STE WILLIAMS

Google is in hot water for scanning millions of students’ email messages and allegedly building “surreptitious” profiles to target advertising at them.

According to Education Week, a “potentially explosive” lawsuit is wending its way through US federal court, now being heard in the US District Court for the Northern District of California.

In court filings, plaintiffs charge that Google data-mines Gmail users – a group that includes students who use the company’s Apps for Education tool suite.

Of course it’s not news that Google reads the emails in its users’ inboxes. The consumer Gmail product is free and pays its way with targeted advertising. The targeting is done by building up profiles of users’ interests based on the content of their email.

The situation is a little muddier when it comes to Apps for Education.

Apps for Education is used by K-12 schools and institutions of higher education throughout the world for free online applications such as email, calendar, word processing, spreadsheet and collaborative document sharing.

Google admitted to Education Week that it automatically “scans and indexes” the email of Apps for Education users even though ads are off by default.

A company spokeswoman said that Google does so in order to provide features such as virus protection, spelling checks, and Gmail’s “priority inbox”. She also said that Google doesn’t process information stored in Google Drive, Docs, or other applications in Apps for Education.

Its automated processes can’t actually be turned off, Google said, even for users who choose not to receive ads.

The company wouldn’t say whether the scans are used to build user profiles, but Bram Bout, the director of Google Apps for Education, said in a statement that the education suite’s ads are turned off by default:

…ads in Gmail are turned off by default for Google Apps for Education and we have no plans to change that in the future.

The thing is, Google’s own court filings in the California suit contradict Bout’s assertion that his employer doesn’t use data mining to target ads to Apps for Education users unless they opt to receive them, according to student-data-privacy experts, Education Week reports.

Khaliah Barnes, a lawyer with the Electronic Privacy Information Center (EPIC), told the education news outlet that the case is troubling:

This should draw the attention of the U.S. Department of Education, the Federal Trade Commission, and state legislatures. … Student privacy is under attack.

Nine plaintiffs, including two students who’ve used the suite, are accusing Google of violating federal and state anti-wiretapping law and hope to turn the case into a class action suit.

The plaintiffs allege that Google violated the Wiretap Act, which prohibits the interception of wire, oral, or electronic communications.

The lawsuit actually rolls up a hodgepodge of seven individual and class action cases brought against Google, including those brought against the company for scanning messages sent from non-Gmail users.

The suit maintains that, because such non-Gmail users who send emails to Gmail users never signed on to Google’s terms of services, they can never have given, in Google’s terms, “implied consent” to scan their email.

The plaintiffs are seeking payouts for millions of Gmail users. The financial damages would amount to $100 per day of each day of violation for every individual who sent or received an email message using Google Apps for Education during a two-year period beginning in May 2011.

The plaintiffs also want Google to be more transparent around its data-mining practices.

Follow @LisaVaas
Follow @NakedSecurity

Image of Google apps licensed under Creative Commons.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/Rj5w3wj2M04/