Case 1:20-cv-00143-NF-KHR Document 28 Filed 06/04/20 Page 1 of 35
`
`UNITED STATES DISTRICT COURT
`FOR THE DISTRICT OF NEW MEXICO
`
`STATE OF NEW MEXICO, ex rel.
`HECTOR BALDERAS, Attorney General for the
`State of New Mexico,
`
`Plaintiff,
`
`v.
`
`GOOGLE, LLC, a Delaware limited liability
`company,
`
`Defendant.
`
`Civil Action No. 1:20-cv-00143-NF-KHR
`Hon. Nancy Freudenthal
`
`ORAL ARGUMENT REQUESTED
`
`GOOGLE’S MOTION TO DISMISS THE COMPLAINT
`AND MEMORANDUM IN SUPPORT
`
`

`

`Case 1:20-cv-00143-NF-KHR Document 28 Filed 06/04/20 Page 2 of 35
`
`TABLE OF CONTENTS
`
`II.
`
`B.
`
`MOTION TO DISMISS .............................................................................................................. 1
`MEMORANDUM IN SUPPORT................................................................................................ 1
`INTRODUCTION ...................................................................................................................... 1
`BACKGROUND ........................................................................................................................ 2
`A.
`Google Provides G Suite For Education To Schools For Free ............................... 2
`B.
`Google’s Privacy Commitments For GSFE .......................................................... 3
`C.
`Google Relies On Schools To Provide Or Obtain Parental Consent For
`Students Using The Core And Additional Services ............................................... 4
`The Attorney General Files Suit ........................................................................... 5
`D.
`LEGAL STANDARD ................................................................................................................. 5
`ARGUMENT .............................................................................................................................. 6
`I.
`THE COMPLAINT FAILS TO PLEAD A COPPA VIOLATION ................................... 6
`A.
`COPPA Requires “Reasonable Efforts” To Obtain Consent ................................. 7
`B.
`FTC Guidance: Operators May Rely On Schools To Provide Or Obtain
`Consent ................................................................................................................ 7
`Google Follows The FTC’s Guidance ................................................................ 10
`C.
`Following FTC Guidance Is Reasonable ............................................................ 11
`D.
`The Attorney General’s Remaining COPPA Theories Fail ................................. 14
`E.
`THE COMPLAINT IDENTIFIES NO UPA VIOLATION ............................................ 15
`A.
`The Attorney General Has Not Alleged Any Sale, Lease, Rental, or Loan In
`Connection with GSFE ...................................................................................... 15
`The Complaint Identifies No Fraudulent Or Misleading Statement Or
`Omission That Violates The UPA ...................................................................... 16
`1.
`Most alleged misrepresentations in the Complaint are insufficiently
`pled ........................................................................................................ 17
`The Complaint does not plausibly allege that Google fails to comply
`with the identified privacy commitments ................................................ 18
`Google’s publication of its Privacy Notice defeats any omissions claim .. 20
`3.
`The Attorney General’s COPPA-Based UPA Claims Fail On
`The Merits And Are Preempted .......................................................................... 21
`The Complaint’s “Unconscionable” Practices Claim Also Fails Because
`Nothing Alleged In The Complaint Is Unconscionable ....................................... 23
`III.
`THERE IS NO INTRUSION UPON SECLUSION ....................................................... 24
`CONCLUSION ......................................................................................................................... 27
`
`2.
`
`C.
`
`D.
`
`i
`
`

`

`Case 1:20-cv-00143-NF-KHR Document 28 Filed 06/04/20 Page 3 of 35
`
`TABLE OF AUTHORITIES
`
`Page(s)
`
`Federal Cases
`
`Alvarado v. KOB-TV, LLC,
`493 F.3d 1210 (10th Cir. 2007).................................................................................. 4, 20, 25
`
`Ashcroft v. Iqbal,
`556 U.S. 662 (2009) .............................................................................................................. 5
`
`Auer v. Robbins,
`519 U.S. 452 (1997) ...................................................................................................... 12, 13
`
`New Mexico ex rel. Balderas v. Tiny Lab Productions,
`No. 18-854 MV/JFR, 2020 WL 2065275 (D.N.M. Apr. 29, 2020) ..................... 11, 16, 23, 26
`
`Barreras v. Travelers Home & Marine Ins. Co.,
`No. 12-CV-0354 RB/RHS, 2012 WL 12870348 (D.N.M. Oct. 17, 2012) ............................. 17
`
`Bell Atl. Corp. v. Twombly,
`550 U.S. 544 (2007) ........................................................................................................ 5, 15
`
`Choate v. Champion Home Builders Co.,
`222 F.3d 788 (10th Cir. 2000) ............................................................................................. 22
`
`Dahlberg v. Avis Rent A Car Sys., Inc.,
`92 F. Supp. 2d 1091 (D. Colo. 2000) ................................................................................... 12
`
`Dine Citizens Against Ruining Our Env't v. Jewell,
`No. CIV 15-0209 JB/SCY, 2015 WL 4997207 (D.N.M. Aug. 14, 2015) .............................. 12
`
`Dubbs v. Head Start, Inc.,
`336 F.3d 1194 (10th Cir. 2003)...................................................................................... 26, 27
`
`English v. Gen. Elec. Co.,
`496 U.S. 72 (1990) ........................................................................................................ 21, 22
`
`Gade v. Nat’l Solid Wastes Mgmt. Ass’n,
`505 U.S. 88 (1992) ........................................................................................................ 22, 23
`
`Kelly v. Advanta Corp.,
`No. CV 02-250 LH/RHS, 2003 WL 27385023 (D.N.M. July 1, 2003) ................................. 25
`
`Kisor v. Wilkie,
`139 S. Ct. 2400 (2019) .................................................................................................. 12, 13
`
`i
`
`

`

`Case 1:20-cv-00143-NF-KHR Document 28 Filed 06/04/20 Page 4 of 35
`
`Koch v. Koch Indus.,
`203 F.3d 1202 (10th Cir. 2000)........................................................................................ 5, 17
`
`Manigault-Johnson v. Google, LLC,
`No. 2:18-CV-1032-BHH, 2019 WL 3006646 (D. S.C. Mar. 31, 2019) ........................... 22, 26
`
`Michelson v. Merrill, Lynch, Pierce, Fenner & Smith, Inc.,
`669 F. Supp. 1244 (S.D.N.Y. 1987) ..................................................................................... 17
`
`Mitchell v. Comm’r,
`775 F.3d 1243 (10th Cir. 2015)............................................................................................ 12
`
`SEC v. Nacchio,
`438 F. Supp. 2d 1266 (D. Colo. 2006) ................................................................................. 18
`
`Nanodetex Corp. v. Sandia Corp.,
`No. 05-cv-1041, 2007 WL 4356154 (D.N.M. July 26, 2007) ............................................... 16
`
`In re Nickelodeon Consumer Privacy Litig.,
`827 F.3d 262 (3d Cir. 2016) .......................................................................................... 25, 26
`
`Safe Streets All. v. Hickenlooper,
`859 F.3d 865 (10th Cir. 2017) ............................................................................................... 5
`
`Schwartz v. State Farm Mut. Auto. Ins. Co.,
`No. 1:18-CV-00328-WJ-SCY, 2018 WL 4148434 (D.N.M. Aug. 30, 2018) ........................ 24
`
`Sedillos v. United Collection Bureau, Inc.,
`No. 10-CV-1063 WJ/WDS, 2011 WL 13289655 (D.N.M. Aug. 17, 2011) ........................... 23
`
`Sprietsma v. Mercury Marine,
`537 U.S. 51 (2002) .............................................................................................................. 22
`
`Summit Elec. Supply Co. v. Int’l Bus. Machs. Corp.,
`No. 1:07-CV-0431 MCA/DJS, 2009 WL 9087259 (D.N.M. Sept. 30, 2009) ........................ 17
`
`Two Old Hippies, LLC v. Catch the Bus, LLC,
`784 F. Supp. 2d 1200 (D.N.M. 2011)............................................................................. 17, 18
`
`Van Woudenberg v. Gibson,
`211 F.3d 560 (10th Cir. 2000), abrogated on other grounds by McGregor v.
`Gibson, 248 F.3d 946 (10th Cir. 2001) .................................................................................. 6
`
`Williams v. Foremost Ins. Co.,
`102 F. Supp. 3d 1230 (D.N.M. 2015)................................................................................... 15
`
`Yunker v. Pandora Media, Inc.,
`No. 11–CV–3113 JSW, 2013 WL 1282980 (N.D. Cal. Mar. 26, 2013) ................................ 25
`
`ii
`
`

`

`Case 1:20-cv-00143-NF-KHR Document 28 Filed 06/04/20 Page 5 of 35
`
`State Cases
`
`Dollens v. Wells Fargo Bank, N.A.,
`356 P.3d 531 (N.M. Ct. App. 2015) ..................................................................................... 18
`
`Hicks v. Eller,
`280 P.3d 304 (N.M. Ct. App. 2012) ..................................................................................... 16
`
`State ex rel. King v. B&B Inv. Grp., Inc.,
`329 P.3d 658 (N.M. 2014) ............................................................................................. 23, 24
`
`Moore v. Sun Publ’g Corp.,
`881 P.2d 735 (N.M. Ct. App. 1994) ............................................................................... 24, 25
`
`Portales Nat’l Bank v. Ribble,
`75 P.3d 838 (N.M. Ct. App. 2003) ....................................................................................... 24
`
`Federal Statutes
`
`Children’s Online Privacy Protection Act, 15 U.S.C. § 6501, et. seq .................................. passim
`
`15 U.S.C. § 6502(b) .............................................................................................................. 6, 12
`
`15 U.S.C. § 6502(d) ............................................................................................................ 12, 21
`
`15 U.S.C. § 6505 ....................................................................................................................... 22
`
`State Statutes
`
`N.M. Stat. Ann. § 57-12-2(D)............................................................................................... 15,18
`
`N.M. Stat. Ann. § 57-12-2(E) .................................................................................................... 23
`
`N.M. Stat. Ann. § 57-12-3 ......................................................................................................... 15
`
`Regulations
`
`16 C.F.R. § 312.2 ........................................................................................................................ 7
`
`16 C.F.R. § 312.3 ........................................................................................................................ 7
`
`16 C.F.R. § 312.7 ...................................................................................................................... 15
`
`64 Fed. Reg. 59,888 (Nov. 3, 1999) ......................................................................... 7, 8, 9, 11, 13
`
`84 Fed. Reg. 35,842 (July 25, 2019) ........................................................................................ 8, 9
`
`iii
`
`

`

`Case 1:20-cv-00143-NF-KHR Document 28 Filed 06/04/20 Page 6 of 35
`
`Other Authorities
`
`Children’s Online Privacy Protection Act of 1998: Hearing on S. 2326 Before the
`S. Comm. on Commc’ns, 150th Cong., 115 Cong. 7 (Sept. 23, 1998)
`(statement of Sen. Richard H. Bryan) .................................................................................. 22
`
`Federal Rule of Civil Procedure 9(b) ........................................................................... 1, 5, 17, 18
`
`Federal Rules of Civil Procedure 12(b)(6) ............................................................................... 1, 5
`
`FTC, Protecting Consumer Privacy and Security, https://tinyurl.com/yc4jbpqv
`(last visited May 29, 2020) .................................................................................................. 13
`
`Kevin M. Stack, Preambles as Guidance, 84 GEO. WASH. L. REV. 1252, 1281
`(2016) ................................................................................................................................. 13
`
`New Mexico Local Rule of Civil Procedure 7.1(a) ...................................................................... 5
`
`Restatement (Second) of Torts § 652B ...................................................................................... 25
`
`iv
`
`

`

`Case 1:20-cv-00143-NF-KHR Document 28 Filed 06/04/20 Page 7 of 35
`
`
`
`MOTION TO DISMISS
`
`Defendant Google LLC by counsel and pursuant to Rules 9(b) and 12(b)(6) of the Federal
`
`Rules of Civil Procedure, hereby moves to dismiss the Attorney General’s Complaint in its
`
`entirety. Google relies upon and incorporates the arguments and legal authorities set forth in the
`
`accompanying Memorandum in Support.
`
`MEMORANDUM IN SUPPORT
`
`INTRODUCTION
`
`G Suite For Education (“GSFE”) is a free suite of tools (including Gmail, Google Drive,
`
`Google Calendar, and Google Classroom) that Google makes available to schools across the
`
`country. GSFE has become a lifeline for schools in recent months as students across the country
`
`have transitioned to remote, online learning as a result of the COVID-19 pandemic and
`
`nationwide school closures.
`
`In this case, New Mexico’s Attorney General accuses Google of breaching the Children’s
`
`Online Privacy Protection Act (“COPPA”) by relying on schools to either provide or obtain
`
`parental consent for student’s use of GSFE, rather than reaching out itself to each student’s
`
`parents for consent. But Google’s practice makes good sense: schools, unlike Google, know
`
`who each student’s parents are and, unlike Google, are typically in regular contact with parents
`
`to obtain consent for a variety of other in-school activities. Schools therefore are well-positioned
`
`to obtain parental consent. And that’s not just Google’s opinion. Recognizing the practical
`
`advantages schools have in this area, the Federal Trade Commission (“FTC”) has issued
`
`controlling guidance authorizing companies like Google to rely on schools to provide or obtain
`
`parental consent. The Attorney General’s COPPA claim thus fails as a matter of law. The
`
`Attorney General’s state law claims fare no better. The AG has failed to allege anything that
`
`
`
`1
`
`

`

`Case 1:20-cv-00143-NF-KHR Document 28 Filed 06/04/20 Page 8 of 35
`
`
`
`would constitute an unfair trade practice, much less the extreme conduct necessary to support the
`
`tort of intrusion on seclusion. The Complaint should be dismissed.
`
`BACKGROUND
`
`A.
`
`Google Provides G Suite For Education To Schools For Free
`
`GSFE is a free collection of products that Google offers to K-12 schools across the
`
`country. Compl. ¶ 20. GSFE gives teachers, students, and administrators the opportunity to
`
`integrate technology into their classrooms to complete assignments and work collaboratively.
`
`See id. ¶¶ 20-23.
`
`Schools who participate in GSFE can assign a GSFE account (i.e., a username and
`
`password) to school personnel and students (together “users”). Id. ¶ 37. With these accounts,
`
`users can access a suite of services, known as the “Core Services,” that have been adapted for
`
`use within a school or organization, including Gmail (email), Calendar, Contacts, Drive
`
`(storage), Docs (word processing), Groups (discussion groups), Sheets (spreadsheets), Slides
`
`(presentations), Chrome Sync (device synchronization), Hangouts Meet/Chat (chat and
`
`conferencing), Vault (archiving), and Classroom (class-specific discussion groups, assignment
`
`distribution, feedback). See Compl. ¶ 21; Ex. 1 (GSFE Privacy Notice) to Declaration of Peter
`
`G. Neiman (“Neiman Decl.”); see also Request for Judicial Notice (“RJN”).1
`
`Google also offers general consumer services, like YouTube, that are not part of the Core
`
`Services. See Neiman Decl. Ex. 1 at 1-2. For K-12 schools, these “Additional Services” are off
`
`by default and cannot be accessed using GSFE accounts unless a school decides to affirmatively
`
`grant access. Id.; Neiman Decl. Ex. 2 (GSFE Agreement, dated September 2018) at 2 (“If
`
`Customer does not desire to enable any of the Additional Products, Customer can enable or
`
`
`1 Certain exhibits attached to the Neiman Decl. are also addressed in Google’s
`contemporaneously filed Request for Judicial Notice (“RJN”).
`
`2
`
`

`

`Case 1:20-cv-00143-NF-KHR Document 28 Filed 06/04/20 Page 9 of 35
`
`
`
`disable them at any time through the Admin Console.”). Schools agree to obtain parental
`
`consent before allowing users under 18 access to Additional Services. Google provides schools
`
`with resources about communicating with parents, including a template to help schools provide
`
`notice and obtain consent. Neiman Decl. Ex. 3 (Notice template).
`
`B.
`
`Google’s Privacy Commitments For GSFE
`
`Google takes student privacy seriously. It publishes a Privacy Notice for GSFE that
`
`discloses what information it collects, how that information is used, and how that information is
`
`shared. See generally Neiman Decl. Ex. 1. The GSFE Privacy Notice explains that no
`
`advertising is shown in the Core Services, and that all data collected in the Core Services is used
`
`solely to provide the Core Services. Id. at 1. The GSFE Privacy Notice also tells parents how
`
`they can access their child’s personal information or request that it be deleted, as well as how
`
`they can stop further collection or use of their child’s data. Id. at 3.
`
`The GSFE Privacy Notice also addresses Additional Services. It explains that Additional
`
`Services may display advertising, and that data collected in Additional Services is treated
`
`differently from data collected in Core Services. Data collected in Additional Services may be
`
`used for a variety of purposes, including providing Google services, maintaining them,
`
`improving them, developing new Google services, and offering users more tailored content, like
`
`better search results. Id. at 1-2. However, Google commits that for GSFE users in primary and
`
`secondary (K-12) schools, Google does not “use any user personal information (or any
`
`information associated with a [GSFE] Account) to target ads, whether in Core Services or other
`
`Google services accessed while using a [GSFE] account.” Id. at 2.
`
`In addition to the privacy commitments in the GSFE Privacy Notice, the GSFE Core
`
`Services are also subject to the School Service Provider Pledge To Safeguard Student Privacy
`
`3
`
`

`

`Case 1:20-cv-00143-NF-KHR Document 28 Filed 06/04/20 Page 10 of 35
`
`
`
`(the “Student Privacy Pledge” or “Pledge”). Neiman Decl. Ex. 5 (Student Privacy Pledge).2 The
`
`Pledge is a voluntary set of best practices developed by privacy experts that applies when a
`
`signatory “is operating in its capacity as a provider of an online or mobile application, online
`
`service or website that is both designed and marketed for use in United States elementary and
`
`secondary educational institutions.” id. at 2. By its own terms, the Pledge does not apply when a
`
`signatory “is operating in its capacity as a provider of general audience software, applications,
`
`services or websites not designed and marketed for schools.” Id. Google has published and
`
`made readily available Frequently Asked Questions about GSFE that explain that the “additional
`
`services outside of the G Suite core service” are “not governed by the Student Privacy Pledge.”
`
`Neiman Decl. Ex. 4 (GSFE Privacy and Security FAQs) at 4.
`
`C.
`
`Google Relies On Schools To Provide Or Obtain Parental Consent For
`Students Using The Core And Additional Services
`
`When schools contract with Google to use GSFE, they agree to provide or obtain the
`
`requisite consent for the use of the services. Neiman Decl. Ex. 2 at 3. With regard to the Core
`
`Services, the schools themselves “consent[] as required under the Children’s Online Privacy
`
`Protection Act to the collection and use of personal information in the Services, described in the
`
`G Suite for Education Privacy Notice.” Id. at 3. With regard to the Additional Services, schools
`
`commit to obtain parental consent before authorizing the use of Additional Services for users
`
`under 18. Id. The Complaint does not allege that any New Mexico schools breached this duty
`
`by failing to obtain parental consent before authorizing access to Additional Services.
`
`
`2 The Court may consider “documents referred to in the complaint if the documents are central to
`the plaintiff’s claim and the parties do not dispute the documents’ authenticity.” Alvarado v.
`KOB-TV, LLC, 493 F.3d 1210, 1215 (10th Cir. 2007) (citation omitted). Because Plaintiff cites
`and excerpts the Pledge throughout its Complaint as central to its claims about Google’s alleged
`misrepresentations, see, e.g., Compl. ¶¶ 25-28, it is properly considered on this motion.
`
`4
`
`

`

`Case 1:20-cv-00143-NF-KHR Document 28 Filed 06/04/20 Page 11 of 35
`
`
`
`D.
`
`The Attorney General Files Suit
`
`On February 20, 2020, the Attorney General filed a Complaint against Google, claiming
`
`that Google’s provision of GSFE to New Mexico schools violated COPPA and its implementing
`
`regulations, the New Mexico Unfair Practices Act (“UPA”), and the New Mexico common-law
`
`prohibition against intrusion upon seclusion. The Attorney General filed the Complaint without
`
`first directing any questions, document requests, or subpoenas to Google. Google informed the
`
`Attorney General of its intent to file this motion to dismiss in accordance with Local Rule 7.1(a),
`
`and he stated his intention to oppose it.
`
`LEGAL STANDARD
`
`“To survive a motion to dismiss, a complaint must allege sufficient factual matter,
`
`accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556
`
`U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). In
`
`resolving a motion under Rule 12(b)(6), the court “accept[s] as true all well-pleaded factual
`
`allegations in the complaint and view[s] them in the light most favorable to the plaintiff.” Safe
`
`Streets All. v. Hickenlooper, 859 F.3d 865, 878 (10th Cir. 2017) (citation omitted). But a
`
`complaint must set forth “more than labels and conclusions, and a formulaic recitation of the
`
`elements of a cause of action will not do.” Twombly, 550 U.S. at 555.
`
`Moreover, fraud claims (such as the fraud-based unfair trade practices claim here) must
`
`meet more stringent standards. See Fed. R. Civ. P. 9(b). “In alleging fraud or mistake, a party
`
`must state with particularity the circumstances constituting fraud or mistake.” Id. Thus, a
`
`complaint must “set forth the time, place and contents of the false representation, the identity of
`
`the party making the false statements and the consequences thereof.” Koch v. Koch Indus., 203
`
`F.3d 1202, 1236 (10th Cir. 2000) (citation omitted).
`
`5
`
`

`

`Case 1:20-cv-00143-NF-KHR Document 28 Filed 06/04/20 Page 12 of 35
`
`
`
`Finally, the court may take judicial notice of facts which are a matter of public record
`
`when deciding a motion to dismiss. See Van Woudenberg v. Gibson, 211 F.3d 560, 568 (10th
`
`Cir. 2000), abrogated on other grounds by McGregor v. Gibson, 248 F.3d 946, 955 (10th Cir.
`
`2001).3
`
`ARGUMENT
`
`The Complaint should be dismissed. The central allegation—that Google’s practices for
`
`obtaining parental consent violate COPPA—fails as a matter of law because the challenged
`
`practices comply with authoritative federal guidance. To the extent the UPA claim alleges
`
`conduct separate from the COPPA claim, it fails because the UPA does not apply to services
`
`provided for free, and in any event the Complaint fails to identify any Google representation that
`
`is false or misleading or any practice that “shocks the conscience.” Finally, the Complaint’s
`
`claim for intrusion upon seclusion fails because the routine and amply disclosed data collection
`
`at issue here—tracking usage of online services—is not even close to the required “highly
`
`offensive” intrusion on privacy.
`
`I.
`
`THE COMPLAINT FAILS TO PLEAD A COPPA VIOLATION
`
`Congress entrusted the development and implementation of COPPA’s requirements to the
`
`expertise of the FTC. COPPA does not by itself forbid or prescribe anything. Rather, COPPA
`
`authorizes the FTC to adopt regulations requiring covered operators of online services to provide
`
`notice to, and obtain consent from, parents before collecting data from children 13 and under.
`
`See 15 U.S.C. § 6502(b)(1)(A). COPPA makes it unlawful to breach those regulations. Id. §
`
`6502(a)(1).
`
`
`3 The judicial notice standard and its application to certain documents relied upon in this
`Memorandum is addressed in Google’s contemporaneously filed Request for Judicial Notice.
`
`6
`
`

`

`Case 1:20-cv-00143-NF-KHR Document 28 Filed 06/04/20 Page 13 of 35
`
`
`
`The FTC adopted regulations (the “COPPA Rule”) on parental consent in 1999. See 16
`
`C.F.R. § 312.3; Children’s Online Privacy Protection Rule, 64 Fed. Reg. 59,888 (Nov. 3, 1999).
`
`To help industry conform its conduct to the COPPA Rule, the FTC has published interpretive
`
`guidance on the COPPA Rule.
`
`The Complaint alleges that Google violates the FTC’s COPPA Rule. But the practices at
`
`issue squarely conform to the FTC’s guidance. Following the FTC’s guidance cannot violate the
`
`COPPA Rule, which the FTC itself wrote. The Attorney General’s COPPA claims should be
`
`dismissed.
`
`A.
`
`COPPA Requires “Reasonable Efforts” To Obtain Consent
`
`The COPPA Rule requires covered operators to obtain “verifiable” parental consent and
`
`defines “[o]btaining verifiable consent” to mean “making any reasonable effort” to provide
`
`notice and obtain consent. 16 C.F.R. § 312.2 (emphasis added); see also id. § 312.5 (“Any
`
`method to obtain verifiable parental consent must be reasonably calculated, in light of available
`
`technology, to ensure that the person providing consent is the child’s parent.”). These word
`
`choices reflect a broad, flexible standard. Compliance does not necessarily require obtaining
`
`consent in every case, but instead “making” an appropriate “effort” to do so. That effort can be
`
`“any reasonable” one.
`
`B.
`
`FTC Guidance: Operators May Rely On Schools To Provide Or Obtain
`Consent
`
`Interpreting its “reasonable efforts” standard, the FTC has repeatedly affirmed that
`
`operators may rely on schools to provide or obtain consent. The Statement of Basis and Purpose
`
`for the COPPA Rule (“Preamble”) squarely states: “the Rule does not preclude schools from
`
`acting as intermediaries between operators and parents in the notice and consent process, or from
`
`serving as the parents’ agent in the process.” COPPA Rule, 64 Fed. Reg. at 59,903; id. at
`
`7
`
`

`

`Case 1:20-cv-00143-NF-KHR Document 28 Filed 06/04/20 Page 14 of 35
`
`
`
`59,909. Additionally, the FTC made clear that “where an operator is authorized by a school to
`
`collect personal information from children, after providing notice to the school …, the operator
`
`can presume that the school’s authorization is based on the school’s having obtained the
`
`parent’s consent.” Id. at 59,903 (emphasis added). The FTC thus concluded that “the Rule
`
`should not hinder businesses that provide services to schools.” Id. at 59,909.
`
`The FTC reaffirmed this position in subsequent guidance that explained when schools
`
`may act as “agents” and provide the actual consent, as opposed to an “intermediary” obtaining
`
`the consent from parents. The FTC elaborated:
`
`Many school districts contract with third-party website operators to
`offer online programs solely for the benefit of their students and
`for the school systems. … In these cases, the schools may act as
`the parent’s agent and can consent to the collection of kids’
`information on the parent’s behalf.
`
`Neiman Decl. Ex. 6 (Fed. Trade Comm’n, Complying with COPPA: Frequently Asked
`
`Questions, Mar. 20, 2015) at 2 (emphasis added). In this “educational context,” the “operator
`
`collects personal information from students for the use and benefit of the school, and for no other
`
`commercial purpose.” Id. Outside of this purely educational context—if collected information
`
`will be used for “commercial purposes in addition to the provision of services to the school”—
`
`parental consent is still necessary. Id. at 3. There, schools may “act[] as intermediaries between
`
`operators and parents in the notice and consent process.” COPPA Rule, 64 Fed. Reg. at 59,903.
`
`
`
`More recent FTC publications continue this approach. In a July 2019 request for public
`
`comment on its implementation of the COPPA Rule, the FTC quoted the language from the
`
`Preamble above with approval, restating that “the Rule ‘does not preclude schools from acting as
`
`intermediaries between operators and schools in the notice and consent process, or from serving
`
`as the parents’ agent in the process.’” Request for Public Comment on the Federal Trade
`
`Commission’s Implementation of the Children’s Online Privacy Protection Rule, 84 Fed. Reg.
`
`8
`
`

`

`Case 1:20-cv-00143-NF-KHR Document 28 Filed 06/04/20 Page 15 of 35
`
`
`
`35,842, 35,845 (July 25, 2019) (quoting COPPA Rule, 64 Fed. Reg. at 59,903). Indeed, the FTC
`
`sought comment on whether it should go further and create a “specific exception to parental
`
`consent for the use of education technology used in the schools.” Id. Still more recently, in
`
`guidance responding to the COVID-19 pandemic, the FTC “[s]tress[ed] that COPPA is not a
`
`barrier to schools providing robust remote learning opportunities through ed tech services.”
`
`Neiman Decl. Ex. 7 (L. Schifferle, COPPA Guidance for Ed Tech Companies and Schools
`
`during the Coronavirus, Fed. Trade Comm’n, Apr. 9, 2020) at 1. It also made clear that “schools
`
`can consent on behalf of parents to the collection of student personal information” if “such
`
`information is used for a school-authorized educational purpose and for no other commercial
`
`purpose.” Id.
`
`The FTC’s guidance is sensible. Schools already obtain parental consent for a wide
`
`range of things, ranging from field trips to use of student images. See, e.g., COPPA Rule, 64
`
`Fed. Reg. at 59,903 (“[M]any schools already seek parental consent for in-school Internet access
`
`at the beginning of the school year.”). The Attorney General suggests it would be preferable for
`
`operators of online services to obtain consent directly from parents, using “an online form, a toll-
`
`free number, [or] a video-conference call.” Compl. ¶ 54. But these methods have their
`
`challenges—such as ensuring that the person providing the consent is in fact the custodial parent.
`
`In contrast, schools have close, long-term relationships with parents, forged through parent-
`
`teacher conferences, PTA meetings, and countless other interactions, and are therefore well-
`
`positioned to obtain truly verifiable consent.
`
`Experts also recognize schools’ advantages in obtaining consent. For example, at a 2010
`
`FTC roundtable, agency staff asked a panel about mechanisms for obtaining consent. One
`
`privacy advocate responded:
`
`9
`
`

`

`Case 1:20-cv-00143-NF-KHR Document 28 Filed 06/04/20 Page 16 of 35
`
`
`
`The real problem here has always been … you never know if you
`have got a parent, and not only if you have got a parent, you don't
`know if you have the custodial parent who has the legal rights over
`this kid, and the only people who know that, if the kids are in
`school, are schools. … Unless you work with the schools, you’re
`never going to get the stuff, because nobody else has this
`information.
`
`Neiman Decl. Ex. 8 (Fed. Trade Comm’n, COPPA Rule Review Roundtables, June 2, 2010) at
`
`6-7 (numbered 259-260).
`
`C.
`
`Google Follows The FTC’s Guidance
`
`The approach Google uses to obtain consent for GSFE—with respect to Core Services
`
`and Additional Services—follows the FTC guidance just described. First, Core Services are a
`
`set of Google services that have been adapted for use within a school. The GSFE Privacy Notice
`
`states: “User personal information collected in the Core Services is used only to provide the Core
`
`Services.” Neiman Decl. Ex. 1 at 1. Information collected in the Core Services is thus “used for
`
`a school-authorized educational purpose and for no other