EFF Files Legal Complaint Against Google At The FTC

from the yeah,-eff-isn't-run-by-google dept

Wed, Dec 2nd 2015 3:49pm — Mike Masnick

So this is interesting. The Electronic Frontier Foundation is dragging Google in front of the FTC, with a complaint alleging some potentially serious privacy violations concerning tracking of students in schools. The crux of the EFF's complaint:

While Google does not use student data for targeted advertising within a subset of Google sites, EFF found that Google’s “Sync” feature for the Chrome browser is enabled by default on Chromebooks sold to schools. This allows Google to track, store on its servers, and data mine for non-advertising purposes, records of every Internet site students visit, every search term they use, the results they click on, videos they look for and watch on YouTube, and their saved passwords. Google doesn’t first obtain permission from students or their parents and since some schools require students to use Chromebooks, many parents are unable to prevent Google’s data collection.

Looking over the details, I'm not entirely sure what the issue is here. The sync feature isn't designed to violate someone's privacy, but to allow users to access the same websites from different machines -- a feature that could be useful, especially in school settings where there may be a bunch of laptops that are passed around, so students may not always use the same machine. Also, wouldn't Google need to store their saved passwords? It also seems noteworthy that the organizations that put together the Student Privacy Pledge that EFF says Google is violating, have all said that EFF is wrong in its complaint. That said, the EFF is usually really good about these things, so I'll give the group the benefit of the doubt that there could be a problem here and will be paying attention to how this shakes out. No matter what, it will be worth following how the FTC responds.

What's much more interesting to me about this, however, is that this once again shows how the EFF is not a front for Google. There's this weird myth among some in the anti-Google/anti-digital rights world that EFF is just a "shill" for Google. I can't count the number of times I've seen blog posts falsely claim that Google is a major funder of EFF. Hell, resident clueless digital rights commentator Andrew Orlowski at the Register made that claim just a few days ago, saying that EFF "received half of its income one year from Google" even though he knows that claim is hellishly misleading.

You can see the EFF's annual report here, which includes this handy chart.

You'll notice, first of all, that approximately slightly less than 1/3 of EFF's funding comes from "corporate contributions" -- but the vast, vast majority of that actually comes from contributions from Humble Bundle campaigns (when you buy video games from Humble, you can designate some portion to go to charity, and EFF is almost always one of the supported charities). Thus, it's actually only less than $600,000 of EFF's $13.5 million income that came from corporate donations. That's less than 5% -- and even if Google is one of those contributors, it's likely not the only one. Now, it's also probably true that some of the "individual contributors" work for Google, but it's certainly not corporate donations. And, from what I've heard from multiple EFF people, the actual amount of revenue that comes from Google employees as individual contributors is tiny.

What most of the conspiracy theorists, such as Orlowski, cite when they say that Google provided a ton of money to the EFF is not what it seems at all. It was a one-time payout, first of all, and it was to settle a legal dispute in which EFF also went against Google. Specifically, it was over Google's ridiculous failed "Google Buzz" offering that had some really weak privacy controls. EFF was among many groups who criticized Google over its privacy failings for Buzz, and so part of the class action settlement was that Google would give a chunk of money to a variety of non-profit/public interest groups who focused on privacy protection -- with EFF being one of those recipients. So even the key case in which Google definitely gave EFF money, it involved a court-sanctioned punishment of Google, giving the money to EFF (and others) who had opposed Google's privacy practices. This was part of a so-called "cy pres" award, and as you can see, in the most recent period, that represented a little over a million dollars in EFF's income. This is hardly a majority and, considering how it comes in, hardly the kind of thing that makes EFF a mouthpiece for those providing the money.

And, of course, now the EFF is going after Google for privacy issues once again. It makes you wonder how everyone who likes to insist EFF is just a Google mouthpiece will spin this one. I'm sure the conspiracy theories will be creative.

Ftccomplaint Googleforeducation (PDF)Ftccomplaint Googleforeducation (Text)

Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.

Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.

While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.

–The Techdirt Team

Filed Under: children, cy press, ftc, funding, privacy, schools, students
Companies: eff, google

35 Comments

If you liked this post, you may also be interested in...

Reader Comments

Subscribe: RSS

View by: Time | Thread

Anonymous Coward, 2 Dec 2015 @ 3:51pm

> The sync feature isn't designed to violate someone's privacy, but to allow users to access the same websites from different machines

That's seriously your argument? Because it's impossible to access "the same websites from different machines" without allowing Google to store and mine a bunch of data about your activities?

Try harder.
[ link to this | view in chronology ]
- Mike Masnick (profile), 2 Dec 2015 @ 4:21pm
  
  Re:
  That's seriously your argument? Because it's impossible to access "the same websites from different machines" without allowing Google to store and mine a bunch of data about your activities?
  
  Again, I'm willing to give the EFF the benefit of the doubt that there's more to it than this, but the sync feature isn't about data mining at all. It's about keeping track of what websites you have open and would like to be able to keep open the next time you log in. I'm not sure how you do that without a sync feature (which can be turned off if you don't want it).
  
  What's so horrible about it?
  [ link to this | view in chronology ]
  - Anonymous Coward, 2 Dec 2015 @ 7:48pm
    
    Re: Re:
    What's horrible about [Google's sync function]?
    Oh gee, I don't know. Maybe the fact that it can't be turned off? Personally, I wouldn't mind it at all if I could just simply have my activities logged in an account and not across machines I'm not signed into my account on.
    (-_Q)
    [ link to this | view in chronology ]
    - Scott Yates (profile), 2 Dec 2015 @ 10:46pm
      
      Re: Re: Re:
      It most certainly CAN be turned off. I specifically turn it off on mine. You can selectively turn off parts of it as well. For example, you can turn off bookmark sync, but leave history sync enabled if you want.
      
      It is an option that can be toggled by the user.
      [ link to this | view in chronology ]
  - nasch (profile), 3 Dec 2015 @ 7:09am
    
    Re: Re:
    Again, I'm willing to give the EFF the benefit of the doubt that there's more to it than this, but the sync feature isn't about data mining at all.
    
    Often programs and features that aren't "about" data mining end up getting used that way later on.
    [ link to this | view in chronology ]
  - Anonymous Coward, 3 Dec 2015 @ 3:28pm
    
    Re: Re:
    > the sync feature isn't about data mining at all.
    
    Yes, Google always collects and spends the money to store data that it will never analyze. After all, Google is a charity, not a business.
    
    > It's about keeping track of what websites you have open and would like to be able to keep open the next time you log in. I'm not sure how you do that without a sync feature (which can be turned off if you don't want it).
    
    1.) You really can't think of any way to keep track of what websites you were looking at without handing the details of every site you've accessed to Google?
    
    2.) The "it can be turned off" excuse is convenient, but you and I both know most people would never even know this was happening to begin with. Google knows this as well, which is why it's enabled by default. If they were really just doing this to provide a useful feature, it would be opt-in, with clear instructions available to anyone who actually wanted to use it.
    [ link to this | view in chronology ]
    - JMT (profile), 3 Dec 2015 @ 4:27pm
      
      Re: Re: Re:
      "Yes, Google always collects and spends the money to store data that it will never analyze. After all, Google is a charity, not a business."
      
      Providing a service that some customers clearly want (and can be switched off by those who don't) makes perfect business sense.
      [ link to this | view in chronology ]
      - Anonymous Coward, 4 Dec 2015 @ 1:01pm
        
        Re: Re: Re: Re:
        Yes, making a feature that most people will never know is collecting data about them, opt-out instead of opt-in, makes perfect business sense for a data mining operation like Google.
        [ link to this | view in chronology ]
- crade (profile), 2 Dec 2015 @ 4:22pm
  
  Re:
  I focused on the word "designed" in this sentence.. There isn't allot that is designed to violate someone's privacy.. It's nearly always going to be a side effect of some other design.. Trying to gather all the data in the world to satiate your massive OCD for instance (looking at you NSA).
  [ link to this | view in chronology ]
  - Anonymous Coward, 2 Dec 2015 @ 9:19pm
    
    Re: Re:
    There isn't allot that is designed to violate someone's privacy
    
    Actually there IS a lot that is designed to violate someone's privacy! Just because you might choose to set a high bar for what constitutes that violation means nothing.
    
    Any attempt to gather information on someone no matter how benign you think it is without their consent is a system specifically designed to violate their privacy!
    
    Some organizations just cut right to the chase and just say, use our stuff and we invade your privacy, take it or leave civilization behind.
    [ link to this | view in chronology ]
- Anonymous Coward, 2 Dec 2015 @ 4:51pm
  
  Re:
  Yes, it's impossible for the Sync feature(s) to work without Google storing data. But you knew that.
  [ link to this | view in chronology ]
Anonymous Coward, 2 Dec 2015 @ 4:02pm

> Can't see the issue

The issue is that it normalises unthinkingly giving up data and privacy before children are old enough to make the decision for themselves. It does so in a compulsory manner - the children aren't given a choice (often either in hardware, software or options).

Oh, and because I have to, *Won't somebody think of the children?*
[ link to this | view in chronology ]
- Mike Masnick (profile), 2 Dec 2015 @ 4:23pm
  
  Re:
  The issue is that it normalises unthinkingly giving up data and privacy before children are old enough to make the decision for themselves.
  
  How so? I don't get this aspect of the argument. You trade off privacy for other things all the time. Leaving your house is a trade off. Most people think it's worth it because of the benefits of leaving your house vs. the downside of possibly being seen in public. The "tradeoff" here doesn't seem much more problematic -- but again I'm willing to admit that I'm missing something if there are more details.
  
  It does so in a compulsory manner - the children aren't given a choice
  
  Apparently the feature is voluntary.
  [ link to this | view in chronology ]
  - Anonymous Coward, 2 Dec 2015 @ 4:44pm
    
    Re: Re:
    >Apparently the feature is voluntary.
    
    It's opt-out (pre-selected as enabled), apparently. That's bad in its own right. The fact that the primary user is a minor makes it worse, as a minor cannot enter into any sort of terms of service agreement (or any other legal agreement).
    
    I don't know what constitutes "personal information" vis a vis COPPA, but I'm a bit surprised that doesn't play in here.
    [ link to this | view in chronology ]
  - Anonymous Coward, 2 Dec 2015 @ 7:13pm
    
    Re: Re:
    I trade off things. I am an adult. I make the decisions about my life and what I trade off.
    
    We aren't talking about an adult making a choice as to what they trade off. We are talking about what a child is compelled to trade off. As I understand it, the children (or, for that matter, their parents) are compelled to use chromebook. While there may be features that don't erode their privacy to the same degree, they are still, effectively, being groomed that their privacy isn't even worth considering.
    
    If the flip-side was in operation, i.e. that sync was disabled by default but they (ideally with parental consent) were able to enable the feature, then it requires them (at least for a small amount of time) to consider the decision, what is being traded off and are they prepared to make that trade off.
    [ link to this | view in chronology ]
- OldMugwump (profile), 3 Dec 2015 @ 7:25am
  
  Re:
  FWIW, my son (now 13) has one of these Google for School things, and I've talked to him about it.
  
  He says all the kids know that the teachers/school can track everything they do online (what webpages they visit, every key they type). They worry about that - not about Google Inc.
  
  So, all the kids use the Google for School accounts ONLY for assigned homework and other school tasks where they're required to use the account.
  
  For everything else, they all have their own personal (non-Google-for-School) accounts.
  
  Problem solved.
  [ link to this | view in chronology ]
  - Chainsaw Flowerchild, 3 Dec 2015 @ 3:54pm
    
    Re: Re:
    My daughter has the same system. She uses her school credentials only for school assignments and then logs out. She understands that anything she does while logged into the Google for School account can be tracked by her teachers.
    
    Not that it matters much anyway since most parent I know had to lie to Google and say their kid was over 13 in order to activate their Android phone or tablet.
    [ link to this | view in chronology ]
    - OldMugwump (profile), 4 Dec 2015 @ 11:35am
      
      Re: Re: Re:
      Yes, me too. I told my son the age 13 business was legal bullshit and that he should just lie (same on any other website).
      
      Funny, the things the legal system makes us do, no?
      [ link to this | view in chronology ]
crade (profile), 2 Dec 2015 @ 4:20pm

On the other hand.. If they *were* a shill for google, this would be the perfect cover! A crappy legal complain that doesn't go anywhere and eventually exonerates google.

Also, who is to say that the top contributers to the humble bundle isn't just google paying for the EFF :) What better way to launder your payoff!

hehe
[ link to this | view in chronology ]
- Eldakka (profile), 3 Dec 2015 @ 3:57pm
  
  Re:
  On the other hand.. If they *were* a shill for google, this would be the perfect cover! A crappy legal complain that doesn't go anywhere and eventually exonerates google.
  I was thinking exactly the same thing.
  
  Not that I agree with EFF being a shill for Google, I don't think they are. Just expressing an opinion on the validity of an argument.
  [ link to this | view in chronology ]
Anonymous Coward, 2 Dec 2015 @ 4:38pm

So the majority of this article is about how Google and the EFF aren't joined at the hip, eh?

Sounds like this stunt is indeed a PR psyop, rather than the EFF cutting bait with Google. Too bad.
[ link to this | view in chronology ]
Anonymous Coward, 2 Dec 2015 @ 5:17pm

Misunderstandings
… have all said that EFF is wrong in its complaint.
That link (for those who didn't bother to clik-thru) goes to:
Some Misunderstandings of the Student Privacy Pledge
December 2, 2015 By Mark MacCarthy

. . . FTC enforcement of privacy promises is entirely legitimate and is an important element of the system of self-regulation the industry has adopted. But, it is also important to have a clear understanding of what the student privacy pledge actually says.

What the student privacy pledge actually says is a bunch of marketing hooey that no one in their right mind would ever believe.

It's ludicrous to think that the companies who “signed” the “pledge” ever expected to be held to their vague fluffy-feelgood “promises”. It's even more ridiculous to expect the government to do anything when those companies break their “pledges” — you knew that, didn't you. Corporations' pledges are just like politician's campaign promises: meaningless! Everyone knows that.
[ link to this | view in chronology ]
Anonymous Coward, 2 Dec 2015 @ 5:59pm

Proof Google is working for the EFF
You got this all wrong: Google is actually a shill for the EFF. Want proof? Just read the article above. It's clearly pro-EFF, and crucially, can be found on Google.

Furthermore, how do most people find the EFF? The internet. Now, since Google=Internet, seeing the EFF on the internet is proof Google supports the EFF.
[ link to this | view in chronology ]
Glenn, 2 Dec 2015 @ 6:21pm

In this case I'd say that they (EFF) are eff-ing stupid.
[ link to this | view in chronology ]
Matthew Cline (profile), 2 Dec 2015 @ 7:07pm

Well, obviously the EFF is doing this to make it look like it isn't a Google Shill.
[ link to this | view in chronology ]
Anonymous Coward, 2 Dec 2015 @ 7:27pm

¿¿Orlowski or Assange??
"Andrew Orlowski at the Register made that claim just a few days ago"
Actually he was quoting Julian Assange, who "singles out the Electronic Frontier Foundation (EFF), which received more than half of its annual income from just one of a series of controversial "cy pres" class action payouts"
[ link to this | view in chronology ]
- Karl (profile), 3 Dec 2015 @ 3:55pm
  
  Re: ¿¿Orlowski or Assange??
  Actually he was quoting Julian Assange
  
  No, he wasn't. True, Assange was criticizing the EFF, but he never said they received "more than half of its annual income" from Google. (In fact, he said "The EFF is a great group, and they’ve done good things for us, but nonetheless it is significantly funded by Google, or people who work at Google.")
  
  And, yeah, this is precisely how the conspiracy theorists turn lawsuits against a company, into being controlled by the company they're suing. According to nutjobs like Orlowski, any "cy press" settlement is nothing more than Google giving money to Google shills, rather than to the actual "victims" of Google.
  
  So if the EFF wins a suit against Google, they're getting money, and if they're getting money, they're obviously in bed with the people who gave it to them. Therefore, EFF is a shill for Google. Quod erat stupidus.
  [ link to this | view in chronology ]
  - Anonymous Coward, 3 Dec 2015 @ 4:17pm
    
    Re: Re: ¿¿Orlowski or Assange??
    "No, he wasn't" Well, actually he was . The only time he mentions Google in the article Mike links to it is a link to an article about Julian Assange. That's the quote in the post above.
    
    The article is here ... http://www.theregister.co.uk/2014/10/14/assange_bollocks_google_eff/
    [ link to this | view in chronology ]
    - nasch (profile), 3 Dec 2015 @ 8:27pm
      
      Re: Re: Re: ¿¿Orlowski or Assange??
      The line is here: "Assange singles out the Electronic Frontier Foundation (EFF), which received more than half of its annual income from just one of a series of controversial "cy pres" class action payouts." This was not a quote from Assange, but a line written by Orlowski. The Assange quote is “The EFF is a great group, and they’ve done good things for us, but nonetheless it is significantly funded by Google, or people who work at Google”.
      [ link to this | view in chronology ]
  - Karl (profile), 16 Dec 2015 @ 5:41am
    
    Re: Re: ¿¿Orlowski or Assange??
    this is precisely how the conspiracy theorists turn lawsuits against a company, into being controlled by the company they're suing. According to nutjobs like Orlowski, any "cy press" settlement is nothing more than Google giving money to Google shills, rather than to the actual "victims" of Google.
    
    So if the EFF wins a suit against Google, they're getting money, and if they're getting money, they're obviously in bed with the people who gave it to them. Therefore, EFF is a shill for Google. Quod erat stupidus.
    
    As predicted:
    https://musictechpolicy.wordpress.com/2015/12/10/why-is-ars-pitching-for-eff-donations/
    [ link to this | view in chronology ]
New Mexico Mark, 2 Dec 2015 @ 8:29pm

Legit concern, but not moral panic
Whether we're talking about "Info-Hoover Barbie(tm)" or Google, the concern seems to be the moderately (for many) difficult "opt-out" approach to information gathering on minors, as well as the potential for targeted advertising directly to minors. At least make most of the aggressive information aggregation "opt-in". If the benefits are that great, kids and/or parents will find a way to enable it.

Microsoft makes the same argument with Windows 10's greatly increased info/behavior hoovering. "It's all about the enhanced user experience." The most frustrating thing is that they're right, in that well-designed systems that 'know' me better than I know myself have the capability to anticipate my behavior and adjust accordingly. Having a traffic warning and route advice spontaneously pop up on Chrome on my work computer around the time I leave work is a little disturbing at first, but becomes very helpful. OTOH, the potential for abuse -- a "future crimes" division of a police state, for instance, is a frightening scenario. A more likely scenario might be colleges or jobs "tuning" their admissions based on analysis of information hoovered up in childhood -- an information version of the "Gattaca" world, if you will.

Oddly enough, even though I'm a major technophile, we steered our daughter away from technology during her early childhood. She spent a lot of time outdoors and reading books. It doesn't seem to have hurt her interests or skills one bit, as she is about to graduate from one of the top science/math high schools in the U.S.
[ link to this | view in chronology ]
Whatever (profile), 2 Dec 2015 @ 10:03pm

"And, of course, now the EFF is going after Google for privacy issues once again. It makes you wonder how everyone who likes to insist EFF is just a Google mouthpiece will spin this one. I'm sure the conspiracy theories will be creative."

I have two theories. One is that Google is more than willing to let this challenge go ahead because it's a fight away from their bigger privacy issues. It's one where Google could have a clear victory, and take that as fodder against anyone else challenging them on privacy issues.

My second theory is that while Google and EFF appear to be closely tied, not everyone at EFF is so cozy and happy about that. The suit is filed by staff attorneys rather than seniors, which seems a little odd considering they are taking on one of the two or three largest technology companies in the world. It almost seems like one of those "well, if you want to try it, you are on your own", leaving two staff attorneys to file.

Overall, my feeling is that Google would be happy with a win / dismissal, and likely not too upset at a loss that requires a limited change in operation. There is only a very small window under which Google would truly lose, otherwise they win by not losing.
[ link to this | view in chronology ]
Anonymous Coward, 3 Dec 2015 @ 4:44am

It can be turned off , but should be turned off by default until the user makes that choice, learning instruments should not be used for ad revenue data mining , when and if you have kids you'll understand.
[ link to this | view in chronology ]
- Just Another Anonymous Troll, 3 Dec 2015 @ 8:21am
  
  Re:
  It does specifically state that this is for non-advertising purposes. I am all for disabled by default though. If I really want it, I'll turn it on.
  [ link to this | view in chronology ]
Guy Cope, 3 Dec 2015 @ 12:17pm

Google, EFF, and COPPA
There's not quite enough information in the above post to indict Google, but this appears to be a violation of COPPA.

From the FTC website:

Post a clear and comprehensive online privacy policy describing their information practices for personal information collected online from children;

Provide direct notice to parents and obtain verifiable parental consent, with limited exceptions, before collecting personal information online from children;

Give parents the choice of consenting to the operator’s collection and internal use of a child’s information, but prohibiting the operator from disclosing that information to third parties (unless disclosure is integral to the site or service, in which case, this must be made clear to parents);

Provide parents access to their child's personal information to review and/or have the information deleted;
Give parents the opportunity to prevent further use or online collection of a child's personal information;
Maintain the confidentiality, security, and integrity of information they collect from children, including by taking reasonable steps to release such information only to parties capable of maintaining its confidentiality and security; and

Retain personal information collected online from a child for only as long as is necessary to fulfill the purpose for which it was collected and delete the information using reasonable measures to protect against its unauthorized access or use.
[ link to this | view in chronology ]