A U.S. Federal Court dismissed the New Mexico Attorney General’s lawsuit against Google that alleged the technology company failed to obtain proper parental consent to collect personal information from students who use its educational products.
The Court ruled that Google’s practice of relying on schools as an intermediary or agent to obtain parental consent is consistent with the Children’s Online Privacy Protection Act (COPPA), the federal law that protects children’s personal data. Technology companies can use schools to give notice and to obtain parental consent regardless of whether that collection is for commercial purposes, according to the Court.
“Ultimately, the law only requires ‘any reasonable effort’ in providing notice to and obtaining consent from parents and, given that schools can provide notice in the scenario when personal information is collected for the use and benefit of the school, it seems persuasive that schools can obtain consent as an intermediary for the scenario when information is also collected by the operator for other commercial purpose,” U.S. Federal Judge Nancy D. Freudenthal wrote in an 18-page opinion.
The Court also ruled that “COPPA contains no requirement that notice be drafted for the understanding of children under 13.”
The lawsuit focuses on a Google product called G Suite for Education, which offers students access to email, calendar, storage, online documents, and additional services. New Mexico’s Attorney General argued Google’s collection of children’s data is mostly done for commercial purposes.
Google argued that schools that use its suite of core educational services are informed about the company’s collection, use, and disclosure of personal information, and that Google can presume that schools have obtained parental consent. Google’s agreements with schools also explicitly states that schools must obtain parental consent before offering additional Google services, like YouTube, Google Maps, and Blogger.
The Federal Trade Commission has issued guidance that technology companies can rely on a school as an “agent” to obtain consent if technology companies fully disclose their practices and if the use and collection happens solely for the benefit of the school, and no other commercial purpose.
The New Mexico Attorney General argued that the law, therefore, requires Google to obtain direct consent from parents if the technology company used that data for a commercial purpose. The Court disagreed.
The Court noted that the FTC also allows schools to act as “intermediaries” between a technology company and parent. The Court noted that “simply because the FTC has provided a further explanation for the scenario of schools as agents, that does not necessarily mean the FTC prohibits operators from contracting with schools as intermediaries in providing notice to, and obtaining consent from, parents for services which result in collecting information from students for commercial purposes.”
The Court gave New Mexico more time to amend its complaint to allege facts that might save the lawsuit, including “that Google fails to provide notice to schools,” that “Google fails to obtain consent from schools,” or that “schools fail to obtain consent from parents.”
The New Mexico Attorney General has filed a number of COPPA lawsuits against Google, including a 2018 suit that was partially dismissed in May.
