Breaking bad... browser use: New Mexico accuses Google of illegally slurping kids' private data via G Suite New Mexico has sued Google, claiming the ad-slinging web titan broke its promises – and the law – by covertly collecting personal information and the browsing habits of children. The southwestern US state – best known for Georgia O'Keeffe, nuclear-weapon proving grounds, and telly smash-hit Breaking Bad – alleged on Thursday …
Apart from the first sentence they don't actually deny the allegations.
State AG: "Google unlawfully collected kid's data"
Google: "schools control account access and... obtain parental consent" "We do not use [kids data] to target ads."
At no point do Google actually state they don't collect kid's data.
"At no point do Google actually state they don't collect kid's data."
Define "kids data" - e-mail/documents saved in the cloud/any set work is all potentially "kids data and browsing habits".
So...did Google collect data? Yes
Did Google collect data that they shouldn't have (assuming parental permission was correctly obtained)?
Aside from the consent issue, it will be interesting to see what New Mexico presents as evidence.
Should Google be collecting the data they "collect"? Suggestions on a postcard for how to store data, allow teachers to view data based on student submissions and retain anonymity.
I'm all for privacy where possible, but this feels like a get state sponsored rich quick scam rather than something that addresses privacy concerns.
They did say they did not use the data to target kids for ads. So a very specific and limited denial of something they were not accused of.
I like how Google employees get upset over specfic little issues dear to their little hearts, but they are quite happy to go in to work every day, make the world a little worse in so many ways, cash their paycheck and feel smugly virtuous.
No!
You Lie!
Google would never do anything like that!
Its against their principles.
It ... it must have been a rogue Programmer who wasn't following their rules.
They will surely get to the bottom of that and address it!
Google is pure as snow!
....
....
Do I really need to add the sarcasm tag?
And the snow... Peruvian Flake? Or the stuff Frank Zappa wrote a song about?
I'll let you be the judge.
Hmmm...that is a very specific denial which fails to answer the question of 'Do they collect the information'? Call me fickle (cue some predictable responses) but if you are being so misleadingly precise in your denials it seems to me the accusation is accurate.
Google's privacy statement is fairly readable now, and does state they'll slurp loads of stuff unless you block kids getting to them. They both say to get parental consent for anyone under 18 (UK), or block a huge list of Google services, including maps.
ie: Google's slurp limiter for kids is only to these few apps:
Gmail, Calendar, Classroom, Contacts, Drive, Docs, Forms, Groups, Sheets, Sites, Slides, Talk/Hangouts, Vault and Chrome Sync.
https://gsuite.google.com/terms/education_privacy.html
Microsoft's privacy statements are all over the place and seems to state that under the "age of majority" - whoever creates the account is agreeing to supervise all activity of them! <18 YO's!! (So kids, stop using teams for homework, there are no teachers about)...
https://www.microsoft.com/en-gb/servicesagreement/
https://privacy.microsoft.com/en-gb/privacystatement
It's very difficult to see if Microsoft has any extra level of protection for kids.
As a School admin using Microsoft and Google clouds, I've at least been informed by Google we need parental consent, else T's&C's say we block the rest or breach contract.
"As a School admin using Microsoft and Google clouds, I've at least been informed by Google we need parental consent, else T's&C's say we block the rest or breach contract."
That may not be as positive as it seems. That sounds like a minor legal measure that ensures that Google can blame you, the parents, or the children if ever something goes wrong because they got some forms. While it ensures that the parents have a chance to see what will be happening, it doesn't provide them or you with extra opportunities to do anything about it, and a privacy-conscious parent will probably instruct their children on how to use normal, privacy-respecting replacements for these Google services anyway, meaning that those who are most at risk get little or no protection from showing them some legal text.
That Microsoft et al have convoluted and possibly conflicting privacy statements doesn't surprise me. I would like to refer you to this rather excellent Freefall cartoon which describes the situation beautifully IMHO.
That said, when it comes to confusion I still think that Adobe remains a strong number one regarding complicating the access to legal statements. What they cooked up is award winning as requires *serious* effort to find the bit of data that applies to you - I'm assuming the idea is to make people give up halfway through their search.
If you're interested in these matters I would suggest a visit to Google's archive of previous statements, because it allows you to see which words Marketing has changed to more benign appearing texts. The words "into perpetuity", for instance, have been replaced with text that means the same, but appearing more benign.
Not too far from South Park, Colorado, (really) my kids' elementary school uses Chromebooks for some tasks, Windows 7 desktops older than they are for other tasks and whatever unsecured BYOD they have for others. Code.org for "coding"; SlyReply for way too much, school news in a Word doc - you get the idea. Security is also as you would expect.
It's SNAFU or nothing though. The schools here barely have enough shekels to keep the heat on, much less hire an IT team with the required experience to support nearly 1000 child customers. Teachers have emailed with "get this great app for your kid". I read the TOS (yup, I'm that guy) and reply back there's no way we're agreeing to them. Crickets. I know they're thinking "why doesn't he just click ok?" because they likely never read the TOS. Most of the time I have to disable the piHole for 5 minutes just to even view whatever link they send. Why don't I boot a portable OS from a thumb drive for that? I'm lazy. :)
And all of this in the middle of Colorado. Nice place. High property taxes. High rent because 30% of the housing stock is owned by investors. Again, you get the idea. If a school here can't afford to roll their own and not trade delicious data for hardware and services, what's a rural district in West Virginia, Louisiana, South Dakota, etc. going to do? Google, et. al. are taking advantage of the situation, sure, but we launched this ship. If only there was money somewhere to put 'er in drydock and have a re-fitting.
Did some napkin maths looking for money. Using the Walton family of WalMart fame as an example, the internet says they're worth US$192B. They could build 100 (yes, 100) Burj Khalifa's and still have US$13B left over. They could give half to education, never earn another shekel and still be able to spend US$364K every single day for the next 50 years.
That's one family, albeit an outlier. If only there were other families or companies who could help.What a wonderful world it would be!
Cheers!
its supposed to be:
Article 12 Universal Declaration of Human Rights:
No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks.
a core agreement of the United Nations, and something all members have to sign up for
A scorpion, which cannot swim, asks a frog to carry it across a river on the frog's back. The frog hesitates, afraid of being stung by the scorpion, but the scorpion argues that if it did that, they would both drown. The frog considers this argument sensible and agrees to transport the scorpion. Midway across the river, the scorpion stings the frog anyway, dooming them both. The dying frog asks the scorpion why it stung the frog despite knowing the consequence, to which the scorpion replies: "I couldn't help it. It's in my nature."
The analogy falls down in that Google will, as usual, face no consequences. However, the point remains: they can't not collect data. It's [in] their nature.
Speaking as someone who has worked in IT for education, I will say that if students and teachers didn't do all their personal business(and worse) on school\work hardware\networks, google wouldn't be getting much but educational data. I only use google chrome to do gafe admin stuff. Not even a search for a problem\solution.
Sometimes I get the feeling people do stuff on their work kit they would never, ever do on their home kit.
Where's the jaded old git icon when I need it...
That's all true, but somehow we have to indicate this to the students. When you're young and don't know how all the tracking and data collection work, you probably assume that you're safer than you really are. And, as a student, you probably don't have a large supply of alternative machines to use for anything private. This might be changing due to increased smartphone use, but they probably don't have their own computers, and home computers for the whole family's use are less prevalent now that laptops are more popular. The first problem we can help fix by increasing education about the dangers of online data collection, while the second one is trickier but we could still help by showing them how to use trustworthy software and maintain good security behavior.
Those posted above have teased out the gag here. Googles hollow assertion that G-suite for education does not use data "to target ads" only applies to the specific applications. Not maps, or a brace of other services. In addition, they dodge both what they are collecting and who they are sharing it with, internally and externally.
Forced transparency is the only remedy here. Though people won't be too happy if they find out their kids have been used to train project Firefly, or a facial recognition project.
School has mandated that a large chunk of homework is done in Google Docs, and each child is given a log-in. No, of course Google doesn't do anything with the data. Everything is safe and stays within the education suite.
Child is doing something at home in Docs and needs to look something up on YouTube. Child does not have a personal YouTube (or Google) account (none of us does) and yet YT recognises child and refuses to play the video because "under 13". The only way YT could have worked this out is if Google suite for education has passed the details on.
Video works fine once I show child how to open the link in a Firefox private tab :-) but that really isn't the point.
No, didn't bother reporting this one to the school. School didn't listen last time I tried. The subject of this article? Unlikely to be heard either, nor the one about Google exporting data to the US.
Lemmings.
M.
Well, Google must by law remember that the account belongs to a child, since otherwise they would start automatically building a user profile to serve targeted ads. This of course applies to YouTube just like all other Google services. Apparently, you think Google should forget that fact when it comes to showing YouTube videos; but there's certainly many people who would argue that this would also be illegal. I imagine there would be a huge outcry saying Google conveniently "forgets" to protect children in order to make money from them...
You miss the point. YouTube doesn't know that my child is, in fact, a child, because YouTube has never been told this. Said child does not have a YT account, and does not "log in" to Google services for anything except school. Google Suite for Education (or whatever it is called) specifically says that the data is safe and never used outside GSfE.
But it plainly is, because it sees the same web browser that is logged into GSfE also browsing YT and YT suddenly recognises that there's a "child" browsing, which it did not do before said child logged on to GSfE. (and for pity's sake, I can't remember exactly what it was, but the video that was blocked was something completely innocuous)
Google now knows exactly when my child is browsing because although we run NoScript and have blacklisted many Google domains (doubleclick etc.), some Google stuff is necessary for many websites to work so gets "temporarily allowed" on an as-and-when basis. I've just checked, and domains with "google" in the address have a total of - believe it or not - seventy nine cookies installed in my child's instance of Firefox. I have no doubt that some cross-referencing can now be carried out as my child wanders around the internet and just about every blasted website sends data back to the mothership.
Some Google cookies are necessary - consent.google.com and adsettings.google.com deal with some of the annoyances, and mail.google.com, drive.google.com, docs.google.com and classroom.google.com (about 25 cookies between them) are needed (I assume) for GSfE to work, but seventy nine?*
It's impossible to escape Google altogether (my own instance of FF has 19 "google" cookies set, though some haven't been accessed since "last year") but we do our best to make it difficult for them.
If it didn't completely break most websites I'd just permanently block all Javascript, and I'm very tempted to use permanent "private" browsing and / or cookie deletion, but that then means that every blasted time you do have to use a Google service, you have to go through that interminable "we need your consent to serve you drivel" malarky.
M.
*that said, cookies belonging to *.theregister.* total one hundred and fifty five on my currently running copy of Firefox
YouTube doesn't know that my child is, in fact, a child, because YouTube has never been told this. Said child does not have a YT account
YouTube is a Google service. If you have a Google account, you have a YouTube account. If you're logged in to Google, you're logged in to YouTube.
Google even recently got fined $170m for not guessing that YouTube users were children, even though they were using the account of adults. What do you think would happen if they let your child watch YouTube, even though they know it's a child?
The information that this is a child must be used everywhere. If it was not, it would mean that Google would automatically create a profile of the user, like they do for every user, even those who are not logged in. And then they would get sued for creating a profile of a child, even though they have a system somewhere that explicitly knows that this is a child. This is literally mandated by law to protect the children.
(I wasn't the down-voter, by the way)
This is (I hope) going to be my last post on the subject but I do have a couple of things to add.
First, I'm in the UK rather than the US, and GSfE has (supposedly) been specifically tailored for EU data protection laws and GPDR. Unlike the US, over this side of the pond we have (for now at least) a reasonable presumption of privacy, and consent required for use of data, child or not. In my specific case there should be no "information that this is a child" because that information is supposed to stay internal to GSfE.
Secondly, the article you link does not completely back your argument up. I may have missed it, but I don't see the part where it says that the children in question were "using the account of adults". It's perfectly possible to browse YT without logging in at all - my household does this, as we have no Google accounts. Given the above, this part of the report is particularly relevant:
Google and YouTube have agreed to respect the privacy of anyone watching videos intended for children."Starting in about four months, we will treat data from anyone watching children’s content on YouTube as coming from a child, regardless of the age of the user,"
Programming aimed at children can reasonably be expected to be watched by children, even if the provider in question has a "no under 13s" rule (and don't get me started on the wisdom of relying on an under 13s rule).
Essentially we're coming from different directions. I say "don't track me unless I give you specific consent" - GDPR, EU cookie law etc. - Google (and most US-based companies and, indeed, a few from over here who don't seem *quite* to have got the idea) says "I will track you unless you have opted out, and even then I might still track you" (cf Windows 10 telemetry).
M.
"We do not use personal information from users in primary and secondary schools to target ads [...]" [Emphasis added]
"But we do use personal information from users in primary and secondary schools to ____________."
One can imagine how an outfit like Google might fill in that blank.
Geez, I need more underscores!
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
