throbber
Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 1 of 24
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 1 of 24
`
`IN THE UNITED STATES DISTRICT COURT
`
`FOR THE DISTRICT OF NEW MEXICO
`
`STATE OF NEW MEXICO, ex rel.,
`HECTOR BALDERAS, Attorney General for
`the State of New Mexico,
`
`Case No.
`
`Plaintifl,
`
`V.
`
`GOOGLE LLC, a Delaware limited liability
`company,
`
`
`
`Defendant.
`
`COMPLAINT
`
`Plaintiff, State of New Mexico, by and through Hector Balderas, Attorney General for the
`
`State of New Mexico, brings this Complaint against Defendant Google LLC, and alleges as
`
`follows:
`
`NATURE OF THE ACTION
`
`1.
`
`Throughout the country, school districts are racing to bring technology into
`
`classrooms and Google has quickly become a dominant player in this space. In just a few years,
`
`Google has infiltrated more than half the nation’s primary- and secondary-schools by offering a
`
`“free” web-based service called G Suite for Education (“Google Education”), which gives
`
`students access to Google’s Gmail, Calendar, Drive, Docs, and other applications.
`
`2.
`
`Though Google Education has been marketed to schools, parents, and students as
`
`a free and purely educational tool, the use of Google Education and other Google products comes
`
`at a very real cost that Google purposefully obscures.
`
`3.
`
`Google Education is now used by more than 80 million educators and students in
`
`the United States—including more than 25 million who use Google-powered laptops, called
`
`

`

`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 2 of 24
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 2 of 24
`
`“Chromebooks,” in schools—essentially giving Google sole and exclusive access to millions of
`
`students’ digital lives and their personal data. More valuable still, Google has captured
`
`generations of future customers who are trained to use Google’s platform as early as
`
`kindergarten.
`
`4.
`
`To drive adoption in more schools—and to alleviate legitimate concerns about its
`
`history of privacy abuses—Google has been making public statements and promises that are
`
`designed to convince parents, teachers, and school officials that Google takes student privacy
`
`seriously and that it only collects education-related data from students using its platform. Google
`
`has also publicly promised never to mine student data for its own commercial purposes.
`
`5.
`
`Unfortunately, Google has broken those promises and deliberately deceived
`
`parents and teachers about Google’s commitment to children’s privacy. In direct contradiction of
`
`its numerous assurances that it would protect children’s privacy, Google has used Google
`
`Education to spy on New Mexico children and their families by collecting troves of their
`
`personal information, including:
`
`their physical locations;
`0
`0 websites they visit;
`0
`every search term they use in Google’s search engine (and the results
`they click on);
`
`o
`
`0
`
`0
`0
`I
`
`the videos they watch on YouTube;
`
`personal contact lists;
`
`voice recordings;
`saved passwords; and
`other behavioral information.
`
`6.
`
`And until April 2014, Google also mined students‘ email accounts, extracted
`
`information about them, and used that data—along with the personal information described
`
`above—for advertising purposes.
`
`7.
`
`These privacy concems—and the effects of Google’s misrepresentations and
`
`

`

`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 3 of 24
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 3 of 24
`
`exploitation of information asymmetry between itself, on one hand, and parents and teachers, on
`
`the other—cannot be overstated. While Google publicly positions Google Education as a benign
`
`tool that is an answer to resource-deprived schools nationwide, it secretly uses Google Education
`
`as a means to monitor children while they browse the Internet, including in their private homes,
`
`on their private computers and phones, and on their private networks. This is particularly
`
`concerning considering that teenagers turn to the Internet to search for issues they otherwise
`
`would be too embarrassed or afraid to ask fiiends, parents, or relatives, such as general health
`
`information, sex education, diet advice, how to deal with bullying, anxiety and depression,
`
`puberty, and more.1 In fact, as many as four out of five teenagers turn to the Internet to learn
`
`about health information, such as anxiety, ADI-ID, and sexually transmitted diseases.2
`
`8.
`
`Google is aware of how problematic it is to mine children‘s data in a commercial
`
`context. Outside of its Google Education platform, Google forbids children under the age of 13
`
`in the United States from having their own Google accounts.3 But Google attempts to get around
`
`this by using Google Education to secretly gain access to troves of information about New
`
`Mexican children that it would not otherwise have.
`
`9.
`
`The data Google accumulates is then stored in profiles attributed to each student
`
`and used by Google for its own commercial purposes—as Google itself admitted in response to a
`
`Teens, Health, and Ttechnology: A National Survey, Center on Media and Human
`Development, School of Communication, Northwestern University (June 2015),
`https:h’cmhdnorthwestemedu/wp-
`content/uploads“201 5305ir] 886_1_SOC_ConfReport_TeensI-{ealthTech_05l 1 15.pdf.
`
`Id.
`
`Age Requirements on Google Accounts, Google FAQS,
`
`

`

`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 4 of 24
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 4 of 24
`
`Congressional inquiry into the privacy practices associated with Google Education.4
`
`10.
`
`Beyond breaking its own promises to respect and safeguard children’s privacy
`
`and exploiting the vulnerability of the parents, educators, and children of New Mexico, Google
`
`brazenly violates federal law prohibiting this very conduct. In 1998, Congress enacted the
`
`Children’s Online Privacy Protection Act, 15 U.S.C. §§ 6501, et seq. (“COPPA”), in response to
`
`a growing concern over the collection of children’s data on the Internet. In passing COPPA,
`
`Congress specifically sought to increase parental involvement in children’s online activities,
`
`ensure children’s safety during their participation in online activities, and most importantly,
`
`protect children’s personal information. Ultimately, Congress enacted COPPA with the specific
`
`goal of placing parents in control over what information is collected from their young children
`
`online.
`
`11.
`
`To that end, COPPA requires—in relevant part—that websites and online services
`
`fully and clearly disclose their data collection, use, and disclosure practices, and obtain
`
`“verifiable parental consent” before collecting, using, or disclosing personal information from
`
`children under 13. Further, COPPA requires websites and online services to permit parents to
`
`review all personal information they collect and maintain from children under 13, and to allow
`
`parents to refuse further use or maintenance of those data. Similarly, websites and online services
`
`may not condition a child’s use of a site or service on the collection of more personal
`
`information than is reasonably necessary, and must take reasonable steps to keep confidential
`
`and safe any personal information in its possession.
`
`Susan Molinari, Vice President, Public Policy and Govemment Relations, Americas,
`Google LLC February 12, 2016 Letter to Senator Al Franken, available at
`https://www.ef£org/filesl2016/12/14/160216googleresponse.pdf(“Google may use the data from
`additional services outside of the GAFE core services for the purposes described in our Privacy
`
`

`

`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 5 of 24
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 5 of 24
`
`12.
`
`Google violates its obligations mandated by COPPA. Not only does it use its
`
`Google Education platform to collect children’s personal and sensitive information for its own
`
`commercial purpose without first informing parents, let alone obtaining “verifiable parental
`
`consent,” it also (1) fails to provide parents the ability to meaningfully review or limit the data
`
`collected and used, and (2) conditions use of its product on expansive (and unnecessary)
`
`collection and use of personal information.
`
`13.
`
`These practices do not simply violate federal law, nor do they merely impact
`
`children under the age of 13. Covertly monitoring children of all ages, despite unambiguous
`
`representations to the contrary, violates longstanding rights rooted in the common law, as well as
`
`New Mexico’s statutory prohibitions on unfair, deceptive, and unconscionable business
`
`practices, codified in the New Mexico Unfair Practices Act, NM. Stat. Ann. §§ 57-12-1, et seq.
`
`(“UPA”). And, although not protected by COPPA, educators are likewise victims of Google’s
`
`practices as—in addition to its deceptive promises—Google similarly monitors teachers utilizing
`
`the Google Education platform when they browse the Internet, including in their private homes,
`
`on their private computers and phones, and on their private networks.
`
`14.
`
`Accordingly, the State of New Mexico, by and through Hector Balderas, Attorney
`
`General for the State of New Mexico, seeks all appropriate injunctive relief to address, remedy,
`
`and prevent harm to New Mexico residents resulting from Google’s misconduct, as well as civil
`
`penalties, fees, costs, and any other relief this Court deems proper.
`
`PARTIES
`
`15.
`
`This action is brought for and on behalf of the sovereign State of New Mexico, by
`
`and through its duly elected Attorney General, Hector Balderas. The Attorney General, as chief
`
`legal officer of the State, is statutorily authorized to initiate and prosecute any and all suits
`
`

`

`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 6 of 24
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 6 of 24
`
`deemed necessary for the protection of the interests and rights of the State. See NM. Stat. Ann. §
`
`8-5-2 (duties of the Attorney General). Specifically, the Attorney General is authorized to initiate
`
`and prosecute suits to penalize conduct that constitutes an unfair or deceptive trade practice. See
`
`NM. Stat. Ann. § 57-12-15 (enforcement of UPA). The Attorney General is further empowered
`
`to enforce COPPA via an action filed in federal court. See 15 U.S.C. § 6504 (civil actions by
`
`state attorneys general). The Attorney General is also charged with the duty of guardian of the
`
`public interest, which includes protecting the privacy interests of New Mexico’s citizens and the
`
`welfare of New Mexico's children online. The State brings this action in its parens patriae
`
`and/0r sovereign capacity.
`
`16.
`
`Defendant Google LLC is a limited liability company organized and existing
`
`under the laws of the State of Delaware, with its headquarters and principal place of business
`
`located at 1600 Amphitheatre Parkway, Mountain View, California 94043.
`
`JURISDICTION AND VENUE
`
`17.
`
`This Court has subject matter jurisdiction over this action pursuant to 28 U.S.C.
`
`§§ 1331, 1337(a), and 1367.
`
`18.
`
`This Court has personal jurisdiction over Google pursuant to NM. Stat. Ann. §
`
`38-1-16 because Google engages in business transactions within the State of New Mexico,
`
`purposefully directs and/or directed its actions toward the State of New Mexico, collects and
`
`uses personal data from students, including those under the age of 13, in New Mexico, and/or has
`
`the requisite minimum contacts within the State of New Mexico needed to permit this Court to
`
`exercise jurisdiction. Further, Google has registered to do business within New Mexico in
`
`accordance with the New Mexico Business Corporation Act, N.M. Stat. Arm. §§ 53-17-1 et seq.,
`
`which amounts to consent to personal jurisdiction under relevant New Mexico law. See
`
`

`

`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 7 of 24
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 7 of 24
`
`Rodriguez v. Ford Motor Co., --- P.3d ---, 2018 WL 6716038, *11-12 (N.M. Ct. App. Dec. 20,
`
`2018) (finding foreign corporation consented to jurisdiction in New Mexico by registering under
`
`N.M. Stat. Ann. 53-17-11); see also Schmidt v. Navistar, Inc, 2019 WL 1024285, *5-6 (D.N.M.
`
`March 4, 2019) (Slip Op.) (agreeing with Rodriguez .
`
`19.
`
`Venue is proper in this district pursuant to 28 U.S.C. § 1391 because a substantial
`
`part of the conduct giving rise to the State’s claims occurred in this District, and because Google
`
`transacts business in this District.
`
`FACTUAL BACKGROUND
`
`An Overview of G Suite for Education.
`
`20.
`
`Google’s G Suite for Education platform (formerly referred to as Google Apps for
`
`Education) is a web-based service marketed by Google as a free service to educational
`
`institutions, including K-12 schools.
`
`21.
`
`The G Suite for Education core services are at the heart of Google’s educational
`
`offering to schools and include Gmail (email), Calendar, Drive (cloud storage), Docs (word
`
`processing software), Sheets (spreadsheet software), Slides (presentation software), and more.
`
`22.
`
`Google also provides Google-powered laptops to schools, called Chromebooks,
`
`which are low-cost laptop computers running on Google’s Chrome OS operating system and
`
`include the Chrome web browser.
`
`23.
`
`Over 80 million educators and students now use G Suite for Education and more
`
`than 25 million use Chromebooks in schools, including within New Mexico?
`
`All types of Chromebooks for all types of learners, Google, https:I/blog.google/outreach-
`
`

`

`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 8 of 24
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 8 of 24
`
`To Drive Adoption Among Schools, Google Promises to Protect Student Privacy and
`Signed on to a Pledge Designed to Convince Parents, Teachers, and School Districts
`That There Are No Privacy Concerns With Google Education.
`
`24.
`
`Google recognizes that “trust is earned through protecting teacher and student
`
`privacy”" and has made a number of public promises designed to convince parents, teachers,
`
`school districts, and students that it will protect the privacy of students who use Google
`
`Education.
`
`25.
`
`To that end, in order to reaffirm the commitments it has made over the years to
`
`safeguard and protect student privacy, including to school districts, Google signed the K—12
`
`School Service Provider Pledge to Safeguard Student Privacy (the “Student Privacy Pledge") in
`
`or around January 2015.
`
`26.
`
`The Student Privacy Pledge is a set of principles and promises developed by the
`
`Future of Privacy Forum and The Software & Information Industry Association regarding the
`
`collection, use, and maintenance of student data]
`
`27.
`
`Though not an original signatory, and hesitant to sign on3 (only succumbing after
`
`public outrage), Googled eventually signed the Student Privacy Pledge and affirmatively and
`
`expressly committed to:
`
`(a) Not collect, maintain, use or share student personal information beyond that
`needed for authorized educational/school purposes, or as authorized by the
`parent/student;
`
`Privacy and Security, Google LLC,
`http://servicesgoogle.com/fh/files/misc/gsuite_for_education_privacy__security.pdf (last visited
`February 20, 2020).
`
`Student Privacy Pledge Signatories, Future of Privacy Forum and The Software &
`Information Industry Association, https://studentprivacypledge.org/signatories/ (last visited
`February 20, 2020).
`
`Google Changes Course, Signs Student Data Privacy Pledge, Wall Street Journal,
`https://blogs.wsj.com/digits/ZOl5/0ll20/google-changes-course—signs-student-data-privacy—
`
`

`

`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 9 of 24
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 9 of 24
`
`an
`through
`collected
`information
`student
`disclose
`or
`use
`(13) Not
`educational/school service (whether personal information or otherwise) for
`behavioral targeting of advertisements to students;
`
`(c) Not build a personal profile of a student other than for supporting authorized
`educational/school purposes or as authorized by the parent/student;
`
`(d) Not knowingly retain student personal information beyond the time period
`required to support
`the authorized educational/school purposes, or as
`authorized by the parent/student;
`
`(e) Collect, use, share, and retain student personal information only for purposes
`for which Google was authorized by the educational
`institution/agency,
`teacher, or the parent/student; and
`
`(f) Disclose clearly in contracts or privacy policies, including in a manner easy
`for parents to understand, what types of student personal information Google
`collects, if any, and the purposes for which the information Google maintains
`is used or shared with third parties.
`
`28.
`
`Google publicly promoted its decision to sign the Student Privacy Pledge and
`
`received positive coverage of its commitment.
`
`29.
`
`As described in Section IV below, in direct contradiction to the express
`
`assurances and promises made through the Student Privacy Pledge, Google collects and records
`
`each student‘s web browsing activities, the videos they watch on YouTube, and other
`
`information not generated for or related to educational purposes whatsoever.
`
`III.
`
`Google Likewise Deceptively Markets Its Google Education Platform to Educators
`in Order to Increase Enrollment.
`
`30.
`
`Beyond its privacy pledges, Google takes additional steps to encourage educators
`
`to adopt Google Education in their classrooms.
`
`31.
`
`In its marketing materials, Google promotes the myriad benefits of implementing
`
`Google Education in the classroom. (See Figures 1—3, showing screenshots of Google’s
`
`webpages promoting some of the many resources available to teachers who implement Google
`
`

`

`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 10 of 24
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 10 of 24
`
`Education in their classrooms.)
`
`Spark learning with (3 Suite for Education
`
`A suite of tools designed to empower educators and students as they team and innovate together. Sign up your
`institution for G Suite for Education.
`
`To help expand
`learning for everyone
`
`Working to support education through our products,
`programs, and philanthropy.
`
`Culture
`
`Teaching resources to empower learning
`in the classroom
`
`Discover a broad selection at apps, activities. lesson plans. digital literacy
`tools, and games to advance leamlng in the classroom including virtual
`
`field trips, lessons on coding. and more.
`Explore teaching resources
`
`éa
`
`CreativityTools
`
`Y
`
`Language. Arts E.
`
`Q
`
`Dlgl tal Uteracy
`
`32.
`
`Google likewise provides various training tools and manuals designed to convince
`
`teachers to implement Google Education into their classrooms.
`
`33. What is conspicuously absent from these marketing materials is any adequate
`
`

`

`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 11 of 24
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 11 of 24
`
`disclosure that, by introducing Google Education to the classroom, Google will track and
`
`monitor students' web browsing activities and other information not generated for or related to
`
`educational purposes whatsoever.
`
`34.
`
`In fact, Google actively misrepresents its privacy—violative conduct and provides
`
`educators with a false sense of security about its data collection practices. For example, on one of
`
`its promotional webpages, Google notes that its core services “do not contain advertising nor do
`
`they use information in those services for advertising purposes.” Google also claims that all of its
`
`“G Suite for Education core services Straport COPPA and FERPA compliance.” (See Figure 4
`
`below, showing a screenshot from Google’s Google Education marketing website. Emphasis
`
`added.)
`
`Transform how your school works with
`our suite of free, secure tools
`
`Education core services support COPPA and FERPA compliance
`
`G Suite core services do not contain advertising nor do they use
`
`information In those services for advertising purposes Plus, all G Suite for
`
`35.
`
`These representations are misleading. First, advertising is but one of an entire
`
`constellation of commercial purposes Google is prohibited from using student information for
`
`under COPPA, and a purported lack of advertising does not in any way mean COPPA
`
`compliance. Second, Google is implying that its products are COPPA/FERPA compliant, but in
`
`reality Google is saying that its products merely “support” COPPA/FERPA compliance. It is
`
`unclear what “supporting compliance" means in this context. Both of these statements are
`
`misleading because in reality, once Google Education is introduced into the classroom, Google
`
`uses it to vociferously collect children’s (and older students’ and educators’) personal and
`
`

`

`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 12 of 24
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 12 of 24
`
`sensitive information for Google’s own commercial purpose without first informing parents, let
`
`alone obtaining “verifiable parental consent” as required by COPPA.
`
`Google Collects Virtually Everything That Students—Including Those Under 13—
`Do Online Through Google Education for its Own Commercial Purposes.
`
`36.
`
`Today, more than half the students in the country use Google Education.
`
`37.
`
`In schools that use Google Education, students are automatically assigned a
`
`unique usemame and password that identifies the student with a particular Google Education
`
`account.
`
`38.
`
`Students are typically given their Google Education credentials the first day of
`
`classes and are immediately instructed-in the classroom—to log into their Google accounts on
`
`their private computers, mobile devices, and/or school-issued Chromebooks in order to use
`
`Google Education.
`
`39. When students log into a school issued or personal Chromebook, Google will tum
`
`on the Chrome Sync function by default. This, in turn, automatically starts uploading students’
`
`Chrome usage data—such as bookmarks, web searches, passwords, and online browsing
`
`habits—to Google’s servers. Google acknowledges in a help page that it can read this data but
`
`states: “With a passphrase, you can use Google’s cloud to store and sync your Chrome data
`
`without letting Google read it.”9 Unfortunately, the option to set such a passphrase to stop
`
`Google from reading private student data is off by default, and buried in settings that parents
`
`likely never see.
`
`40.
`
`Students also are often encouraged to logon to their Google Education accounts
`
`Google Chrome Help, Google LLC,
`https:a’fsupport.google.com/chromelanswert1 65 l 39?co=GENIE.P1atform%3 DDesktop&hl=en
`
`

`

`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 13 of 24
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 13 of 24
`
`on the Chrome browser of their family’s personal computers. When doing so, an option exists to
`
`turn on Google Sync and link the family’s existing Chrome usage data to the student's Google
`
`Education account—which associates even more personal data to the student’s Google profile.
`
`41.
`
`Additionally, once students are signed into their Google Education accounts,
`
`Google uses cookies to identify students and begins collecting essentially everything they do
`
`online, including the names and URLs of websites searched and visited, and what videos they
`
`watch on YouTube.'°
`
`42.
`
`Google routinely and automatically collects this highly sensitive data regardless
`
`of whether students are using a school issued device or are logged into their Google Education
`
`account through a personal device.”
`
`43.
`
`Even if students affinnatively log out of their accounts through a settings page,
`
`Google permanently ties this data to their profiles.
`
`44.
`
`In its marketing materials, Google even boasts that kids as young as kindergarten-
`
`age in New Mexico now have Google email accounts and that all students will have access to
`
`their accounts for years after they graduate. (See Figure 5, showing a screenshot of Google
`
`Stories of Impact.)
`
`This should be no surprise to Google. On September 4, 2019, the Federal Trade
`Commission, together with the New York Attorney General’s Office, announced a $170 million
`settlement with Google’s video sharing subsidiary—YouTube—over allegations that it collected
`children’s personal information without their parents’ consent in violation of COPPA.
`
`Until recently, Google also collected, on information and belief, children’s precise
`physical locations, mobile device contact lists (when signed into their mobile devices), and audio
`
`

`

`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 14 of 24
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 14 of 24
`
`E OUTCOMES: Saving Money and Cultivating Relationships
`
`Cost Savings
`
`Sometimes It’s the Little Things
`
`Pr or to 60an Google, we put significant time and money into file
`storage. software licensing. email sewers, and local virus scanning
`Now we enjoy all the features and benefits of G Suite for Education
`for FREE
`
`We are 7+ years into our Google adoption, and it still costs 30 per user! Gallo-pi-
`
`__
`
`_
`
`'cluding email
`
`_ -
`wrth sop retreated spam and antiwrus contro r
`Web-based office suite comparable to competing products
`Unlm ted file storage in the Google Drive cloud - and it’s all
`incrementai ly backed up!
`Google Vault allows us to maintain extremely reliable and rapid
`backups and monitoring of email and documents for staff and
`students Without the fear of lost data or legal failures
`
`I
`
`MESD is able to provide an additional perk that
`wouldn't be possible if it wasn't free'
`_
`__
`_ q
`cess
`Graduating students have
`to 91¢ apcoupts for year—safter they
`graduate. This helps them maintain
`contact with teachers and community
`members important to them as they
`move into the workplace or further
`education.
`
`lFig. 5.)
`
`45.
`
`By tracking and cataloguing everything children do online and on their digital
`
`devices, Google has unprecedented visibility and access into the online lives of children across
`
`the country and specifically, in the State of New Mexico.
`
`46.
`
`Ultimately, though it is marketed to schools as a purely educational tool, Google
`
`Education provides far more benefit to Google than it does to students or schools. Google
`
`recognizes that by giving children fi‘ee access to its online tools and habituating them at a young
`
`age, Google obtains something much more valuable: generations of fiiture customers.
`
`47.
`
`Google also uses the data it accumulates through Google Education for its own
`
`commercial purposes—as Google itself admitted in response to a Congressional inquiry into the
`
`privacy practices associated with Google Education.‘
`
`2
`
`48.
`
`Google likewise tracks and documents the online activity of teachers using
`
`Susan Molinari, Vice President, Public Policy and Government Relations, Americas,
`Google LLC February 12, 2016 Letter to Senator Al Franken, available at
`https://www.ef£org/files/2016/12/14/160216googleresponse.pdf (“Google may use the data from
`additional services outside of the GAFE core services for the purposes described in our Privacy
`
`

`

`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 15 of 24
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 15 of 24
`
`Google Education through a Chrome browser or Chromebook without their prior knowledge or
`
`consent.
`
`Google’s Collection of Non-Educational Data from Students Violates its Own
`Privacy Promises as Well as Federal Law.
`
`49.
`
`Despite its numerous assurances, Google has been using Google Education to spy
`
`on New Mexico children, teachers, and their families by collecting troves of their personal
`
`information—including by monitoring kids while they browse the Internet in their private
`
`homes, on their private computers and phones, and on their private networks—and using that
`
`data for its own commercial benefit.
`
`50.
`
`In addition to breaking its own promises, including those identified in Sections 11—
`
`111, Google does not provide adequate notice to the parents or the teachers of the tracked children
`
`about these data collection practices and, worst of all, does not obtain any form of verifiable
`
`parental consent before doing so.
`
`51.
`
`Beyond thwarting parental autonomy by unlawfully collecting children‘s
`
`information in the first place, Google also robs parents of any control over the subsequent use of
`
`collected data. Further, it does not allow children to use the Google Education platform in a
`
`manner that allows children to avoid gratuitous collection of their personal information. Thus,
`
`Google uses its ability to provide schools—and thereby children, parents, and educators—with
`
`much needed resources in a deeply exploitative manner, forcing children to use products and
`
`services that will secretly (and unlawfully) monitor them, in order to receive an education.
`
`52.
`
`Google—and not school districts—has an obligation to provide notice to parents
`
`and obtain their consent. After all, schools that partner with Google are not in a position to
`
`properly inform parents of the types of information that Google will be collecting from students,
`
`

`

`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 16 of 24
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 16 of 24
`
`of the extent of its practices), and are likewise victims of Google’s practices themselves.
`
`53.
`
`Google is required to inform parents of its data collection practices. It is also
`
`required to direct this notice at the parents of children whose data it seeks to collect and to obtain
`
`verifiable parental consent.
`
`54.
`
`Google did not obtain verifiable parental consent via an online form, a toll-free
`
`number, a video-conference call—or by any other method allowed under COPPA or recognized
`
`under any other law—enabling a parent to accept or reject Google’s data collection practices.
`
`55.
`
`Furthermore, the pop-up notifications that Google displayed to students when first
`
`accessing their Google Education accounts are not intended nor available for review by the
`
`child’s parent. The notifications appear when the child uses his or her Chromebook computer or
`
`logs on to a Chrome browser in order to complete school work.
`
`56.
`
`Even if such notifications fully informed a child of Google‘s collection practices
`
`(they do not), such notice is insufficient under COPPA because children under 13 do not have
`
`the capacity to consent to Google’s data collection practices.
`
`5?.
`
`The consequences of Google’s tracking cannot be overstated: children are being
`
`monitored by one of the largest data mining companies in the world, at school, at home, on
`
`mobile devices, without their knowledge and without the permission of their parents. Vast
`
`amounts of personal data generated by the student while online will be captured by Google and
`
`added to the student’s profile. While purporting to offer only educational services, Google
`
`instead has stripped children and parents of autonomy and control of their most sensitive
`
`personal information, forcing children to acquiesce to constant monitoring, in perpetuity, in
`
`exchange for their education.
`
`

`

`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 17 of 24
`
`Case 1:20-cv-00143-NF-KHR Document 1 Filed 02/20/20 Page 17 of 24
`
`FIRST CAUSE OF ACTION
`
`Violations of the Children’s Online Privacy Protection Act
`15 U.S.C. §§ 6501, et seq.
`
`58.
`
`Plaintiff State of New Mexico incorporates the foregoing allegations as if fully set
`
`forth herein.
`
`59.
`
`The Attorney General of the State of New Mexico is authorized to bring a civil
`
`action in the name of the State, against Google, to enforce regulations prescribed by COPPA
`
`and to secure remedies for violations of such regulations. See 15 U.S.C. § 6504.
`
`60.
`
`Under COPPA, an operator of a website or online service that collects personal
`
`information from children must provide notice to the child’s parent about its data collection
`
`practices and obtain verifiable parental consent prior to any collection or use of personal
`
`information from children. A violation of this regulation is deemed unlawful. 16 CPR. § 312.3.
`
`6].
`
`COPPA defines a “child" as “an individual under the age of 13.” I6 CPI}. §
`
`312.2.
`
`62.
`
`Google is required to comply with the requirements set out in COPPA because it
`
`has specifically developed the Google Education platform for use by students in grades K—12.
`
`Furthermore, Google has actual knowledge that children under the age of 13 use its apps and
`
`services.
`
`63.
`
`Google is an “operator” as contemplated by 16 C.F.R. § 312.2 because it operates
`
`a “Web site located on the Internet or an online service and who collects or maintains personal
`
`information from or about the users of or visitors to such Web site or online service .
`
`.
`
`. where
`
`such Web site or online service is operated for commercial purposes involving commerce among
`
`the several States or with l or more foreign nations.” I

This document is available on Docket Alarm but you must sign up to view it.


Or .

Accessing this document will incur an additional charge of $.

After purchase, you can access this document again without charge.

Accept $ Charge
throbber

Still Working On It

This document is taking longer than usual to download. This can happen if we need to contact the court directly to obtain the document and their servers are running slowly.

Give it another minute or two to complete, and then try the refresh button.

throbber

A few More Minutes ... Still Working

It can take up to 5 minutes for us to download a document if the court servers are running slowly.

Thank you for your continued patience.

This document could not be displayed.

We could not find this document within its docket. Please go back to the docket page and check the link. If that does not work, go back to the docket and refresh it to pull the newest information.

Your account does not support viewing this document.

You need a Paid Account to view this document. Click here to change your account type.

Your account does not support viewing this document.

Set your membership status to view this document.

With a Docket Alarm membership, you'll get a whole lot more, including:

  • Up-to-date information for this case.
  • Email alerts whenever there is an update.
  • Full text search for other cases.
  • Get email alerts whenever a new case matches your search.

Become a Member

One Moment Please

The filing “” is large (MB) and is being downloaded.

Please refresh this page in a few minutes to see if the filing has been downloaded. The filing will also be emailed to you when the download completes.

Your document is on its way!

If you do not receive the document in five minutes, contact support at support@docketalarm.com.

Sealed Document

We are unable to display this document, it may be under a court ordered seal.

If you have proper credentials to access the file, you may proceed directly to the court's system using your government issued username and password.


Access Government Site

We are redirecting you
to a mobile optimized page.





Document Unreadable or Corrupt

Refresh this Document
Go to the Docket

We are unable to display this document.

Refresh this Document
Go to the Docket