`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 1 of 24
`
`IN THE UNITED STATES DISTRICT COURT
`
`FOR THE DISTRICT OF NEW MEXICO
`
`STATE OF NEW MEXICO, ex rel.,
`HECTOR BALDERAS, Attorney General for
`the State of New Mexico,
`
`Case No.
`
`Plaintifl,
`
`V.
`
`GOOGLE LLC, a Delaware limited liability
`company,
`
`
`
`Defendant.
`
`COMPLAINT
`
`Plaintiff, State of New Mexico, by and through Hector Balderas, Attorney General for the
`
`State of New Mexico, brings this Complaint against Defendant Google LLC, and alleges as
`
`follows:
`
`NATURE OF THE ACTION
`
`1.
`
`Throughout the country, school districts are racing to bring technology into
`
`classrooms and Google has quickly become a dominant player in this space. In just a few years,
`
`Google has infiltrated more than half the nation’s primary- and secondary-schools by offering a
`
`“free” web-based service called G Suite for Education (“Google Education”), which gives
`
`students access to Google’s Gmail, Calendar, Drive, Docs, and other applications.
`
`2.
`
`Though Google Education has been marketed to schools, parents, and students as
`
`a free and purely educational tool, the use of Google Education and other Google products comes
`
`at a very real cost that Google purposefully obscures.
`
`3.
`
`Google Education is now used by more than 80 million educators and students in
`
`the United States—including more than 25 million who use Google-powered laptops, called
`
`
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 2 of 24
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 2 of 24
`
`“Chromebooks,” in schools—essentially giving Google sole and exclusive access to millions of
`
`students’ digital lives and their personal data. More valuable still, Google has captured
`
`generations of future customers who are trained to use Google’s platform as early as
`
`kindergarten.
`
`4.
`
`To drive adoption in more schools—and to alleviate legitimate concerns about its
`
`history of privacy abuses—Google has been making public statements and promises that are
`
`designed to convince parents, teachers, and school officials that Google takes student privacy
`
`seriously and that it only collects education-related data from students using its platform. Google
`
`has also publicly promised never to mine student data for its own commercial purposes.
`
`5.
`
`Unfortunately, Google has broken those promises and deliberately deceived
`
`parents and teachers about Google’s commitment to children’s privacy. In direct contradiction of
`
`its numerous assurances that it would protect children’s privacy, Google has used Google
`
`Education to spy on New Mexico children and their families by collecting troves of their
`
`personal information, including:
`
`their physical locations;
`0
`0 websites they visit;
`0
`every search term they use in Google’s search engine (and the results
`they click on);
`
`o
`
`0
`
`0
`0
`I
`
`the videos they watch on YouTube;
`
`personal contact lists;
`
`voice recordings;
`saved passwords; and
`other behavioral information.
`
`6.
`
`And until April 2014, Google also mined students‘ email accounts, extracted
`
`information about them, and used that data—along with the personal information described
`
`above—for advertising purposes.
`
`7.
`
`These privacy concems—and the effects of Google’s misrepresentations and
`
`
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 3 of 24
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 3 of 24
`
`exploitation of information asymmetry between itself, on one hand, and parents and teachers, on
`
`the other—cannot be overstated. While Google publicly positions Google Education as a benign
`
`tool that is an answer to resource-deprived schools nationwide, it secretly uses Google Education
`
`as a means to monitor children while they browse the Internet, including in their private homes,
`
`on their private computers and phones, and on their private networks. This is particularly
`
`concerning considering that teenagers turn to the Internet to search for issues they otherwise
`
`would be too embarrassed or afraid to ask fiiends, parents, or relatives, such as general health
`
`information, sex education, diet advice, how to deal with bullying, anxiety and depression,
`
`puberty, and more.1 In fact, as many as four out of five teenagers turn to the Internet to learn
`
`about health information, such as anxiety, ADI-ID, and sexually transmitted diseases.2
`
`8.
`
`Google is aware of how problematic it is to mine children‘s data in a commercial
`
`context. Outside of its Google Education platform, Google forbids children under the age of 13
`
`in the United States from having their own Google accounts.3 But Google attempts to get around
`
`this by using Google Education to secretly gain access to troves of information about New
`
`Mexican children that it would not otherwise have.
`
`9.
`
`The data Google accumulates is then stored in profiles attributed to each student
`
`and used by Google for its own commercial purposes—as Google itself admitted in response to a
`
`Teens, Health, and Ttechnology: A National Survey, Center on Media and Human
`Development, School of Communication, Northwestern University (June 2015),
`https:h’cmhdnorthwestemedu/wp-
`content/uploads“201 5305ir] 886_1_SOC_ConfReport_TeensI-{ealthTech_05l 1 15.pdf.
`
`Id.
`
`Age Requirements on Google Accounts, Google FAQS,
`
`
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 4 of 24
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 4 of 24
`
`Congressional inquiry into the privacy practices associated with Google Education.4
`
`10.
`
`Beyond breaking its own promises to respect and safeguard children’s privacy
`
`and exploiting the vulnerability of the parents, educators, and children of New Mexico, Google
`
`brazenly violates federal law prohibiting this very conduct. In 1998, Congress enacted the
`
`Children’s Online Privacy Protection Act, 15 U.S.C. §§ 6501, et seq. (“COPPA”), in response to
`
`a growing concern over the collection of children’s data on the Internet. In passing COPPA,
`
`Congress specifically sought to increase parental involvement in children’s online activities,
`
`ensure children’s safety during their participation in online activities, and most importantly,
`
`protect children’s personal information. Ultimately, Congress enacted COPPA with the specific
`
`goal of placing parents in control over what information is collected from their young children
`
`online.
`
`11.
`
`To that end, COPPA requires—in relevant part—that websites and online services
`
`fully and clearly disclose their data collection, use, and disclosure practices, and obtain
`
`“verifiable parental consent” before collecting, using, or disclosing personal information from
`
`children under 13. Further, COPPA requires websites and online services to permit parents to
`
`review all personal information they collect and maintain from children under 13, and to allow
`
`parents to refuse further use or maintenance of those data. Similarly, websites and online services
`
`may not condition a child’s use of a site or service on the collection of more personal
`
`information than is reasonably necessary, and must take reasonable steps to keep confidential
`
`and safe any personal information in its possession.
`
`Susan Molinari, Vice President, Public Policy and Govemment Relations, Americas,
`Google LLC February 12, 2016 Letter to Senator Al Franken, available at
`https://www.ef£org/filesl2016/12/14/160216googleresponse.pdf(“Google may use the data from
`additional services outside of the GAFE core services for the purposes described in our Privacy
`
`
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 5 of 24
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 5 of 24
`
`12.
`
`Google violates its obligations mandated by COPPA. Not only does it use its
`
`Google Education platform to collect children’s personal and sensitive information for its own
`
`commercial purpose without first informing parents, let alone obtaining “verifiable parental
`
`consent,” it also (1) fails to provide parents the ability to meaningfully review or limit the data
`
`collected and used, and (2) conditions use of its product on expansive (and unnecessary)
`
`collection and use of personal information.
`
`13.
`
`These practices do not simply violate federal law, nor do they merely impact
`
`children under the age of 13. Covertly monitoring children of all ages, despite unambiguous
`
`representations to the contrary, violates longstanding rights rooted in the common law, as well as
`
`New Mexico’s statutory prohibitions on unfair, deceptive, and unconscionable business
`
`practices, codified in the New Mexico Unfair Practices Act, NM. Stat. Ann. §§ 57-12-1, et seq.
`
`(“UPA”). And, although not protected by COPPA, educators are likewise victims of Google’s
`
`practices as—in addition to its deceptive promises—Google similarly monitors teachers utilizing
`
`the Google Education platform when they browse the Internet, including in their private homes,
`
`on their private computers and phones, and on their private networks.
`
`14.
`
`Accordingly, the State of New Mexico, by and through Hector Balderas, Attorney
`
`General for the State of New Mexico, seeks all appropriate injunctive relief to address, remedy,
`
`and prevent harm to New Mexico residents resulting from Google’s misconduct, as well as civil
`
`penalties, fees, costs, and any other relief this Court deems proper.
`
`PARTIES
`
`15.
`
`This action is brought for and on behalf of the sovereign State of New Mexico, by
`
`and through its duly elected Attorney General, Hector Balderas. The Attorney General, as chief
`
`legal officer of the State, is statutorily authorized to initiate and prosecute any and all suits
`
`
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 6 of 24
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 6 of 24
`
`deemed necessary for the protection of the interests and rights of the State. See NM. Stat. Ann. §
`
`8-5-2 (duties of the Attorney General). Specifically, the Attorney General is authorized to initiate
`
`and prosecute suits to penalize conduct that constitutes an unfair or deceptive trade practice. See
`
`NM. Stat. Ann. § 57-12-15 (enforcement of UPA). The Attorney General is further empowered
`
`to enforce COPPA via an action filed in federal court. See 15 U.S.C. § 6504 (civil actions by
`
`state attorneys general). The Attorney General is also charged with the duty of guardian of the
`
`public interest, which includes protecting the privacy interests of New Mexico’s citizens and the
`
`welfare of New Mexico's children online. The State brings this action in its parens patriae
`
`and/0r sovereign capacity.
`
`16.
`
`Defendant Google LLC is a limited liability company organized and existing
`
`under the laws of the State of Delaware, with its headquarters and principal place of business
`
`located at 1600 Amphitheatre Parkway, Mountain View, California 94043.
`
`JURISDICTION AND VENUE
`
`17.
`
`This Court has subject matter jurisdiction over this action pursuant to 28 U.S.C.
`
`§§ 1331, 1337(a), and 1367.
`
`18.
`
`This Court has personal jurisdiction over Google pursuant to NM. Stat. Ann. §
`
`38-1-16 because Google engages in business transactions within the State of New Mexico,
`
`purposefully directs and/or directed its actions toward the State of New Mexico, collects and
`
`uses personal data from students, including those under the age of 13, in New Mexico, and/or has
`
`the requisite minimum contacts within the State of New Mexico needed to permit this Court to
`
`exercise jurisdiction. Further, Google has registered to do business within New Mexico in
`
`accordance with the New Mexico Business Corporation Act, N.M. Stat. Arm. §§ 53-17-1 et seq.,
`
`which amounts to consent to personal jurisdiction under relevant New Mexico law. See
`
`
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 7 of 24
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 7 of 24
`
`Rodriguez v. Ford Motor Co., --- P.3d ---, 2018 WL 6716038, *11-12 (N.M. Ct. App. Dec. 20,
`
`2018) (finding foreign corporation consented to jurisdiction in New Mexico by registering under
`
`N.M. Stat. Ann. 53-17-11); see also Schmidt v. Navistar, Inc, 2019 WL 1024285, *5-6 (D.N.M.
`
`March 4, 2019) (Slip Op.) (agreeing with Rodriguez .
`
`19.
`
`Venue is proper in this district pursuant to 28 U.S.C. § 1391 because a substantial
`
`part of the conduct giving rise to the State’s claims occurred in this District, and because Google
`
`transacts business in this District.
`
`FACTUAL BACKGROUND
`
`An Overview of G Suite for Education.
`
`20.
`
`Google’s G Suite for Education platform (formerly referred to as Google Apps for
`
`Education) is a web-based service marketed by Google as a free service to educational
`
`institutions, including K-12 schools.
`
`21.
`
`The G Suite for Education core services are at the heart of Google’s educational
`
`offering to schools and include Gmail (email), Calendar, Drive (cloud storage), Docs (word
`
`processing software), Sheets (spreadsheet software), Slides (presentation software), and more.
`
`22.
`
`Google also provides Google-powered laptops to schools, called Chromebooks,
`
`which are low-cost laptop computers running on Google’s Chrome OS operating system and
`
`include the Chrome web browser.
`
`23.
`
`Over 80 million educators and students now use G Suite for Education and more
`
`than 25 million use Chromebooks in schools, including within New Mexico?
`
`All types of Chromebooks for all types of learners, Google, https:I/blog.google/outreach-
`
`
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 8 of 24
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 8 of 24
`
`To Drive Adoption Among Schools, Google Promises to Protect Student Privacy and
`Signed on to a Pledge Designed to Convince Parents, Teachers, and School Districts
`That There Are No Privacy Concerns With Google Education.
`
`24.
`
`Google recognizes that “trust is earned through protecting teacher and student
`
`privacy”" and has made a number of public promises designed to convince parents, teachers,
`
`school districts, and students that it will protect the privacy of students who use Google
`
`Education.
`
`25.
`
`To that end, in order to reaffirm the commitments it has made over the years to
`
`safeguard and protect student privacy, including to school districts, Google signed the K—12
`
`School Service Provider Pledge to Safeguard Student Privacy (the “Student Privacy Pledge") in
`
`or around January 2015.
`
`26.
`
`The Student Privacy Pledge is a set of principles and promises developed by the
`
`Future of Privacy Forum and The Software & Information Industry Association regarding the
`
`collection, use, and maintenance of student data]
`
`27.
`
`Though not an original signatory, and hesitant to sign on3 (only succumbing after
`
`public outrage), Googled eventually signed the Student Privacy Pledge and affirmatively and
`
`expressly committed to:
`
`(a) Not collect, maintain, use or share student personal information beyond that
`needed for authorized educational/school purposes, or as authorized by the
`parent/student;
`
`Privacy and Security, Google LLC,
`http://servicesgoogle.com/fh/files/misc/gsuite_for_education_privacy__security.pdf (last visited
`February 20, 2020).
`
`Student Privacy Pledge Signatories, Future of Privacy Forum and The Software &
`Information Industry Association, https://studentprivacypledge.org/signatories/ (last visited
`February 20, 2020).
`
`Google Changes Course, Signs Student Data Privacy Pledge, Wall Street Journal,
`https://blogs.wsj.com/digits/ZOl5/0ll20/google-changes-course—signs-student-data-privacy—
`
`
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 9 of 24
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 9 of 24
`
`an
`through
`collected
`information
`student
`disclose
`or
`use
`(13) Not
`educational/school service (whether personal information or otherwise) for
`behavioral targeting of advertisements to students;
`
`(c) Not build a personal profile of a student other than for supporting authorized
`educational/school purposes or as authorized by the parent/student;
`
`(d) Not knowingly retain student personal information beyond the time period
`required to support
`the authorized educational/school purposes, or as
`authorized by the parent/student;
`
`(e) Collect, use, share, and retain student personal information only for purposes
`for which Google was authorized by the educational
`institution/agency,
`teacher, or the parent/student; and
`
`(f) Disclose clearly in contracts or privacy policies, including in a manner easy
`for parents to understand, what types of student personal information Google
`collects, if any, and the purposes for which the information Google maintains
`is used or shared with third parties.
`
`28.
`
`Google publicly promoted its decision to sign the Student Privacy Pledge and
`
`received positive coverage of its commitment.
`
`29.
`
`As described in Section IV below, in direct contradiction to the express
`
`assurances and promises made through the Student Privacy Pledge, Google collects and records
`
`each student‘s web browsing activities, the videos they watch on YouTube, and other
`
`information not generated for or related to educational purposes whatsoever.
`
`III.
`
`Google Likewise Deceptively Markets Its Google Education Platform to Educators
`in Order to Increase Enrollment.
`
`30.
`
`Beyond its privacy pledges, Google takes additional steps to encourage educators
`
`to adopt Google Education in their classrooms.
`
`31.
`
`In its marketing materials, Google promotes the myriad benefits of implementing
`
`Google Education in the classroom. (See Figures 1—3, showing screenshots of Google’s
`
`webpages promoting some of the many resources available to teachers who implement Google
`
`
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 10 of 24
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 10 of 24
`
`Education in their classrooms.)
`
`Spark learning with (3 Suite for Education
`
`A suite of tools designed to empower educators and students as they team and innovate together. Sign up your
`institution for G Suite for Education.
`
`To help expand
`learning for everyone
`
`Working to support education through our products,
`programs, and philanthropy.
`
`Culture
`
`Teaching resources to empower learning
`in the classroom
`
`Discover a broad selection at apps, activities. lesson plans. digital literacy
`tools, and games to advance leamlng in the classroom including virtual
`
`field trips, lessons on coding. and more.
`Explore teaching resources
`
`éa
`
`CreativityTools
`
`Y
`
`Language. Arts E.
`
`Q
`
`Dlgl tal Uteracy
`
`32.
`
`Google likewise provides various training tools and manuals designed to convince
`
`teachers to implement Google Education into their classrooms.
`
`33. What is conspicuously absent from these marketing materials is any adequate
`
`
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 11 of 24
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 11 of 24
`
`disclosure that, by introducing Google Education to the classroom, Google will track and
`
`monitor students' web browsing activities and other information not generated for or related to
`
`educational purposes whatsoever.
`
`34.
`
`In fact, Google actively misrepresents its privacy—violative conduct and provides
`
`educators with a false sense of security about its data collection practices. For example, on one of
`
`its promotional webpages, Google notes that its core services “do not contain advertising nor do
`
`they use information in those services for advertising purposes.” Google also claims that all of its
`
`“G Suite for Education core services Straport COPPA and FERPA compliance.” (See Figure 4
`
`below, showing a screenshot from Google’s Google Education marketing website. Emphasis
`
`added.)
`
`Transform how your school works with
`our suite of free, secure tools
`
`Education core services support COPPA and FERPA compliance
`
`G Suite core services do not contain advertising nor do they use
`
`information In those services for advertising purposes Plus, all G Suite for
`
`35.
`
`These representations are misleading. First, advertising is but one of an entire
`
`constellation of commercial purposes Google is prohibited from using student information for
`
`under COPPA, and a purported lack of advertising does not in any way mean COPPA
`
`compliance. Second, Google is implying that its products are COPPA/FERPA compliant, but in
`
`reality Google is saying that its products merely “support” COPPA/FERPA compliance. It is
`
`unclear what “supporting compliance" means in this context. Both of these statements are
`
`misleading because in reality, once Google Education is introduced into the classroom, Google
`
`uses it to vociferously collect children’s (and older students’ and educators’) personal and
`
`
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 12 of 24
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 12 of 24
`
`sensitive information for Google’s own commercial purpose without first informing parents, let
`
`alone obtaining “verifiable parental consent” as required by COPPA.
`
`Google Collects Virtually Everything That Students—Including Those Under 13—
`Do Online Through Google Education for its Own Commercial Purposes.
`
`36.
`
`Today, more than half the students in the country use Google Education.
`
`37.
`
`In schools that use Google Education, students are automatically assigned a
`
`unique usemame and password that identifies the student with a particular Google Education
`
`account.
`
`38.
`
`Students are typically given their Google Education credentials the first day of
`
`classes and are immediately instructed-in the classroom—to log into their Google accounts on
`
`their private computers, mobile devices, and/or school-issued Chromebooks in order to use
`
`Google Education.
`
`39. When students log into a school issued or personal Chromebook, Google will tum
`
`on the Chrome Sync function by default. This, in turn, automatically starts uploading students’
`
`Chrome usage data—such as bookmarks, web searches, passwords, and online browsing
`
`habits—to Google’s servers. Google acknowledges in a help page that it can read this data but
`
`states: “With a passphrase, you can use Google’s cloud to store and sync your Chrome data
`
`without letting Google read it.”9 Unfortunately, the option to set such a passphrase to stop
`
`Google from reading private student data is off by default, and buried in settings that parents
`
`likely never see.
`
`40.
`
`Students also are often encouraged to logon to their Google Education accounts
`
`Google Chrome Help, Google LLC,
`https:a’fsupport.google.com/chromelanswert1 65 l 39?co=GENIE.P1atform%3 DDesktop&hl=en
`
`
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 13 of 24
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 13 of 24
`
`on the Chrome browser of their family’s personal computers. When doing so, an option exists to
`
`turn on Google Sync and link the family’s existing Chrome usage data to the student's Google
`
`Education account—which associates even more personal data to the student’s Google profile.
`
`41.
`
`Additionally, once students are signed into their Google Education accounts,
`
`Google uses cookies to identify students and begins collecting essentially everything they do
`
`online, including the names and URLs of websites searched and visited, and what videos they
`
`watch on YouTube.'°
`
`42.
`
`Google routinely and automatically collects this highly sensitive data regardless
`
`of whether students are using a school issued device or are logged into their Google Education
`
`account through a personal device.”
`
`43.
`
`Even if students affinnatively log out of their accounts through a settings page,
`
`Google permanently ties this data to their profiles.
`
`44.
`
`In its marketing materials, Google even boasts that kids as young as kindergarten-
`
`age in New Mexico now have Google email accounts and that all students will have access to
`
`their accounts for years after they graduate. (See Figure 5, showing a screenshot of Google
`
`Stories of Impact.)
`
`This should be no surprise to Google. On September 4, 2019, the Federal Trade
`Commission, together with the New York Attorney General’s Office, announced a $170 million
`settlement with Google’s video sharing subsidiary—YouTube—over allegations that it collected
`children’s personal information without their parents’ consent in violation of COPPA.
`
`Until recently, Google also collected, on information and belief, children’s precise
`physical locations, mobile device contact lists (when signed into their mobile devices), and audio
`
`
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 14 of 24
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 14 of 24
`
`E OUTCOMES: Saving Money and Cultivating Relationships
`
`Cost Savings
`
`Sometimes It’s the Little Things
`
`Pr or to 60an Google, we put significant time and money into file
`storage. software licensing. email sewers, and local virus scanning
`Now we enjoy all the features and benefits of G Suite for Education
`for FREE
`
`We are 7+ years into our Google adoption, and it still costs 30 per user! Gallo-pi-
`
`__
`
`_
`
`'cluding email
`
`_ -
`wrth sop retreated spam and antiwrus contro r
`Web-based office suite comparable to competing products
`Unlm ted file storage in the Google Drive cloud - and it’s all
`incrementai ly backed up!
`Google Vault allows us to maintain extremely reliable and rapid
`backups and monitoring of email and documents for staff and
`students Without the fear of lost data or legal failures
`
`I
`
`MESD is able to provide an additional perk that
`wouldn't be possible if it wasn't free'
`_
`__
`_ q
`cess
`Graduating students have
`to 91¢ apcoupts for year—safter they
`graduate. This helps them maintain
`contact with teachers and community
`members important to them as they
`move into the workplace or further
`education.
`
`lFig. 5.)
`
`45.
`
`By tracking and cataloguing everything children do online and on their digital
`
`devices, Google has unprecedented visibility and access into the online lives of children across
`
`the country and specifically, in the State of New Mexico.
`
`46.
`
`Ultimately, though it is marketed to schools as a purely educational tool, Google
`
`Education provides far more benefit to Google than it does to students or schools. Google
`
`recognizes that by giving children fi‘ee access to its online tools and habituating them at a young
`
`age, Google obtains something much more valuable: generations of fiiture customers.
`
`47.
`
`Google also uses the data it accumulates through Google Education for its own
`
`commercial purposes—as Google itself admitted in response to a Congressional inquiry into the
`
`privacy practices associated with Google Education.‘
`
`2
`
`48.
`
`Google likewise tracks and documents the online activity of teachers using
`
`Susan Molinari, Vice President, Public Policy and Government Relations, Americas,
`Google LLC February 12, 2016 Letter to Senator Al Franken, available at
`https://www.ef£org/files/2016/12/14/160216googleresponse.pdf (“Google may use the data from
`additional services outside of the GAFE core services for the purposes described in our Privacy
`
`
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 15 of 24
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 15 of 24
`
`Google Education through a Chrome browser or Chromebook without their prior knowledge or
`
`consent.
`
`Google’s Collection of Non-Educational Data from Students Violates its Own
`Privacy Promises as Well as Federal Law.
`
`49.
`
`Despite its numerous assurances, Google has been using Google Education to spy
`
`on New Mexico children, teachers, and their families by collecting troves of their personal
`
`information—including by monitoring kids while they browse the Internet in their private
`
`homes, on their private computers and phones, and on their private networks—and using that
`
`data for its own commercial benefit.
`
`50.
`
`In addition to breaking its own promises, including those identified in Sections 11—
`
`111, Google does not provide adequate notice to the parents or the teachers of the tracked children
`
`about these data collection practices and, worst of all, does not obtain any form of verifiable
`
`parental consent before doing so.
`
`51.
`
`Beyond thwarting parental autonomy by unlawfully collecting children‘s
`
`information in the first place, Google also robs parents of any control over the subsequent use of
`
`collected data. Further, it does not allow children to use the Google Education platform in a
`
`manner that allows children to avoid gratuitous collection of their personal information. Thus,
`
`Google uses its ability to provide schools—and thereby children, parents, and educators—with
`
`much needed resources in a deeply exploitative manner, forcing children to use products and
`
`services that will secretly (and unlawfully) monitor them, in order to receive an education.
`
`52.
`
`Google—and not school districts—has an obligation to provide notice to parents
`
`and obtain their consent. After all, schools that partner with Google are not in a position to
`
`properly inform parents of the types of information that Google will be collecting from students,
`
`
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 16 of 24
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 16 of 24
`
`of the extent of its practices), and are likewise victims of Google’s practices themselves.
`
`53.
`
`Google is required to inform parents of its data collection practices. It is also
`
`required to direct this notice at the parents of children whose data it seeks to collect and to obtain
`
`verifiable parental consent.
`
`54.
`
`Google did not obtain verifiable parental consent via an online form, a toll-free
`
`number, a video-conference call—or by any other method allowed under COPPA or recognized
`
`under any other law—enabling a parent to accept or reject Google’s data collection practices.
`
`55.
`
`Furthermore, the pop-up notifications that Google displayed to students when first
`
`accessing their Google Education accounts are not intended nor available for review by the
`
`child’s parent. The notifications appear when the child uses his or her Chromebook computer or
`
`logs on to a Chrome browser in order to complete school work.
`
`56.
`
`Even if such notifications fully informed a child of Google‘s collection practices
`
`(they do not), such notice is insufficient under COPPA because children under 13 do not have
`
`the capacity to consent to Google’s data collection practices.
`
`5?.
`
`The consequences of Google’s tracking cannot be overstated: children are being
`
`monitored by one of the largest data mining companies in the world, at school, at home, on
`
`mobile devices, without their knowledge and without the permission of their parents. Vast
`
`amounts of personal data generated by the student while online will be captured by Google and
`
`added to the student’s profile. While purporting to offer only educational services, Google
`
`instead has stripped children and parents of autonomy and control of their most sensitive
`
`personal information, forcing children to acquiesce to constant monitoring, in perpetuity, in
`
`exchange for their education.
`
`
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 17 of 24
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 17 of 24
`
`FIRST CAUSE OF ACTION
`
`Violations of the Children’s Online Privacy Protection Act
`15 U.S.C. §§ 6501, et seq.
`
`58.
`
`Plaintiff State of New Mexico incorporates the foregoing allegations as if fully set
`
`forth herein.
`
`59.
`
`The Attorney General of the State of New Mexico is authorized to bring a civil
`
`action in the name of the State, against Google, to enforce regulations prescribed by COPPA
`
`and to secure remedies for violations of such regulations. See 15 U.S.C. § 6504.
`
`60.
`
`Under COPPA, an operator of a website or online service that collects personal
`
`information from children must provide notice to the child’s parent about its data collection
`
`practices and obtain verifiable parental consent prior to any collection or use of personal
`
`information from children. A violation of this regulation is deemed unlawful. 16 CPR. § 312.3.
`
`6].
`
`COPPA defines a “child" as “an individual under the age of 13.” I6 CPI}. §
`
`312.2.
`
`62.
`
`Google is required to comply with the requirements set out in COPPA because it
`
`has specifically developed the Google Education platform for use by students in grades K—12.
`
`Furthermore, Google has actual knowledge that children under the age of 13 use its apps and
`
`services.
`
`63.
`
`Google is an “operator” as contemplated by 16 C.F.R. § 312.2 because it operates
`
`a “Web site located on the Internet or an online service and who collects or maintains personal
`
`information from or about the users of or visitors to such Web site or online service .
`
`.
`
`. where
`
`such Web site or online service is operated for commercial purposes involving commerce among
`
`the several States or with l or more foreign nations.” I