 million students and teachers also use Chromebooks, laptops that run on the company’s Chrome operating system, the lawsuit said.
In September, Google agreed to pay a $170 million fine to settle federal and New York State charges that it illegally harvested the personal data of children on YouTube.
The new lawsuit, filed in U.S. District Court for the District of New Mexico, claimed that Google violated the federal Children’s Online Privacy Protection Act. The law requires companies to obtain a parent’s consent before collecting the name, contact information and other personal details from a child under 13.
The lawsuit also said Google deceived schools, parents, teachers and students by telling them that were no privacy concerns with its education products when, in fact, the company had amassed a trove of potentially sensitive details on students’ online activities and locations.
Jose Castaneda, a Google spokesman, said the lawsuit’s claims were “factually wrong.”
“G Suite for Education allows schools to control account access and requires that schools obtain parental consent when necessary,” he said in a statement. “We do not use personal information from users in primary and secondary schools to target ads.”
For years, parents and privacy groups have complained that Google was using its education products to track millions of schoolchildren without adequately detailing its data-mining practices or obtaining explicit parental consent for the tracking. One issue of contention is that the company applies different privacy policies to different products.
Google has said its “core” products for schools, including Gmail and Drive, comply with privacy regulations requiring companies to use student data only for school purposes. The company said those core education products do not collect student data for advertising purposes or show targeted ads.
Google has maintained that other company services, like YouTube, which many schools also use, fall under a consumer privacy policy allowing it to collect user data for its own business purposes, such as product development.
Although the company provides school districts with an online dashboard to control student access to YouTube and dozens of other Google apps, some public school officials have said it can be difficult to parse the tech giant’s differing data-mining practices.
Mr. Balderas said Google had used its education products as a means to deceptively track schoolchildren for nonschool purposes.
When students log into their Chromebooks, Google turns on a feature that syncs its Chrome browser with other devices used by a student on that account, the lawsuit said. It effectively blends a student’s school and personal web activities into a single profile that Google can view, according to the lawsuit.
A feature that would prevent Google from full access to that data is also turned off by default, the suit said.
Students “begin engaging with Google technology through teachers and in school settings for homework, communication and other educational purposes,” Mr. Balderas said in a phone interview. Then the same schoolchildren, he said, go on to use Google services from their phones or at home, “allowing Google to track them for noneducational purposes — and definitely without the consent of their parents.”
Brian McMath, a senior litigator in the state attorney general’s Consumer and Environmental Protection division, said his office estimated that two-thirds of New Mexico’s school districts use some type of Google Education product.
This is not the first time that New Mexico has tangled with Google in the courts. Mr. Balderas filed a separate lawsuit in 2018 saying that a popular children’s app maker, along with advertising networks like Google and Twitter, had violated the federal children’s privacy law. In 2019, Google asked a federal judge to dismiss the suit. Mr. Balderas is also one of the state attorneys general who have publicly signed on to an antitrust investigation into Google.
To ease concerns about Google’s education data mining, the company agreed in 2015 to sign a voluntary industry pledge on student privacy. Under that pledge, Google promised not to collect, maintain, use or share student personal information beyond that needed for educational purposes.
Google also agreed not to use student information collected from its education services for behavioral ad targeting and not to retain students’ personal information beyond the time that the children were in school unless they received parental consent.
The lawsuit argued that Google had broken those promises.