Google settles over kids biometric data collection in schools

Google and the parents of an Illinois girl who sued (H.K. et al. v. Google LLC) the tech giant in state court in 2020 alleging Google violated two sections of the Illinois Biometric Information Privacy Act (BIPA), have agreed to a settlement in which the case “in its entirety” has been sent back to the U.S. Circuit Court of the Ninth Judicial Circuit, McDonough County, Illinois, where the suit was originally filed.

The settlement comes on the heels of Illinois residents having started receiving payments last year as part of a $65.8 million class-action settlement with Google for nearly identical alleged violations of BIPA, including “collecting and storing biometric data of individuals who, while residing in Illinois, appeared in a photograph in the photograph sharing and storage service known as Google Photos, without proper notice and consent.”

And in 2019, Google reached a record $170 million settlement with the U.S. Federal Trade Commission and New York’s Attorney General over allegations of violating children’s privacy laws.

The putative class action suit against Google that was settled in principle last week had also alleged that, in violation of BIPA’s requirement for consent from parents or legal guardians, Google had illegally collected, stored, and used millions of schoolchildren’s biometric data, including scans of faces, voiceprints, and other personally identifiable information (PII). The suit further alleged that Google illegally harvested children’s physical locations, websites they visited, personal contact lists, passwords, and other behavioral data.

According to an amended complaint filed in July 2021, Google “infiltrated” school systems in the U.S. through its having provided schoolchildren with access to its Chromebook laptops, which are pre-installed with the company’s G Suite for Education apps, including email, calendar and Docs services, and are free to access.

“Google has complete control over the data collection, use, and retention practices of the ‘G Suite for Education’ service, including the biometric data and other personally identifying information collected through the use of the service, and uses this control not only to secretly and unlawfully monitor and profile children, but to do so without the knowledge or consent of those children’s parents,” the suit had alleged.

A putative class action is a lawsuit that is filed by one or more named plaintiffs on behalf of a potential group of people who may have suffered a similar claim. The term “putative” means something is presumed, reputed, or supposed, but not yet established. A case is considered putative before it receives class certification, which is when a judge agrees that the case meets the requirements to proceed as a class action.

However, through private mediation with retired Judge Stuart E. Palmer, Google and the parents reached a settlement-in-principle that, if finally approved by the circuit court, will resolve all claims asserted in the lawsuit.

Court documents show both litigants “reduced their settlement to a written settlement agreement and the agreement has been executed in full.”

In sending the case back to the lower court, Chief U.S. District Judge Sara Darrow ruled that the “settlement contemplates effectuation of the settlement in the Circuit Court” and that both parties “have conferred and agreed that the action should be remanded in its entirety to the Circuit Court of the Ninth Judicial Circuit … for all further proceedings related to the settlement.”

Darrow ordered the case sent back to the lower court “in its entirety … without prejudice to Google’s rights.”

“The parties have reduced their settlement to a written settlement agreement and the agreement has been executed in full,” Darrow’s July 23 ruling states.

In April 2021, Google was successful in having the case removed to federal court, but a year later was unsuccessful in getting Judge Darrow to dismiss the case altogether. Darrow denied Google’s motion to dismiss, saying it would be premature to decide at the motion to dismiss stage whether the suit’s allegations were preempted by the Illinois Student Online Personal Protection Act that governs the collection of certain student information in Illinois grade schools.

Google had argued that the suit should be dismissed because the plaintiff’s biometric privacy claim was also preempted by the federal Children’s Online Privacy Protection Act, which imposes certain requirements on operators of websites or online services directed to children under 13 years old.

Google had also argued that the suit should be dismissed because plaintiff Clinton Farwell, the father of the young girl named in the suit, failed to allege sufficient facts that would render his allegations plausible.

Google was thus faced with another potentially loosing – and expensive – case similar to ones it had already reach settlements regarding.

Article Topics

biometric data  |  Biometric Information Privacy Act (BIPA)  |  children  |  data protection  |  Google  |  lawsuits  |  schools