No, You Don't Need That Highlighter App (A discourse on Google for Education and FERPA)

As educators, parents and students around the world struggle to rapidly adapt to our changed environment, now seems like a good time for a reminder that it's ok (even necessary) to slow down and evaluate our technology adoptions.  As such, I'm taking this opportunity to review some points about Google Apps for Education (GAFE) and FERPA compliance.

The G Suite Terms of Service for Education Agreement is not a terribly long document, it totals out at just over 12 pages.  When a school district signs up to use Google Apps for Education, someone authorizes this agreement.  In it, Google asserts that they will act as a "school official" with regards to the data they receive.  There are two very important things to remember about this agreement however:

1. This agreement applies to Google's Core Services and does NOT apply to additional services (explicitly noted in the GAFE privacy policy.)
2. It is still the responsibility of the district to configure the G Suite to maintain FERPA compliance.

In the matter of the first point, Google specifically requires schools to get parent consent for the use of additional services.  These additional services follow a whole different set of privacy and data collection rules that includes the following:

We collect information to provide better services to all our users — from figuring out basic stuff like which language you speak, to more complex things like which ads you’ll find most useful, the people who matter most to you online, or which YouTube videos you might like. The information Google collects, and how that information is used, depends on how you use our services and how you manage your privacy controls.

There is an important line there at the end: how you manage your privacy controls. Google offers a whole informational guide on how to manage privacy with their specific apps, as the default settings are NOT the most private or restricted settings.

In regards to the second point, district responsibility, that is where things can go crooked.  One of the most well liked "features" of Google is how easily it can be integrated with different third party apps.  Practically every educational or commercial product has some form of Google integration.  Unfortunately, that is also where it is easiest for things to go wrong.  

For instance, Google Chat is a core service, which means that data is stored in a FERPA compliant fashion on Google's servers.  However, depending on the G Suite domain configuration, teachers may have the ability to add bots to a chat room (a setting which is on by default.)  Some of the available bots are created and managed by Google, some by third parties, but all of them will have their own terms of service and privacy rules.  These additions, whether they are bots for chat, or extensions deployed to Chromebooks, need to be carefully vetted and approved.  Many of these third party apps and extensions can provide great things, but our rush to provide an online education experience does not negate our responsibility to fully research them.

The Google Apps for Education suite can only be as safe and FERPA compliant as the domain administrator configures it to be.  While Google does not seem to offer a FERPA implementation guide that I've found yet, taking a quick look at their HIPAA Implementation Guide (PDF) can give you a good idea of where to start looking at your default configurations.  For some good tips on how to review terms of service and privacy policies for FERPA compliance, check out this PDF provided by the US Dept. of Education's Privacy Technical Assistance Center.

There are a lot of changes happening very fast in the world of education right now.  While everyone is coming together to support each other, and teachers are working hard for the best way to support their students, it becomes the job of administrators to step back and take a deep breath.  In the rush for online and remote learning, we cannot afford to sacrifice the privacy of our children.