The Student Privacy Pledge: political facade or privacy protection?

-- By AlexandraRosen - 09 Dec 2015

Introduction

Since January 2015, over 200 companies—including Google, Apple Inc. and Microsoft Corp.—signed what is referred to as the Student Privacy Pledge (the "Pledge"). The legally binding pledge created by the Future of Privacy Forum (FPF) and Software and Information Industry Association (SIIA) is a “vow to collect, store or use student data only for educational purposes.” While on its face the Pledge seems like a positive step towards stricter consumer privacy protection on the Web, the Pledge’s impact on companies collection and use of personal information and activity should not be overstated. The Pledge is not a substitute for student-privacy legislation.

In the following paper, I will argue that the existence and wide support lauding the Student Privacy Pledge as an effective mechanism for protecting student privacy on the Web creates a false sense that security within the status quo and in turn, slows real progress toward more effective privacy protections.

Recent action to enforce the terms of the Pledge force me to re-examine my argument

Given my strong skepticism of the Pledge’s ability to effect company behavior, I was surprised to see that on Tuesday, December 1, 2015, the Electronic Frontier Foundation (EFF),a non-profit privacy organization, filed a complaint with the Federal Trade Commission (FTC) against Google's Apps for Education (GAFE) alleging that it violates the company’s pledge to limit its use of student data. In light of this complaint, I consider whether my critique of the Student Privacy Pledge is completely misplaced.

Am I Wrong? Or is the Pledge an Empty Promise?

A closer look at student privacy protection under the Pledge

1. Limited scope

The Pledge does not impose a blanket prohibition on companies' collection and use of student information. Instead, the Pledge obligates signatories to “be transparent about collection and use of data” in conducting certain activity in particular context. The scope of activities covered by the Pledge is explicitly limited not to include “the use of student information for purposes of adaptive learning or customized education.”

Apparently, EFF’s complaint against Google incorrectly interprets the Pledge to apply to various GAFE activities. Shortly after the complaint was filed, both FPF and SIIA issued statements criticizing the complaint as a large misunderstanding of the Pledge itself. For example, FPF Executive Director Jules Polonetsky issued the following statement in response to EFF’s allegations, “We have reviewed the EFF complaint but do not believe it has merit.” Similarly, Mark MacCarthy? , Senior Vice President at SIIA, noted that the EFF complaint against Google contains important misunderstandings about the Pledge including:

1. The complaint alleges that Google violated the Pledge because it collected information about students who are using general purpose services; however, the Pledge only applies to applications, services, or web sites “designed and marketed for use in U.S. elementary and secondary educational institutions.”
2. The complaint alleges that Google violated the Pledge by collecting personal information such as browser histories and bookmarks; however, Google collects this information at the direction of the school as a part of a student’s educational experience (“educational/school purposes” explicitly permitted in the Pledge).
3. The complaint alleges that Google violated the Pledge by collecting and using aggregated and anonymized information; however, the Pledge applies only to personal information that identifies particular students and is maintained at the individual level.

Thus, the problem with EFF’s complaint(at least a part of the problem) is that EFF applies the prohibitions agreed to under the Pledge too broadly. In the complaint, EFF asked the FTC to “require Google to destroy all student data it has collected and used in violation of the Student Privacy Pledge and to prevent the company from collecting such data in the future.” EFF attorney Nate Cardozo, who wrote the complaint, told the Wall Street Journal that “[t]he best way for Google to comply would be to simply not collect any data on the activities of logged-in Google [Apps for] Education users.” While privacy advocates like Cardozo would surely prefer that Google do just that, under the Pledge regime companies have no real incentive to give in to Cardozo’s demands—Google can, and likely will, shrug off Cardozo’s demands as a lofty “suggestion.”

2. Limited enforcement

The Pledge does not include a specific enforcement provision “nor is there an enforcement regime behind the effort that monitors compliance, and takes disciplinary action or informs the FTC when a company is not compliant.” Despite any specific enforcement provision, in the United States a company’s security and other commitments made under the Pledge are legally enforceable by the FTC and State Attorneys General under Section 5 of the Consumer Protection Act for “unfair or deceptive acts.” However, even if noncompliance triggers FTC enforcement under Section 5, the FTC’s enforcement powers are limited. For example, in 2012, Google paid $22.5 million to settle an FTC complaint that it violated an advertising industry pledge by misrepresenting the way it tracked Web users. While the FTC’s $22.5 million fine was record-setting for the FTC (at the time, it was largest-ever fine issued by the FTC against a company), it was arguably only a slap on the wrist for Google [the agency’s fine represented about 0% of Google’s income in 2012].

Does the Pledge do More Harm than Good?

In light of the realization that the Pledge applies to only a narrow set of activities in limited contexts and that within that narrow scope, the FTC does not have sufficient teeth to deter companies from noncompliance with the Student Privacy Pledge, I circle back to my initial perspective and ask does the Pledge do any good?

---

You are entitled to restrict access to your paper if you want to. But we all derive immense benefit from reading one another's work, and I hope you won't feel the need unless the subject matter is personal and its disclosure would be harmful or undesirable. To restrict access to your paper simply delete the "#" character on the next two lines:

• #Set ALLOWTOPICVIEW = TWikiAdminGroup, AlexandraRosen
• #Set DENYTOPICVIEW = TWikiGuest

Note: TWiki has strict formatting rules for preference declarations. Make sure you preserve the three spaces, asterisk, and extra space at the beginning of these lines. If you wish to give access to any other users simply add them to the comma separated ALLOWTOPICVIEW list.