Cross-posted from Marketplace K-12.
UPDATED
Google announced Wednesday in a blog post that it has halted the practice of scanning student Gmail accounts for any potential advertising purposes, apparently bowing to pressure from a lawsuit and an Education Week published report revealing the practice.
Used for free by more than 30 million students, educators, and administrators, Google Apps for Education provides Gmail accounts as part of its package of cloud-based services to schools.
Six weeks ago, Google acknowledged to Benjamin Herold for Education Week that the giant online-services provider scanned contents of millions of student users’ email messages within Apps for Education.
The issue arose from a lawsuit working its way through federal courts, in which accusations from plaintiffs charged Google with building “surreptitious” profiles of Apps for Education users that could result in advertising being targeted to them.
At the time, a Google spokeswoman confirmed to Education Week that the company “scans and indexes” the emails of all Apps for Education. Now, that practice has apparently been abandoned.
In the blog post Bram Bout, director of Google for Education, described the additional steps that Google is taking as: permanently removing the “enable/disable” toggle for ads, so that administrators can no longer turn on ads in these services, and removing all ads scanning in Gmail for Apps for Education.
In bold type, the giant online services provider added: “Google cannot collect or use student data in Apps for Education services for advertising purposes.”
The move was met with praise, and some cautionary comments, from various Google observers.
While Joel Reidenberg, a law professor at Fordham University and Princeton University, called Google’s measure “a positive step,” in an interview he identified two “significant problems” with it: Google can change this policy at any time, and, the scanning disclaimer is associated with advertising purposes only. “There may be other commercial uses that they are exploiting student data for,” he said, such as selling information to textbook publishers, or test-preparation services. Google’s Apps for Education security/privacy policy is described on this website.
“Schools have to look at what happens to their data once they no longer want to use Google Apps for Education, too,” said Reidenberg, who worked on a study released in December about privacy issues associated with cloud computing in schools. “Is it completely deleted from the Google system, or does it stay in the cloud forever?” While the service is free, he indicated that Google can make money by other means. “What’s the quid pro quo? If they’re not paying with cash, they’re paying with privacy,” he said.
This move will “force schools to do what they’ve always done, which is to not turn on ads,” said Henry Thiele, the assistant superintendent for technology and learning for the 6,800-student Maine Township High School District 207 in Illinois.
“I don’t know of a single school district that turns on ads, which would have—in the past—triggered the data piece for serving advertising to students and staff,” he added. Thiele will join Bout and Google’s director of product management in a Google “Hangout on Air” on the company’s Google for Education G+ page on Thursday at noon, Eastern time. “This is mostly just peace of mind for school districts, for families and students in districts who use Google Apps for Education.” His district has been using the suite of tools, which include cloud-based storage, collaborating with word-processing, spreadsheet, and other software applications, keeping a calendar, and sending email, since 2008.
“I don’t think parents or teachers thought that Google was doing what it was doing,” said Bradley S. Shear, a social-media and digital-privacy lawyer based in Bethesda, Md. He added that the move was a “good first step,” but that it took too long for the company to take that step.
As for the ed-tech industry, Google’s announcement got two thumbs up. “Google’s actions are another example of school service providers continuously evaluating and improving their products and practices to better meet user needs and expectations. This includes in the area of privacy and security,” Mark Schneiderman, the senior director of education policy for the Software & Information Industry Association, wrote in an email.
Moving forward, the sector will be challenged “to avoid over corrections that do not necessarily enhance privacy but instead unintentionally inhibit the effective use of data to enable school operations, enhance products and services, and personalize and improve student learning,” he wrote.
Bout of Google acknowledged the importance of the company’s new position in his blog post by writing that: Earning and keeping the trust of students, teachers, and administrators “drives our business forward. We know that trust is earned through protecting their privacy and providing the best security measures.”
A Google spokeswoman added, in an email, that ads were turned off by default “from day one” in Apps for Education services. “The changes announced today are simply a continued evolution of our efforts to provide the best experience for our users, including students,” the spokeswoman wrote.
The move comes after a lawsuit that started the firestorm of controversy. It is being heard by the U.S. District Court for the Northern District of California, and is set for trial in October. The plaintiffs allege that the data-mining practices behind Google’s Gmail electronic-messaging service violate federal and state wiretap and privacy laws. “We are very pleased that a substantial portion of the relief sought by this litigation has been achieved,” said attorney Sean F. Rommel, who with James C. Wyly of Wyly-Rommel PLLC in Texarkana, Texas, is representing two of the plaintiffs—Robert Fread, of the University of Hawaii, and Rafael Carrillo, of the University of the Pacific in Stockton, Calif. Fread and Carrillo say they were required to use Gmail accounts when their institutions adopted Google Apps for Education.
“The litigation has resulted in meaningful changes to Google’s practices, and has caused Google to update its disclosure. We’re proud to be part of the litigation, which has resulted in greater protection of email users’ privacy,” Rommel said in a prepared statement he read over the phone.
Questions also arose about the legality of the alleged practice under the Family Educational Rights and Privacy Act, or FERPA. The U.S. Department of Education’s guidance on student-data privacy, issued in March, seemed to deem the practice in violation of FERPA. However, a Google spokesman countered with the following emailed statement: “Google Apps for Education complies with FERPA and our commitment to do so is included in our agreements.”
Google, in its blog post, indicated that education is not the only domain where these changes are occurring: it is making similar changes to its services for businesses and government users.
UPDATE: This post was updated at 3:50 p.m. to include reaction from experts and additional comments from the company.