Professional Documents
Culture Documents
How Does Google Use Student Data?
How Does Google Use Student Data?
How Does Google Use Student Data?
TheHonorableAlFranken
UnitedStatesSenate
309HartSenateOfficeBuilding
Washington,DC20510
DearSenatorFranken:
ThankyouforyourletterofJanuary13,2016,concerningGoogleAppsforEducationand
Chromebooks.Wehavealwaysbeenfirmlycommittedtokeepingstudentdataprivateand
secure.WeappreciatetheopportunitytoexplainourproductsandthestepsGoogletakesto
protectourusersinformation.
EnsuringeducatorsandstudentscanlearnandworktogetherfitsnaturallywithGoogles
missiontoorganizetheworldsinformationandmakeituniversallyaccessibleanduseful.
Googlebelievesthattechnologylevelstheplayingfieldandenablesanyonetolearn,anywhere.
Thatswhywebuildeasytousesolutionsthatgiveteachersandadministratorsmoretimeto
educateandstudentsmoretimetolearn.
OneexampleisGoogleAppsforEducation(GAFE),afreeandsecuresetofproductivitytools.
SchoolssetupandmakeavailabletostudentstheGAFEcoreservices,suchasGmail,Google
Calendar,Groups,andDrive,whichincludesDocs(wordprocessing),Sheets(spreadsheets)
andSlides(presentations).
WithGAFE,studentscancollaborateonprojectsinrealtimefromacrosstheroomoracrossthe
world.Theycanfindandinteractwiththeinformationtheyneed,becomecreatorsandmore
engagedandactivelearnersand,ultimately,becomebetterpreparedfortwentyfirstcentury
careers.Forteachers,distributingandcollectinghomeworkandprovidingstudentsoneonone
feedbackbecomeeasierandmoreeffective.
GAFEservicesmaybeusedonanydevicewithamodernwebbrowser.Manyschoolschoose
touseChromebooks,whichareaffordableanddurablelaptopsthatcanbeusedtoaccess
GAFEservicesandtherestoftheInternet,undertheschoolsmanagement.Chromebooks,
like,GAFE,haveworldclasssecurity,whichiscriticaltoensuringprivacyofstudentspersonal
data.
AnotherexampleisChromeSync,afeaturepopularwithbothChromebooksandtheChrome
browserthatenablesGoogleAccountholderstologintoanyChromebookorChromebrowser
andfindalltheirapps,extensions,bookmarks,andfrequentlyvisitedsites.Eachcommunityand
schooldistrictisdifferent.TechnologylikeChromeSyncgivesschoolstheflexibilitytheyneedto
developasystemthatworksbestfortheircommunity,whetherthismeansonedeviceper
studentorshareddevicesacrossclasses.Forstudents,thismeansthattheycangettowork,
rightawayevenwhenaschooldoesntprovideadeviceforeachstudent,ChromeSync
makesaChromebookinstantlyfeellikethestudent'sown.
Digitalliteracyisanimportantcomponentofensuringtheprivacyandsecurityofstudents
personalinformation.Soweworkwithexpertstodevelopprogramssuchasthe
Online
SafetyRoadshow
thatteachstudentswhattheycandotostaysafeandsecureonline.
Belowareresponsestoyourspecificquestions.
1. WhenastudentissignedintotheirGAFEaccountbutisnotusingoneofthe
GAFEservices,whatkindofdatadoesGooglecollectonanindividualstudent?
Schooladministratorsdeterminewhichservicesstudentscanaccessanduse.TheGAFEcore
servicesareCalendar,Classroom,Contacts,Drive,Docs,Gmail,Forms,Groups,Sheets,Sites,
Slides,Talk/HangoutsandVault.AdministratorscontrolaccesstotheseGAFEcoreservicesas
wellasservicesoutsideoftheGAFEcoreservices.Schoolsmaypermitstudentstoaccess
additionalGoogleservices(likeYouTube,Maps,andothers)beyondtheGAFEcoreservicesif
theyobtaintheconsentofaparentforminorstudents,andiftheuseisforeducational
purposes.
BeforeweaddressthoseadditionalGoogleservices,wewouldliketoexplainGoogles
practiceswithrespecttotheGAFEcoreservices.InGAFE,Googlecollectsbothpersonaldata,
likeastudentsnameandemailaddress,aswellasotherinformationabouthowtheservices
areused,suchasthetypeofdeviceandtheIPaddressoftheusersnetwork.HowGoogle
collectsandusesinformationwithGAFEaccountsisdescribedinthe
GoogleAppsfor
EducationPrivacyNotice
.GooglesuseofinformationinGAFEcoreservicesislimitedbythe
GoogleAppsforEducationagreement
andthe
DataProcessingAmendment
(whichschools
canacceptintheGAFEAdminconsole).GoogleusesstudentspersonaldatainGAFEcore
servicesonlytoprovidetheseservices,sostudentscandothingslikecommunicateusingemail
andcollaborateonassignmentsusingGoogleDocs.TherearenoadsinGAFEcoreservices,
andstudentdataintheseservicesisnotusedforadvertisingpurposes.
IfaschoolpermitsaccesstooneofGooglesadditionalservicesoutsidetheGAFEcore
services,suchasGoogleMaps,Googlecollectstheinformationdescribedinour
PrivacyPolicy
.
TheinformationwecollectintheseservicesissimilartothatcollectedfromanyotherGoogle
user,andincludes:
Informationtheusergivesus,includingpersonalinformationlikename,emailaddress,
ortelephonenumber.
Deviceinformation(suchasyourhardwaremodel,operatingsystemversion,unique
deviceidentifiers,andmobilenetworkinformationincludingphonenumber).
Loginformation,includinguserentrieslikemapsqueries,thenetworksIPaddress,and
deviceeventinformationsuchascrashes,systemactivity,hardwaresettings,browser
type,browserlanguage,thedateandtimeoftherequestandreferralURL.
IfanyofthisdataisassociatedwithastudentsGAFEaccountwhichmayhappenwhena
studentisloggedintotheirGAFEaccountweconsiderittobethestudentspersonal
information.Aswepromiseinthe
GAFEPrivacyNotice
,noK12studentpersonalinformationis
usedtotargetads,andinsomeservicesweshownoadsatall.InGoogleSearch,forexample,
weshownoadswhenK12studentsareloggedintotheirGAFEaccounts.
Asdescribedinmoredetailinresponsetoquestiontwo,below,userswhohaveChromeSync
enabled(whetheronaChromebookorusingtheChromebrowser)willhaveadditional
informationabouttheirbrowsersettingsstoredintheirGAFEAccount,includingbrowsing
history,anysavedapps,extensions,bookmarks,andpasswords.Inaddition,Chromebooks
collectanonymoususagestatisticsandcrashreportsaboutusersinteractionswithChrome
features.Thesestatisticsandcrashreportsarecollectedanonymously,meaningthatwedonot
associatethemwithyourGoogleAccountwhenwecollectthem.
2. WhenastudentisusingaChromebookbutisnotusingoneoftheGAFEservices,
whatkindofdatadoesGooglecollectonanindividualstudent?
ThereisverylittledifferencebetweenthedatacollectedfromastudentusingGoogleservices
onaChromebookversususingaGoogleserviceonanyotherdevice,whichwedescribe
above.Bydefault,Chromebooksanonymouslycollectusagestatisticsandcrashreports,which
involveinformationabouttheusageofChromefeatures.Otherthanthat,thefactthatyouare
accessingaGoogleservice,suchasGmailorGoogleSearch,withaChromebookdoesnot
causeGoogletoreceiveanyadditionalordifferentinformationaboutyou.Notethatschool
administratorsmayrestrictthewebsitesandservicesaccessibleviatheChromebook,whereas
otherdevicesmaynotbesolimited.
UserswhohaveChromeSyncenabled(whetheronaChromebookorusingtheChrome
browser)willhaveadditionalinformationabouttheirbrowsersettingsstoredintheirGoogle
Account,includingbrowsinghistory,anysavedapps,extensions,bookmarks,andpasswords.
Seeour
HelpCentertolearnmoreaboutChromeSync
.Ifanyofthisdataisassociatedwitha
studentsGAFEaccountwhichisthecasewhenastudentisloggedintoaChromebookwith
ChromeSyncenabledwiththeirGAFEaccountweconsiderthisdatatobethestudents
personalinformationanddonotuseittotargetads.
3. IfGoogledoescollectanyindividualizeddataonastudent,suchasbrowsing
informationorviewinghabits,whenastudentisusingaChromebookorislogged
intotheirGAFEaccountbutisnotusingoneofGAFEservices,pleaseaddress
thefollowingquestions:
a. ForwhatpurposesdoesGooglecollectthisinformation?
InGAFEcoreservices,studentspersonaldataisusedonlytoprovidetheservicesthemselves.
InGooglesadditionalservices,Googlecollectsinformationforthepurposesdescribedinthe
GAFEPrivacyNotice
andour
PrivacyPolicy
,suchasproviding,maintaining,anddeveloping
ourservices,andprotectingusersfromharm.Wespecificallypromiseinour
GAFEPrivacy
Notice
thatK12studentspersonalinformationisnotusedtotargetads.
b. IsitnecessarytocollectallofthisinformationfortheprovisionofGAFE
servicesortodeliverothervaluablefeaturesthatmayberelevantfor
educationalpurposes?
PersonalinformationcollectedinGAFEcoreservicesisusedsolelytoprovidethoseservices.
SchoolsareresponsibleforcompliancewiththeChildren'sOnlinePrivacyProtectionActof
1998,includingobtainingparentalconsentforcollectionofstudents'personalinformationin
GAFEcoreservices.Schooladministratorschoosewhich,ifany,additionalGoogleservices
outsideoftheGAFEcoreservicestoallowtheirstudentstoaccess.ManyofthesenonGAFE
services,suchasSearch,Earth,MapsandYouTube,havefunctionswhichschoolsfind
educationallyrelevantandvaluable.Thoseservicesmayuseinformationsuchasbrowsingor
viewinginformationtoimproveservicesandmakethemmorerelevantforusers,andforother
purposespermittedbytheGoogle
PrivacyPolicy
.Ifanadministratorallowsaccesstoanyof
thesenonGAFEservices,theymaydosoonlyforeducationalpurposesandwithparental
consentforanystudentsunder18.
c. HasGoogleeverusedthiskindofdatatotargetadstostudentsinGoogle
services,eitherintheGAFEservicesorotherGoogleservices,suchas
GoogleSearch,GoogleNews,GoogleBooks,GoogleMaps,Blogger,or
YouTube?
SinceGAFEwaslaunched,adsintheGAFEcoreserviceshavealwaysbeenoffbydefault.In
2014,we
tooktheadditionalstep
ofremovingtheenable/disabletoggleforadsintheGAFE
Adminconsole.ThischangeensuredthatadswouldalwaysremainoffinGAFEcoreservices
andthatusersdataintheseserviceswouldnotbeusedforadvertisingpurposesa
commitmentthatisreflectedinour
AppsforEducationagreement
.
ManyofouradditionalservicesoutsideoftheGAFEcoreservicesnormallyshowtargetedads
(whichishowweofferthemforfree).WehaveworkedtorestrictuseofK12studentpersonal
information:our
GAFEPrivacyNotice
promisesnottouseanyK12studentpersonal
informationtotargetads,includinginservicesoutsidetheGAFEcoreservices.Insome
products,likeSearchandMaps,wehaveremovedtheadsaltogetherforsignedinK12GAFE
users,whileotherservicesmayshowonlycontextualadstotheseusers.Contextualadsare
selectedwithoutreferencetoanyuserprofileorotherpersonalinformationabouttheuser.
d. HasGoogleeverusedthiskindofdataforitsownbusinesspurposes,
unrelatedtotheprovisionofGoogleseducationalofferings?
GooglemayusethedatafromadditionalservicesoutsideoftheGAFEcoreservicesforthe
purposesdescribedinour
PrivacyPolicy
,whichinclude,forexample,productimprovementand
productdevelopment.WemakefurthercommitmentsforGAFEusersinour
GAFEPrivacy
Notice
,includingacommitmentnottousepersonalinformationfromK12GAFEuserstotarget
ads.Inotherrespects,theadditionalservicesoutsideoftheGAFEcoreservicesworkfor
studentsjustastheydoforanyotheruser.Werequireschooladministratorstoobtainparents
consentforminorstudentsforourdatacollectionanduseiftheyenabletheseadditional
servicesforstudents.PersonalinformationcollectedincoreGAFEservicesisusedsolelyto
providethoseservices.
e. Isitpossibletomakethisdatacollectionoptin?
GoogleprovidescontrolstoadministratorsoverGAFEcoreservicesandtheadditionalservices
intheAdminconsoletoassisttheminrestrictingstudentaccesstothoseservicesiftheywishto
doso.Furthermore,schoolsmustobtainparentalconsentforminorstudentstoGoogles
collectionofthedatawehavedescribedandtotheuseofanyadditionalservicesbeyondthe
GAFEcoreservices.InadditiontoadministratorcontrolsoverservicesandsettingsintheGAFE
Adminconsole,eachstudentsaccountalsohasaccessto
controlsofferedtoeveryGoogle
account
(someofwhichcanalsobecontrolledthroughtheAdminconsole),
andthesecanbe
usedtoreflectschoolpoliciesandparentalconsents
.
f. DoesGooglesharethisinformationwithadditionalparties?
WedontsellGAFEdataoranyofour
userspersonaldata
.Wedonotsharepersonal
informationwiththirdpartiesexceptinthefewexceptionalcircumstancesdescribedinthe
GoogleAppsforEducationagreement
andour
PrivacyPolicy
,suchaswhenschoolsaskusto
shareitorwhenwearerequiredtodosobylaw.
4. Googlehasindicatedthatitcompilesdataaggregatedfromstudentusersof
ChromeSync,anonymizesthedata,andusesittoimproveitsservices.Canyou
expandonhowtheaggregatedinformationistreated?Forexample,doesthis
includesharingtheaggregateddatawiththirdpartiesforresearchpurposesor
otherwise?
Aswementionedinour
blogpost
,wecompileaggregatedandanonymizeddatafromallusers
ofChromeSyncwhosynctheirbrowsinghistoryandhavenotencryptedtheirChromeSync
datawithasyncpassphrase.Beforeusingthisdatawecompletelyremoveidentifying
informationaboutindividualusers.Inmostcases,thisisaccomplishedbyaggregatingthedata
andreducingtheinformationtoacountforexample,wemightusethefactthatawebpage
hasbeenseenbythousandsofusers.Thereisnowaytopersonallyidentifyanyuserbasedon
thiscount.This
aggregated,anonymizedChromeSyncdataisusedtoimproveGoogle's
products,primarilywebsearch,byhelpingtodetectmobilefriendlypages,pageswhichhave
stoppedservingcontent,anddownloadsofmalware.
Unlessrequiredbyavalidlaw
enforcementrequest,wedonotshareaggregatedChromeSyncdatawithanythirdparties,for
researchpurposesorotherwise.
5. CanyoudescribeGooglesrelationshipwithschooldistrictsandadministrators
thatchoosetouseGoogleforEducationproductsandservices?Apartfrom
publiclyavailableprivacypolicies,doesGoogleofferanyexplanationtoparents,
teachers,andeducationofficialsabouthowstudentinformationiscollectedand
used?
Googleoffersa
privacyandsecuritysite
,includingdetailedFAQs,toschoolsandparents
consideringorusingGAFEservices.Itcontainsmuchoftheinformationdescribedinthisletter,
includinginformationabouttheStudentPrivacyPledge,Chromebooks,anduseofadditional
GoogleservicesoutsideoftheGAFEcoreservices.
Our
GAFEPrivacyNotice
reflectsourcommitmenttodisabletargetedadsbasedonpersonal
informationinallGoogleservicesforK12students.
Weprovidea
HelpCenter
andmessage
boardwhereadministratorscanfindhelp.ThroughtheAdminconsole,weprovide24/7phone
andemailsupport.
Weenableeducatorstoconnectwitheachotherbecausewefindthatpeersarethemost
helpfulresources.
Forteachers,thereareGoogleEducatorGroupsrunforeducatorsby
educatorstosharepracticesinpersonoronline.Theycancomparenotesabouthowtheyuse
tools,whichtoolstheydoanddon'tallowforcertaingradelevelsofstudents,andother
importantinformation.Foralleducatorsweofferthe
GoogleforEducationTrainingCenter
,aset
ofonlineresourceswecreatedwitheducatorsforeducators.
We
reachouttoschoolleaders,educators,andparentsthroughchannelslikeourGooglefor
Educationnewsletter,GoogleforEducation
Twitter
and
G+
accounts,andthe
Googlefor
Educationblog
.Weregularlymeetwithorganizationsthatrepresentstateadministratorsand
schoolleaders,presentatandparticipateinconferences,andhostwebinarsthatinclude
informationaboutprivacyandsecurity.
6. Canyoudescribeallthecontextsandwaysinwhichbothschooladministrators
andparentsofstudentsusingGoogleforEducationproductsandserviceshave
controloverwhatdataisbeingcollectedandhowthedataarebeingused?
Googleseducationalproductsaredesignedtobedeployedandmanagedbyschool
administratorsandteachers,sotheyhavecontroloverwhetherandhowGoogleservicesare
availabletostudents.Schoolsalsoactonourbehalftoobtainparentalconsentforminor
studentstouseGoogleservicesoutsidetheGAFEcoreservices,andtothecollectionoruseof
datainvolvedinthoseadditionalservices.Asnotedabove,schoolsareresponsiblefor
compliancewiththeChildren'sOnlinePrivacyProtectionActof1998,includingobtaining
parentalconsentforcollectionofstudents'personalinformationinGAFEcoreservices.
Administratorshavefinegrainedcontrolovermanyoftheservicestheydeploy.Forexample,a
schooladministratormaychoosetolimittheaccessofmiddleschoolstudentstoGoogleDrive
andDocs,butallowhighschoolstudentstoalsoaccessGmail.Aschooladministratormayalso
choosetoallowstudentstoexchangeemailonlywithrecipientswithinthedistrict,theschool,or
evenjusttheirclass.SchoolscanalsoblockstudentaccesstoGoogleservicesoutsideofthe
GAFEcoreservices,likeYouTubeandBlogger.Inadditiontoadministratorcontrolsover
servicesandsettingsintheGAFEAdminconsole,eachstudentsaccountalsohasaccessto
controlsofferedtoeveryGoogleaccount
andthesecanbeusedtoreflectschoolpoliciesand
parentalconsents
.
ForthoseschoolsthatuseChromebooks,ChromeSyncisonbydefault(inaccordancewith
feedbackfromschoolsthathavehighlightedthisasacrucialfeature),butanadministratorcan
disableitforallstudents,orjustforsomegroups.Our
HelpCenter
describeshowtoturnoff
servicesintheAdminconsole.IndividualstudentsalsohavecontroloverChromeSync.
Studentscan
choosewhattosync
insettings.Usersalsocanelecttoseta
syncpassphrase
.
Whenyousetasyncpassphrase,yourdataisstillstoredinyourGoogleaccount,butitis
encryptedwithyourpassphrasesoGooglecantreadit.Regardlessofwhetherstudentsuse
thisfeature,however,GoogleusesthepersonaldatastoredinChromeSyncdatapurelyto
providefeaturesinChromeforthatperson,forexampleallowingstudentstosecurelyaccess
theirownbrowsingdataandsettingsacrossdevices.
WeappreciatethechancetoexplainGooglesprivacyandsecuritypracticesofGoogleAppsfor
EducationandChromebooks.Pleaseletusknowifwecanaddressanyotherquestionsyou
mighthaveorbearesourcetoyouonoursharedgoalsofimprovingstudentperformanceand
protectingstudentsprivacyandsecurity.
Sincerely,
SusanMolinari
VicePresident,PublicPolicyandGovernmentRelations,Americas
Google