The Student Privacy Pledge is a Binding Legal Commitment and G Suite for Education Makes the Grade
The Student Privacy Pledge is a public and legally enforceable statement by ed tech companies to safeguard student privacy, built around a dozen commitments regarding the collection, maintenance, and use of student personal information. Since it was introduced in 2014 by the Future of Privacy Forum and the Software and Information Industry Association, more than 300 ed tech companies have become signatories, and it was endorsed by the White House in 2015.
Yesterday, the Mississippi Attorney General filed a Complaint against Google, alleging that the company violated its promises as a signatory of the Student Privacy Pledge (“Pledge”). After reviewing the Complaint and Google’s policy, the Future of Privacy Forum has determined that Google’s practices are consistent with its obligations under the Pledge.
First, it is important to understand that only Google’s educational products, known collectively as G Suite for Education, are subject to the Pledge. As we have written before, the Pledge covers only “school service providers,” – that is, companies when they are operating in their capacity as a provider of a service that is both designed and marketed for use in schools. This is consistent with most state student privacy laws and proposed federal bills. Why? When vendors are selling their general market products, they should not be required to change those products simply because they are sold to a school. The Pledge, and all state student privacy laws, are written to cover services like G Suite for Education that are specifically designed and marketed to schools.
The Complaint alleges that Google is advertising to students based on “data mining” the student’s behavioral activity while logged into G Suite. However, Google has consistently stated that there are no ads in the G Suite for Education Core Services, which include Gmail, Calendar, Classroom, Drive, Docs, Sheets, Slides, Contacts, Groups, Vault, and Hangouts. Beyond those core services, school administrators must opt-in to allow students to use their school account with other Google services, some of which are ad supported, such as YouTube, Maps, or Blogger. Students can likewise be on a personal device, and “sync” the device or use other websites with their G Suite account if a school administrator allows them to do so. When using these commercial sites – not covered by the Pledge – students will see ads, but no student personal information from within the G Suite for Education Core Service products is ever used to target that advertising.
Targeted advertisements to students using data collected from G Suite for Education student accounts is not allowed under the Pledge, and Google does not do this. Therefore, we don’t believe the Complaint raises any valid issues about student data use by Google for Mississippi students. Google’s practices meet the commitments it has publicly made, as expressed in the Student Privacy Pledge.
