Two Swedish researchers have torn into Google's free school service, accusing the online giant of purposefully misleading users in order to continue profiting from the sale of children's data.
Maria Lindh and Jan Nolin from the University of Borås have published a research paper [note: paid access] that digs into the policies around the Google Apps for Education (GAFE) service, and concluded that it has gone to some lengths to "conceal" the business model from school administrators.
By using a range of rhetorical devices and misleading definitions, the company is able to advertise that GAFE will not include any ads and "your data is yours," while at the same time selling the information it accumulates to advertisers for significant profit, they conclude.
"Educators and pupils become reconfigured as targets for data mining, tracking and measurement," the paper argues.
One of the key distinctions comes in Google's own fluid definitions of "data" and "information," which it uses to make bold claims while actually doing what many perceive is the opposite of what they have understood. The other key term is "processing."
"Google processes your data to fulfill our contractual obligation to deliver our services," it states, adding: "Google's customers own their data, not Google."
It goes on: "The data that companies, schools and students put into our systems is theirs. Google does not sell your data to third parties."
Which all sounds very convincing until you start reading Google's "Data Processing Amendment" and other official documents relating to the GAFE service. Lindh and Nolin state they were struck by how the company carefully phrased them to hide true intent.
They note that the company is under a legal obligation to say that it commercially exploits its "constantly expanding archive" – ie, all the information it accumulates from people using the service – but that it goes to some lengths to hide the reality of the situation.
"Several segments of the policy texts state clearly, or so it seems, that the archive is not exploited, ie, we do not sell your data," says the paper. But thanks to how Google chooses to define "data," that is not true. "Central terms, such as processing user data or content, are not explained," they note. And important information is hidden or left out.
The sale of data is frequently framed as something that is done to improve services or user experience, and its commercial value is not touched upon.
By contrast, the real business model is "belittled or framed as a minor aspect of what Google does." And when the company provides "examples" of what its policies mean in reality, it provides ones that don't cover the less savory aspects of what actually happens. "Google's systematic approach of giving one example connected to each claim is therefore misleading in more than one way," the paper notes.
They conclude: "It is obvious that Google talks in different voices, deliberately wanting to make their business model less obvious for users, who mostly do not look deeply into Google's policies in any case."
The authors paint a distinction between Google's back-end and front-end models: where the front end is free – services for schools – and the back-end is where it makes its money: "information packaged for profit."
GAFE itself is a cloud-based service that bundles several Google services, including Google Classroom, Gmail, Google Drive/Calendar/Docs/Presentation/Sites and others, and provides them for free to schools.
Google says it has 50 million students, teachers and administrators using GAFE, and price is a major reason why.
"We came up with a suggestion that instantaneously would lower costs by one million," one former CEO of a Swedish education establishment told the researchers, despite having reservations about its legality, security, sales of data and tracking by Google. "Yes, but then what? The next item on the agenda! These are decisions that make themselves."
But, the authors argue, Google is able to say it does not sell its users' "data" – but it is not the day-to-day data it profits from, but rather the longer-term "monitoring of behavior" where it creates "algorithmic identities of individual users" by combining collected and personal information.
Those "algorithmic identities" then become of enormous value and are used commercially but not "sold" to third parties – allowing for the seemingly clear language about what happens to students' data.
With the soothing language about Google not selling the information, the teachers and administrators that the authors talked to were more than happy to take on the benefits that comes from Google's services.
Not only is the service free, but it is well-managed and run (no more constantly dealing with a small and impossible IT department), and brings novel advantages.
Several teachers noted, for example, that they were able to watch the progress of their students' work. This not only helped clamp down on bad practices – such as the pasting of an entire paragraph (plagiarism?) or poor planning (three weeks to do the assignment and the document is created the night before) – but it also helps teachers see their students' thought processes and so both better understand and assist them in their learning, and save the teachers from the dreaded arrival of a stack of finished essays on the final day.
The question, though, is whether these advantages outweigh the fact that one company is able to build up commercially valuable information on students, which Google can most likely continue over when they stop using the school system because of their multiple tie-ins with other Google services.
Where are the regulators in this case? Trying their best. The Swedish Data Inspection Board brought an injunction against the first municipality to implement GAFE, Salem, in 2011 arguing that its pupils' privacy was under threat by the users of Google software.
Four years later, and the "shortcomings in the agreement with Google" had finally been resolved. In March last year it said: "We can confirm that the flaws in the agreement that we have pointed out before have now been remedied."
But, it also noted that it was now reviewing the agreement to see if there were any more issues. Critically, it noted that it "has not yet examined the processing of sensitive personal data in a cloud service."
In other words, the topic of this entire paper in which it concluded Google was purposefully misleading people over what it was actually doing with their personal data. ®