As the director of The Cartel documentary, one of the things I learned was how poorly the traditional news media cover issues pertaining to children, in that case corruption in public education. Since the film's release, I often get contacted about other aspects of child protection that I would have never imagined -- stories that don't seem to get attention elsewhere. Like this.
What you're about to read hasn't been reported anywhere, and when it was brought to my attention, I could hardly believe it.Â
It turns out that the company sporting the motto "don't be evil" has been asking parents nationwide to disclose their children's personal information, including Social Security Numbers, and recruiting schools to help them do it -- all under the guise of an art contest. It's called, "Doodle-4-Google," a rather catchy, kid-friendly name if I do say so myself. The company is even offering prize money to schools to enlist their help with the promotion. Doesn't it sound like fun? Don't you want your kid to enter too?
What could be wrong with filling out a few entry forms?
A national, commercial database of names and addresses of American children, especially one that includes their dates of birth and SSNs, would be worth many millions to marketing firms and retailers. Â
Of course, data collection is not the reason Google gives for doing this competition. Their FAQ says it's because "We love to encourage and celebrate the creativity of young people..." etc. If that's so, then why on earth would the contest's original Parent Consent Form ask for the child's city of birth, date of birth and last four digits of the child's SSN? Along with complete contact info of the parents.Â
You see what Google knows and many parents don't know is that a person's city of birth and year of birth can be used to make a statistical guess about the first five digits of his/her social security number. Then, if you can somehow obtain those last four SSN digits explicitly -- voila, you've unlocked countless troves of personal information from people who didn't even understand that such a disclosure was happening.
This kind of data can be linked with other databases to target advertising. It's worth many times more than what Google will spend on prizes (each State Finalist gets a T-shirt!).Â
In fairness, we have no evidence that Google will use or sell this information for marketing purposes. For that matter, it's possible they could throw the data away. (Care to guess the odds?) But to be absolutely clear, there's no evidence Google has done anything with this information at all, nefarious or otherwise.
It's also clear that children's social security numbers shouldn't be required for an art contest.
There's a second chapter to this story. Some of the people who tipped me off to it were wondering if the solicitation of children's Social Security Numbers was even legal. And so they sent emails to the Federal Trade Commission, the website InsideGoogle.com and a couple of other places. That email went out on February 17. Twenty-six hours later Google released an updated Parental Consent form without requiring the last four digits of the child's SSN, although the form still inexplicably asks for the child's city of birth.
Meanwhile, the original PDF can still be found on lots of school websites, like this one. In other words, many schools are still distributing the original form, and many parents are no doubt still forking over their kids' social security numbers to Google.
At least the contest "privacy notice" is clear enough: "participation constitutes consent to the storage, use and disclosure of the Entrant's entry details...."Â It should really be called the "privacy waiver."Â
I sent all of this to Google's press office, and after 48 hours, they had offered no response.
So in closing, three simple ideas for you, gentle reader, to take away. (1) City of birth, when coupled with year of birth, can be correlated to social security numbers, so don't give it out just because a box appears on a form. (2) No public contest should ask for any part of a social security number, especially involving kids. (3) For internet searches, have you tried Yahoo! or Bing lately? (They're probably both improved since you last tried them.) You just might find what you're looking for.
------------
Update (2/22/11, 9:38pmET):
Google's Spokesperson just contacted me with the following response:
This year we started accepting doodles from kids even if their school hadn't registered for the contest. To help us keep entries distinct and remove duplicate entries from any particular student, we asked parents for limited information, including the last 4 digits of a student's social security number. We later updated our forms when we recognized that we could sufficiently separate legitimate contest entries while requesting less information. To be clear, these last 4 digits were not entered into our records and will be safely discarded.
As for the city of birth:
The city of birth helps us identify whether contestants are eligible for the contest, as winners must be either U.S. citizens or permanent legal residents of the U.S. The information isn't used for any other purpose.
Couple things:
1.) I'm not much of a conspiracy theorist by disposition, but doesn't "these last 4 digits were not entered into our records and will be safely discarded," sound like a contradiction? (How can they delete something that is not in their records?) Even taking just the first part, we're supposed to believe Google didn't enter demographic data that it had been supplied? Isn't this the same Google that promotes itself as the master of targeted marketing campaigns?
2.) If they simply want to limit the contest to citizens and permanent legal residents, why not ask that question as a "yes/no"? Then, they could ask more specific questions of the winners, right? Instead, Google's wants every child's city of birth upfront? That's really necessary?
Maybe the kids should all just say, "Springfield."
----------
Update (2/23/11, 8:30pmET):
A follow-up clarification came from a Google spokesperson:
To be clear, all data concerning students that is collected by Doodle 4 Google is used only to administer the contest. We received this information on paper because parents who downloaded the original Parent Consent form had to print it, fill it out, and mail it to us. The last 4 digits of the social security number were not entered into our contest records, and as indicated, any forms containing this information will be safely discarded.We have asked for city of birth all 4 years of the contest to date, as it helps us determine eligibility. For example, if the city is not in the U.S., we can flag it for possible future follow-up. The question also gives us a higher degree of confidence at this early stage that an actual parent or guardian is completing the form (it's easier to check 'Yes' than to know an actual city of birth). As indicated previously, this information is not used for any other purpose.
Follow Bob Bowdon on Twitter: www.twitter.com/BobBowdon
Probably you know better than many among us the all pervasive effect of the web. We assume that info we put into the web somehow disappears and no one usually views it. This is a fallacy.
The data collected by Google and the likes is probably sold to/shared with companies/individuals/governments across the world. Sometimes this data is misused by the recipents.
And now we have Google enticing very young folk to partake of what seems like a "kiddies day out". This is unacceptable. But then Freedom of Speech and Civil Rights come into play, if we object, yes?
A line has to be drawn and this can only be done by the people, not companies/government.
So where do we start?
Result -- An Associated Press article that makes Google look like the good guy, and Bowdon the bad conspiracist. Surprise!
Of course, the AP article fails to mention that the previous Google PR explanations for collecting childrens' private data were patently false and contradictory.
And they neglect to mention that parents had to complain to the FFEDERAL TRADE COMMISSION before Google would deign to take any action.
And they neglect to mention that Google is STILL collecting date of birth (DOB) and city of birth (COB), which constitute MOST of the information you need to find a complete SSN. And which are absolutely unnecessary for the "contest".
Wow, just wow. It is a very sad world that we live in, where corporations can buy or intimidate the mass media to cover up their abuses like this.
More than anything else, I feel sorry for the poor corporate slaves who do Google PR. They have to sleep every night, knowing that they have sacrificed any human moral or ethical framework, just so they could serve their corporate slavemaster and make enough money to buy their Starbucks every morning. Shudder. Poor stupid suckers...
"To be clear, all data concerning students that is collected by Doodle 4 Google is NOW, FOLLOWING MULTIPLE COMPLAINTS ABOUT OUR DATA MINING PRACTICES, used only to administer the contest. YOU SHOULD TRUST US ON THIS, REALLY, EVEN THOUGH WE JUST LIED TO YOU ABOUT WHY THIS INFORMATION WAS COLLECTED IN THE FIRST PLACE."
"The last 4 digits of the social security number were not entered into our contest records, WHICH MIGHT MAKE YOU WONDER WHY WE ASKED FOR IT, BUT THE FACT IS WE HAD ABSOLUTELY NO NEED FOR THE SSN DIGITS FOR CONTEST PURPOSES. HOWEVER, THIS DATA WOULD HAVE BEEN (AND STILL MAY BE) ENTERED INTO OTHER GOOGLE RECORDS FOR MARKETING PURPOSES."
"We have asked for city of birth all 4 years of the contest to date, BECAUSE IT IS A VALUABLE PIECE OF PERSONAL INFORMATION THAT DOES NOT RAISE AS MANY RED FLAGS AS ASKING FOR SSN DIGITS. SO YES, HAHA, WE GOT AWAY WITH IT. BUT AGAIN WE HAD NO REAL NEED OF THIS INFORMATION FOR THE CONTEST ITSELF."
"I'd also like to make clear to you on background that we were not aware that anyone had contacted the FTC when we updated the Parent Consent form, HOWEVER, WE WERE AWARE THAT ONE OR MORE PERSONS INTENDED TO CONTACT THE FTC TO REPORT OUR BEHAVIOR."
I think that about sums it up.
Besides Commander Bog, who sends me Imperial Directives from the Helix Nebulae tells me it wouldn't work anyway.
It was brought up earlier -- From an engineering perspective it makes complete sense. There is nothing worse that trying to create a database with insufficient information. Collecting TOO much data is always best, chances of being able to design a database while uniquely defining all entries is much greater.
But then the official Google PR response, with its patently false explanations & assurances, removed any shred of doubt that this form was collecting cross-linked data for marketing purposes.
Understand, this is ~extremely~ valuable data to marketers.
As adults, we regularly sacrifice our privacy to marketing firms. We need insurance, credit cards, loans, etc. Giving up our personal info is part of the cost to gain those services.
But children? They aren't banking, or buying much ~yet~. So their data is much harder to collect. And their product loyalties are still highly impressionable. These factors make a child's data worth 100x more than an adult's.
On top of that, this data could be cross-linked with...wait for it...the kids' HOPES and DREAMS, which are collected by the contest itself. That is an almost unbelievable boon for marketers. Crazy valuable.
Is it evil? I'd say yes, but it depends on your definition. Really this is just how a pure-profit-motive public corporation behaves. If you want to change it, you'd have to change Wall Street.
Let's hope that the FTC can slap Google with some hefty fines for this.
Huh? If they want to know if a child is a U.S. citizen or permanent legal residents, then they should ask. The city of birth only provides information regarding the citizenship of children born in the U.S. if a foreign city is provided, they have no way of knowing if the child is a U.S. citizen (born to parents who are U.S. citizens) or a permanent legal resident. A yes or no question is simple and straightforward -- if they chose not to use one, they have a reason.
Everyone born in a U.S. city is a U.S. citizen, but not all U.S. citizens are born in U.S. cities.
And the funny thing is, they did. On the second page of the form, the parent has to check a box to "confirm that the Entrant is a citizen or legal permanent resident of the United States".
There was absolutely no need for them to indirectly confirm citizenship/residency, because the form already DIRECTLY confirms it.
The rest of the Google PR response is equally nonsensical. For instance, the bollocks about distinct entries and duplicate entries. The form collects the parent's full name, full street address, telephone number, and signature...this is far more data than you need to ensure unique entries with no duplicates.
The only plausible reason to collect DOB, COB, and SSN is for a database of these kids' personal info.
Google has no problem with throwing low-level employees under the bus for privacy violations. The fact that Google PR has blatantly lied about the reasons for this data collection, seems to indicate that it was a fairly senior management decision.
Nice scaremongering, but what "trove" of personal information do you think you can get about a child by having his or her SSN?
Respectfully....
Because once you have the SSN of a child, you have it the rest of their lives.
If you're arguing that revelation of social security numbers does not present a privacy or an identity theft risk, and that such an implication is "scaremongering," perhaps you'd like to reveal yours right here, in this comment section. :) That way, by example, you'll certify your conviction that our fears are unfounded.