Minor plaintiffs H.K. and J.C., through their father Clinton Farwell, have filed a class action complaint against Google for violating Illinois’ Biometric Information Privacy Act (BIPA), California’s Unfair Competition Law (UCL) and the Children’s Online Privacy Protection Act (COPPA). The complaint was filed in the California Northern District Court. Plaintiffs are represented by Bursor & Fisher.
The plaintiffs allege that Google is illegally “collecting, storing, and using their and other similarly situated childrens’ biometric identifiers and biometric information (referred to collectively as ‘biometrics’), as well as numerous other forms of personally identifying information, without them [sic] requisite consent of their legal guardians – in direct violation of both BIPA and COPPA.”
COPPA is meant to protect the privacy of children, especially from collecting their data online. The law has sought to increase parent and guardian involvement for their children’s activities online in order to protect the personal information of children. COPPA requires that “websites and online services fully and clearly disclose their data collection, use, and disclosure practices, and obtain ‘verifiable parental consent’ before collecting, using, or disclosing personal information from children under 13.” Parents can review the collected information.
BIPA is designed to protect individuals’ biometrics because “[b]iometrics are unlike other unique identifiers that are used to access finances or other sensitive information.” It notes that “social security numbers, when compromised, can be changed. Biometrics, however, are biologically unique to the individual; therefore, once compromised, the individual has no recourse, is at heightened risk for identity theft, and is likely to withdraw from biometric-facilitated transactions.” BIPA provides that companies must inform a person in writing that their biometrics will be collected or stored, inform them for how long this information will be collected or stored, obtain a written release to collect this information from the individual and publish written retention schedules and how this information will be permanently destroyed.
Google allegedly violated both BIPA and COPPA by “collecting, storing, and using the personally identifying biometric data of millions of school children throughout the country… most of whom are under the age of 13, without seeking, much less obtaining the requisite informed consent from any of their parents of other legal guardians.” Google accessed this information by providing its ChromeBook laptops to school systems, which is pre-installed with its “G Suite for Education” platform. Children use these devices at school, which allegedly “creates, collects, stores and uses their ‘face templates’ (or ‘scans of face geometry’) and ‘voiceprints’ – highly sensitive and immutable biometric data.” Google also has access to at least the following: “their physical location; the websites they visit; every search term they use in Google’s search engine…the videos they watch on YouTube; personal contact lists; voice recordings; saved passwords; and other behavioral information.” Google collected, stored, and used this information “without providing notice, obtaining informed or verifiable parental consent, or publishing data retention policies.” Plaintiff Farwell has sought to protect the privacy and biometrics of his children, both are currently under 13 years old.
H.K. and J.C. used G Suite for Education at their elementary school; neither child was asked to obtain “verifiable or written parental consent” for Google’s “extraction, collection, storage, and use” of their biometrics, nor was Farwell notified or asked to authorize Google’s action. Google publicly stated it would not collect, store or use this data, noting that “trust is earned through protecting teacher and student privacy,” however, according to the plaintiffs, Google still extracted this information.
The plaintiffs highlighted Google’s alleged actions even after it joined the Student Privacy Pledge. Certain features of the G Suite for Education allegedly violate this pledge and were created after Google signed the Pledge. For example, features that allow students to be recorded on ChromeBook and look at the camera, have allowed Google to create voiceprints and face templates. Google purportedly uses this information to track who is using its devices and platforms. It compares the voice and face to stored voiceprints and face templates, if there is a match, Google will continuously improve these prints and templates.
The plaintiffs have sought to certify class action status for the case, and for a declaration that Google violated BIPA and COPPA. They also seek statutory damages, injunctive and equitable relief, and costs and fees.
Google was previously sued by the state of New Mexico for collecting children’s data through its G Suite for Education.
