by Lisa Vaas
Two schoolchildren have sued Google, alleging that it’s illegally collecting their voiceprints, faceprints and other personally identifiable information (PII).
The students were identified only as HK and JC in the complaint, which was filed on Thursday in San Jose, CA, in the US District Court of Northern California. The children are suing through their father, Clinton Farwell.
The complaint notes that Google has infiltrated the country’s primary and secondary school systems by distributing its Chromebook laptops, which come pre-installed with its G Suite for Education platform. That suite includes student versions of Gmail, Calendar, Drive, Docs, Sheets, and other Google apps.
In order to use those apps, the kids had to speak into the laptop’s audio recording device so Google could record their voices, and they had to look into the laptop’s camera so Google could scan their faces.
According to the lawsuit, over half of the nation’s school children use Google’s education products, including those in Illinois, most of whom are under the age of 13.
Illinois comes into play because it’s got the strictest biometrics privacy law in the land: the Biometric Information Privacy Act (BIPA). BIPA requires private entities – like Google – to first get our informed consent before collecting our biometrics, including faceprints and voiceprints.
The complaint alleges that Google’s violating both BIPA and the nation’s strictest federal online children’s privacy law, the Children’s Online Privacy Protection Act (COPPA). COPPA requires websites and online services to fully and clearly disclose their data collection, use, and disclosure practices and that they obtain verifiable parental consent before collecting, using, or disclosing the data they collect from children younger than 13.
“Incredibly,” the complaint says, Google’s violating both of those privacy protection laws at the same time. The lawsuit says that besides faceprints and voiceprints, Google’s also illegally creating, collecting, storing and using students’ PII, including:
- their physical locations;
- the websites they visit;
- every search term they use in Google’s search engine (and the results they click on);
- the videos they watch on YouTube;
- personal contact lists;
- voice recordings;
- saved passwords; and
- other behavioral information.
…all without verifiable parental consent. From the complaint:
Google has complete control over the data collection, use, and retention practices of the ‘G Suite for Education’ service, including the biometric data and other personally identifying information collected through the use of the service, and uses this control not only to secretly and unlawfully monitor and profile children, but to do so without the knowledge or consent of those children’s parents.
The plaintiffs are requesting a jury trial. They want Google to stop collecting the data and to destroy whatever data it has. The suit is also seeking $5,000 per student for each of Google’s alleged “intentional or reckless” violations, and $1,000 for each “negligent” violation.
Not the first time
Even before COVID-19 sent schools reeling into a crash course on remote learning and an embrace of the tools companies offer to make it happen, Google was looking at legal action over the privacy implications of students using its free G Suite for Education-loaded Chromebooks.
In February, New Mexico Attorney General Hector Balderas sued Google over alleged data slurping with the laptops. Like the BIPA lawsuit filed last week, Balderas accused Google of secretly collecting information including students’ geolocation information, internet history, terms that students have searched for on Google, videos they’ve watched on YouTube, personal contact lists, saved passwords, voice recordings, and more, in violation of COPPA.
Google had already been fined over blowing kids’ privacy a few months prior to New Mexico’s suit. In September 2019, the Federal Trade Commission (FTC) fined the company $170 million for illegally sucking up kids’ data so it could target them with ads.
In response to the FTC fine, Google’s YouTube subsidiary decided to sit out the thorny task of verifying age, instead passing the burden on to content creators, leaving them liable for being sued over COPPA violations, even if the creators themselves think that their content is meant for viewers over the age of 13. More @ Source
