The Student Privacy Pledge: political facade or privacy protection?

The Pledge is not a substitute for student-privacy legislation.

-- By AlexandraRosen - 09 Dec 2015

Introduction

Since January 2015, over 200+ companies—including Google, Apple Inc. and Microsoft Corp.—signed what is referred to as the Student Privacy Pledge (the "Pledge"). The legally binding pledge created by the Future of Privacy Forum (FPF) and Software and Information Industry Association (SIIA) is a “vow to collect, store or use student data only for educational purposes.” While on its face the Pledge seems like a positive step towards stricter consumer privacy protection on the Web, the Pledge’s impact on companies' collection and use of personal information and activity should not be overstated.

In the following paper, I will argue that the existence and wide support lauding the Pledge as an effective mechanism for protecting student privacy on the Web creates a false sense that security within the status quo and in turn, slows real progress toward more effective privacy protections.

Recent action to enforce the terms of the Pledge force me to re-examine my argument

Given my strong skepticism of the Pledge’s ability to effect company behavior, I was surprised to see that on December 1, 2015, the Electronic Frontier Foundation (EFF) filed a complaint with the FTC against Google's Apps for Education (GAFE) alleging that it violates the company’s pledge to limit its use of student data. In light of this complaint, I consider whether my critique of the Pledge is completely misplaced.

Am I Wrong? Or is the Pledge an Empty Promise?

A closer look at student privacy protection under the Pledge

1. Limited scope

The Pledge does not impose a blanket prohibition on companies' collection and use of student information. Instead, the Pledge obligates signatories to “be transparent about collection and use of data” in conducting certain activity in particular context. The scope of activities covered by the Pledge is explicitly limited not to include “the use of student information for purposes of adaptive learning or customized education.”

Apparently, EFF’s complaint against Google incorrectly interprets the Pledge to apply to various GAFE activities. Shortly after the complaint was filed, both FPF and SIIA issued statements criticizing the complaint as a large misunderstanding of the Pledge itself. For example, FPF Exec Polonetsky issued the following statement in response to EFF’s allegations, “We have reviewed the EFF complaint but do not believe it has merit.” Similarly, SIIA's MacCarthy? noted that the EFF complaint against Google contains important misunderstandings about the Pledge including:

The complaint alleges that Google violated the Pledge:

1. because it collected information about students who are using general purpose services; however, the Pledge only applies to applications, services, or web sites “designed and marketed for use in U.S. K-12 institutions.”
2. by collecting personal information such as browser histories and bookmarks; however, Google collects this information at the direction of the school as a part of a student’s educational experience.
3. by collecting and using aggregated and anonymized information; however, the Pledge applies only to personal information that identifies particular students.

Thus, the problem (in part) with EFF’s complaint is that EFF applies the prohibitions agreed to under the Pledge too broadly. In the complaint, EFF asked the FTC to “require Google to destroy all student data it has collected and used in violation of the Pledge and to prevent the company from collecting such data in the future.” EFF attorney Nate Cardozo, who wrote the complaint, told the WSJ that “[t]he best way for Google to comply would be to simply not collect any data on the activities of logged-in [GAFE] users.” While privacy advocates like Cardozo would surely prefer that Google do just that, under the Pledge regime companies have no real incentive to give in to Cardozo’s demands—Google can, and likely will, shrug off Cardozo’s demands as a lofty “suggestion.”

2. Limited enforcement

The Pledge does not include a specific enforcement provision “nor is there an enforcement regime behind the effort that monitors compliance, and takes disciplinary action or informs the FTC when a company is not compliant.” Despite any specific enforcement provision, in the U.S. a company’s security and other commitments made under the Pledge are legally enforceable by the FTC and State AGs under Section 5 of the Consumer Protection Act for “unfair or deceptive acts.” However, even if noncompliance triggers FTC enforcement under Section 5, the FTC’s enforcement powers are limited. For example, in 2012, Google paid $22.5 million to settle an FTC complaint that it violated an advertising industry pledge by misrepresenting the way it tracked Web users. While the FTC’s $22.5 million fine was record-setting for the FTC, it was arguably only a slap on the wrist for Google [the agency’s fine represented about 0% of Google’s income in 2012].

Does the Pledge do More Harm than Good?

In light of the realization that the Pledge applies to only a narrow set of activities in limited contexts and that within that narrow scope, the FTC does not have sufficient teeth to deter companies from noncompliance with the Pledge, I circle back to my initial perspective and ask does the Pledge do any good?

I think it is important to consider the context in which the Pledge was passed and widely adopted. The initiative came at a time when state legislatures were rushing to enact restrictions on data collection and data mining. Supporters of education technology, like SIIA who had “long resisted efforts to strengthen federal privacy law,” feared that legislative proposals would hurt their business models and wrote the Pledge hoping to avoid stricter proposals from being passed. Therefore, the impetus for the Pledge was to limit future restraints on companies’ data collection.

Despite any perverse incentives that led to the creation of the regime, if the Pledge improved privacy for students, then the initial motives are irrelevant. However, the existence and the propaganda-like support for the Pledge as sufficient protection makes the likelihood of any real rules passing slim, at best. The 200+ signatories are free to continue collecting and mining student data largely without limit (except for the very narrow constraints imposed by the Pledge) and without privacy advocates and politicians constantly looking over their shoulder and questioning their every move. The Pledge is a perfect and carefully crafted distraction from public scrutiny.

---

You are entitled to restrict access to your paper if you want to. But we all derive immense benefit from reading one another's work, and I hope you won't feel the need unless the subject matter is personal and its disclosure would be harmful or undesirable. To restrict access to your paper simply delete the "#" character on the next two lines:

• #Set ALLOWTOPICVIEW = TWikiAdminGroup, AlexandraRosen
• #Set DENYTOPICVIEW = TWikiGuest

Note: TWiki has strict formatting rules for preference declarations. Make sure you preserve the three spaces, asterisk, and extra space at the beginning of these lines. If you wish to give access to any other users simply add them to the comma separated ALLOWTOPICVIEW list.