Over the last several years, student online data privacy bills have been popping up across the country with increasing regularity. This shouldn’t be a surprise as student data is extremely valuable. It’s valuable to corporations (for purposes of simplicity Google is used as an example) because it’s easily monetized and generates enormous profits. It’s valuable to parents because (quite obviously) it belongs to their children. Sometimes the information is personal and sensitive. But just as often it’s as innocuous as a link click, a search term, sites visited, or the websites saved in bookmarks.
As states are quickly passing privacy legislation, Arizona jumped on the bandwagon during the current legislative session. Senate Bill 1314, sponsored by Senator Sylvia Allen (R) LD-6, would amend Title 15, by adding §15-1046, Student data privacy; definitions. It certainly sounds good. And if it sounds good, it must be good. That is, until you read it. Not skim it, not rely on the fact it uses the word “privacy” in the heading, and certainly not because a lobbyist being paid hundreds of dollars per hour says it’s good. Because it’s not good.
In fact, it’s so not good, it’s horrible. Yet only two senators voted against it on third read on February 21, 2017: Senator Steve Montenegro (R) LD-13, and Senator Catherine Miranda (D) LD-27. Senators Montenegro and Miranda, both members of the Senate Education Committee, had also voted no in committee on February 2, 2017.
This bill needs to die quickly and here’s why:
SB1314 prohibits tech companies from creating a student profile for targeted advertising only when a student is using an education product or application developed exclusively for use in schools. For example, Google Apps for Education, which was developed specifically for use by students in a school setting. However, the bill states:
- THIS SECTION DOES NOT:
- APPLY TO GENERAL AUDIENCE INTERNET WEBSITES, GENERAL AUDIENCE ONLINE SERVICES, GENERAL AUDIENCE ONLINE APPLICATIONS OR GENERAL AUDIENCE MOBILE APPLICATIONS, EVEN IF LOGIN CREDENTIALS CREATED FOR AN OPERATOR’S SITE, SERVICE OR APPLICATION MAY BE USED TO ACCESS THOSE GENERAL AUDIENCE SITES, SERVICES OR APPLICATIONS.
In plain English, based on the language of SB1314, everything students do on their school-issued computers, outside of products designed and marketed specifically for schools, can be gathered, used, rented, or sold, for the purposes of targeted advertising.
The following is an example, of what student information Google, et al, can gather about students consistent with the current language in SB1314:
- Searches: web, images, news, blogs, etc., Google is the most popular search engine in the world and 66% of searches in the US are made on Google.
- Clicks on search results: Not only does Google get information on what we search for, it also gets to find out which search results we click on.
- Google Chrome Browser: What is your web browsing behavior? What sites do you visit? What sites do you bookmark? What links do you click? Google Chrome is the standard browser on the millions of Chromebooks provided to schools by Google. “Chrome Sync” is enabled by default, a feature that sends the student users’ entire browsing trail to Google. Chromebooks are configured to send every student’s entire browsing history back to Google, in near real time. That’s true even despite Google’s signature on the “Student Privacy Pledge.”
- Twitter – Google has direct access to all tweets that pass through Twitter in real time after a deal made in 2015. Twitter is more commonly being used as a classroom tool.
- Google Maps
- Google Earth
The long and short of it, if students use Google services, Google will know what they’re searching for, what websites they visit, what news and blog posts they read, and more. There is absolutely nothing in the bill to protect children from having their school computer use tracked by Google, or to stop Google from amassing a profile about students for behavioral targeted advertising. Because, let’s face it. The information Google wants isn’t found on education applications, it’s found on the web browser and SB1314 doesn’t provide protection for a student’s web browser.
SB1314 is heavily backed by Google, et al. Their lobbyists have ensconced themselves in legislative offices to the tune of hundreds of dollars per hour spinning tales of benevolence and concern for student privacy. At a stakeholder’s meeting with Senator Sylvia Allen on February 15, 2017, the “stakeholders” who huddled up close to Senator Allen were those same highly paid lobbyists, none of whom had any idea how technology and data gathering works. The parent advocates; the ones who had read the bill, researched, studied, and understood what it said, were relegated to the far end of the table. They asked for stricter privacy protections. They asked for parental consent provisions which would allow parents to opt-in to data being gathered about their children. It was not an outrageous request.
In the end, parental advocates were ignored. Technology companies don’t want a parental opt-in because their business model wouldn’t work with an opt-in requirement. As the Electronic Frontier Foundation said, “If a business model wouldn’t work if users had to opt in, it deserves to fail.”
Nonetheless, Senator Allen turned her back on parents and let billion-dollar tech companies have their way with kids. What’s in it for tech companies? Money. Information is power. Information is profit. School children generate an awful lot of information. School children are a cash cow and the Arizona Senate just threw them to the wolves.
The bill will now move to the House. At the House Education Committee hearing, representatives need to ask one question: Does SB1314 prevent Google, et al., from amassing a student profile based on browsing history, search terms, page clicks, and links followed, and using that profile for behavioral targeted advertising. It’s a simple yes or no question. If the answer is not an unequivocal yes, SB1314 needs to die until legislators work with the people who understand technology, data, and privacy, and are willing to protect school children; not just a little, but 100 percent!