Google Accounts to Kids May Harm Their Privacy

Will the default privacy option for children be no data collection of personally identifiable information (PII) (i.e., opt-in required instead of opt-out)? If a child who is under 13 years old keeps his Google account past the age of 13, will the default be for Google to automatically delete the data it has collected (i.e., opt-in required to keep the pre-13 data instead of opt-out)?

Will informed consent be via a small check box, or will parents be provided clear and concise warnings about how their children's personal information may be utilized? The documentary “Terms and Conditions May Apply” thoroughly discussed some of the troubling issues inherent with Google's terms and privacy policy.

Why is Google really opening up its services to those under 13 and allegedly willing to jump through extra compliance hurdles to comply with COPPA? According to Silicon Beat, the tech blog of The Mercury News: “While YouTube is profitable, it may not make as much money as some analysts thought, according to an article in The Information blog (subscription required).” See, “YouTube: News Report Says It's Not Growing (Revenue) As Fast As Some Thought.”'

Google Has to Expand

According to the CDD: “Google has a problem. In order to continue to be the global digital marketing leader, it has to expand its monetizing (the industry term for making cash off us and our data) practices. Kids are the last nearly untouched market, since COPPA's opt-in and informed parental consent privacy requirements are a serious problem for Google and others who really don't want to respect our privacy online. Kids (so called 'Generation Z' by marketers) are a very lucrative market, spending and influencing billions of dollars each year, including for games, apps and other products. Companies want to 'brand' early and develop lifelong loyalty and, of course, ongoing spending.” See, “Google Plans,” supra.

Can Google, the most profitable advertising company in the history of the world, be trusted to protect our kids' personal and most sensitive information? Since a company's past actions are generally an excellent indicator of future behavior it would be prudent to examine some of Google's recent history regarding online privacy.

In 2011, the FTC's groundbreaking agreement with Google banned the company from making future privacy misrepresentations because its Buzz social network had deceptive privacy practices. See, “FTC Charges Deceptive Privacy Practices in Googles [sic] Rollout of Its Buzz Social Network,” FTC.gov. Unfortunately for users, Google violated this agreement in 2012 because it paid a $22.5 million dollar fine for misleading users about its privacy practices. See, “Google Will Pay $22.5 Million to Settle FTC Charges it Misrepresented Privacy Assurances to Users of Apple's Safari Internet Browser,” FTC.gov. In 2013, Google entered into a multi-million dollar privacy violation settlement regarding its Street View Project's data collection practices. See, “Google Concedes That Drive-By Prying Violated Privacy,” NY Times.com. Earlier this year, Education Week caught Google scanning student e-mails in its Google Apps For Education platform for advertising purposes (see, “Google Under Fire for Data-Mining Student Email Messages“), despite denying the practice for years (see, “Google's Apps for Education and the New Privacy Policy,” The Journal.com.

Time Magazine 's Jacob Davidson made a very keen observation about why Google wants to offer its services to kids under 13 when he stated: “Another reason for kid-centric services could be a desire by Google to break into the lucrative education market. The company's Chromebooks are low-cost laptops that might be attractive to schools, but the products are entirely based around Google services.” See, “'Google for Kids' Is Coming.”'

How Online Data Is Used

If Google officially offers its services to children under 13 years of age, it is almost certain that Facebook, Instagram, Yahoo, etc, will follow. My concern is that I don't believe most people, regardless of their age, truly understand how these companies are repurposing the information they are collecting.

Do Google users know that their search history is being tied to the videos they watch on YouTube and the content in their Gmail accounts and this information is being utilized for behavioral advertising and other non-transparent purposes? Do Facebook account holders realize that every “Like” and status update is being sent directly to data brokers and this information may be combined with offline behavior which may negatively affect credit scores which may lead to less favorable home and/or auto loan rates? See, “Facebook Joins Forces With Data Brokers To Gather More Intel About Users For Ads,” Forbes.com. Do people know that some companies may utilize their personal data for scientific experiments that may emotionally harm them? See, “Privacy Group Complains to F.T.C. About Facebook Emotion Study,” NY Times.com.

Age restrictions on driving and alcohol consumption are in place because as a society we have deemed them important to reach certain public policy goals.

Since children are increasingly utilizing digital platforms for not just leisure activities but also for educational purposes, why should they be required to waive their personal privacy rights to utilize a particular service? Why shouldn't digital providers be required to change their privacy policies and data collection practices if they want to cater to children?

Google creates some exciting products and services that may be beneficial to kids. However, until it changes its troubling privacy policy and demonstrates it won't act “evil” when it comes to safeguarding our children's personal information, I don't believe it can be trusted to protect their privacy.

Bradley S. Shear is a lawyer in Bethesda, MD, and an Adjunct Professor at George Washington University. A member of this newsletter's Board of Editors, he practices digital media and Internet law, privacy and advertising law, and copyright and trademark law. Shear advises state and federal lawmakers around the country on digital law and public policy issues. He can be reached at www.shearlaw.com and on Twitter @bradleyshear.

Recently, multiple media outlets reported that Google plans to offer accounts for their wide array of services to children under 13 years of age. See, “Google Is Planning to Offer Accounts to Kids Under 13,” WSJ.com. While the details regarding this alleged plan have not been publicized, it has already created a lot of concern with multiple privacy advocates. In response to these reports, the Center For Digital Democracy (CDD) stated: Anyone who knows how Google really conducts its business should be alarmed about its plans to make money off of kids.” See, “Google's Plans to Target Kids with Marketing and Ads.”'

Implementation Issues

There are many unanswered questions about this proposal. For example, how does Google plan on implementing this new offering? How will these accounts become compliant with the Children's Online Privacy Protection Act (COPPA)? Will accounts for children under the age of 13 (the age range that COPPA covers) be governed by a new privacy policy that actually protects the personal privacy of children rather than the standard Google consumer privacy policy that is in reality a data use policy?

Will the default privacy option for children be no data collection of personally identifiable information (PII) (i.e., opt-in required instead of opt-out)? If a child who is under 13 years old keeps his Google account past the age of 13, will the default be for Google to automatically delete the data it has collected (i.e., opt-in required to keep the pre-13 data instead of opt-out)?

Will informed consent be via a small check box, or will parents be provided clear and concise warnings about how their children's personal information may be utilized? The documentary “Terms and Conditions May Apply” thoroughly discussed some of the troubling issues inherent with Google's terms and privacy policy.

Why is Google really opening up its services to those under 13 and allegedly willing to jump through extra compliance hurdles to comply with COPPA? According to Silicon Beat, the tech blog of The Mercury News: “While YouTube is profitable, it may not make as much money as some analysts thought, according to an article in The Information blog (subscription required).” See, “YouTube: News Report Says It's Not Growing (Revenue) As Fast As Some Thought.”'

Google Has to Expand

According to the CDD: “Google has a problem. In order to continue to be the global digital marketing leader, it has to expand its monetizing (the industry term for making cash off us and our data) practices. Kids are the last nearly untouched market, since COPPA's opt-in and informed parental consent privacy requirements are a serious problem for Google and others who really don't want to respect our privacy online. Kids (so called 'Generation Z' by marketers) are a very lucrative market, spending and influencing billions of dollars each year, including for games, apps and other products. Companies want to 'brand' early and develop lifelong loyalty and, of course, ongoing spending.” See, “Google Plans,” supra.

Can Google, the most profitable advertising company in the history of the world, be trusted to protect our kids' personal and most sensitive information? Since a company's past actions are generally an excellent indicator of future behavior it would be prudent to examine some of Google's recent history regarding online privacy.

In 2011, the FTC's groundbreaking agreement with Google banned the company from making future privacy misrepresentations because its Buzz social network had deceptive privacy practices. See, “FTC Charges Deceptive Privacy Practices in Googles [sic] Rollout of Its Buzz Social Network,” FTC.gov. Unfortunately for users, Google violated this agreement in 2012 because it paid a $22.5 million dollar fine for misleading users about its privacy practices. See, “Google Will Pay $22.5 Million to Settle FTC Charges it Misrepresented Privacy Assurances to Users of Apple's Safari Internet Browser,” FTC.gov. In 2013, Google entered into a multi-million dollar privacy violation settlement regarding its Street View Project's data collection practices. See, “Google Concedes That Drive-By Prying Violated Privacy,” NY Times.com. Earlier this year, Education Week caught Google scanning student e-mails in its Google Apps For Education platform for advertising purposes (see, “Google Under Fire for Data-Mining Student Email Messages“), despite denying the practice for years (see, “Google's Apps for Education and the New Privacy Policy,” The Journal.com.

Time Magazine 's Jacob Davidson made a very keen observation about why Google wants to offer its services to kids under 13 when he stated: “Another reason for kid-centric services could be a desire by Google to break into the lucrative education market. The company's Chromebooks are low-cost laptops that might be attractive to schools, but the products are entirely based around Google services.” See, “'Google for Kids' Is Coming.”'

How Online Data Is Used

If Google officially offers its services to children under 13 years of age, it is almost certain that Facebook, Instagram, Yahoo, etc, will follow. My concern is that I don't believe most people, regardless of their age, truly understand how these companies are repurposing the information they are collecting.

Do Google users know that their search history is being tied to the videos they watch on YouTube and the content in their Gmail accounts and this information is being utilized for behavioral advertising and other non-transparent purposes? Do Facebook account holders realize that every “Like” and status update is being sent directly to data brokers and this information may be combined with offline behavior which may negatively affect credit scores which may lead to less favorable home and/or auto loan rates? See, “Facebook Joins Forces With Data Brokers To Gather More Intel About Users For Ads,” Forbes.com. Do people know that some companies may utilize their personal data for scientific experiments that may emotionally harm them? See, “Privacy Group Complains to F.T.C. About Facebook Emotion Study,” NY Times.com.

Age restrictions on driving and alcohol consumption are in place because as a society we have deemed them important to reach certain public policy goals.

Since children are increasingly utilizing digital platforms for not just leisure activities but also for educational purposes, why should they be required to waive their personal privacy rights to utilize a particular service? Why shouldn't digital providers be required to change their privacy policies and data collection practices if they want to cater to children?

Google creates some exciting products and services that may be beneficial to kids. However, until it changes its troubling privacy policy and demonstrates it won't act “evil” when it comes to safeguarding our children's personal information, I don't believe it can be trusted to protect their privacy.

Bradley S. Shear is a lawyer in Bethesda, MD, and an Adjunct Professor at George Washington University. A member of this newsletter's Board of Editors, he practices digital media and Internet law, privacy and advertising law, and copyright and trademark law. Shear advises state and federal lawmakers around the country on digital law and public policy issues. He can be reached at www.shearlaw.com and on Twitter @bradleyshear.