February12,2016

TheHonorableAlFranken
UnitedStatesSenate
309HartSenateOfficeBuilding
Washington,DC20510

DearSenatorFranken:

ThankyouforyourletterofJanuary13,2016,concerningGoogleAppsforEducationand
Chromebooks.Wehavealwaysbeenfirmlycommittedtokeepingstudentdataprivateand
secure.WeappreciatetheopportunitytoexplainourproductsandthestepsGoogletakesto
protectourusersinformation.

EnsuringeducatorsandstudentscanlearnandworktogetherfitsnaturallywithGoogles
missiontoorganizetheworldsinformationandmakeituniversallyaccessibleanduseful.
Googlebelievesthattechnologylevelstheplayingfieldandenablesanyonetolearn,anywhere.
Thatswhywebuildeasytousesolutionsthatgiveteachersandadministratorsmoretimeto
educateandstudentsmoretimetolearn.

OneexampleisGoogleAppsforEducation(GAFE),afreeandsecuresetofproductivitytools.
SchoolssetupandmakeavailabletostudentstheGAFEcoreservices,suchasGmail,Google
Calendar,Groups,andDrive,whichincludesDocs(wordprocessing),Sheets(spreadsheets)
andSlides(presentations).

WithGAFE,studentscancollaborateonprojectsinrealtimefromacrosstheroomoracrossthe
world.Theycanfindandinteractwiththeinformationtheyneed,becomecreatorsandmore
engagedandactivelearnersand,ultimately,becomebetterpreparedfortwentyfirstcentury
careers.Forteachers,distributingandcollectinghomeworkandprovidingstudentsoneonone
feedbackbecomeeasierandmoreeffective.

GAFEservicesmaybeusedonanydevicewithamodernwebbrowser.Manyschoolschoose
touseChromebooks,whichareaffordableanddurablelaptopsthatcanbeusedtoaccess
GAFEservicesandtherestoftheInternet,undertheschoolsmanagement.Chromebooks,
like,GAFE,haveworldclasssecurity,whichiscriticaltoensuringprivacyofstudentspersonal
data.

AnotherexampleisChromeSync,afeaturepopularwithbothChromebooksandtheChrome
browserthatenablesGoogleAccountholderstologintoanyChromebookorChromebrowser

andfindalltheirapps,extensions,bookmarks,andfrequentlyvisitedsites.Eachcommunityand
schooldistrictisdifferent.TechnologylikeChromeSyncgivesschoolstheflexibilitytheyneedto
developasystemthatworksbestfortheircommunity,whetherthismeansonedeviceper
studentorshareddevicesacrossclasses.Forstudents,thismeansthattheycangettowork,
rightawayevenwhenaschooldoesntprovideadeviceforeachstudent,ChromeSync
makesaChromebookinstantlyfeellikethestudent'sown.

Digitalliteracyisanimportantcomponentofensuringtheprivacyandsecurityofstudents
personalinformation.Soweworkwithexpertstodevelopprogramssuchasthe
Online
SafetyRoadshow
thatteachstudentswhattheycandotostaysafeandsecureonline.

Belowareresponsestoyourspecificquestions.

1. WhenastudentissignedintotheirGAFEaccountbutisnotusingoneofthe
GAFEservices,whatkindofdatadoesGooglecollectonanindividualstudent?

Schooladministratorsdeterminewhichservicesstudentscanaccessanduse.TheGAFEcore
servicesareCalendar,Classroom,Contacts,Drive,Docs,Gmail,Forms,Groups,Sheets,Sites,
Slides,Talk/HangoutsandVault.AdministratorscontrolaccesstotheseGAFEcoreservicesas
wellasservicesoutsideoftheGAFEcoreservices.Schoolsmaypermitstudentstoaccess
additionalGoogleservices(likeYouTube,Maps,andothers)beyondtheGAFEcoreservicesif
theyobtaintheconsentofaparentforminorstudents,andiftheuseisforeducational
purposes.

BeforeweaddressthoseadditionalGoogleservices,wewouldliketoexplainGoogles
practiceswithrespecttotheGAFEcoreservices.InGAFE,Googlecollectsbothpersonaldata,
likeastudentsnameandemailaddress,aswellasotherinformationabouthowtheservices
areused,suchasthetypeofdeviceandtheIPaddressoftheusersnetwork.HowGoogle
collectsandusesinformationwithGAFEaccountsisdescribedinthe
GoogleAppsfor
EducationPrivacyNotice
.GooglesuseofinformationinGAFEcoreservicesislimitedbythe
GoogleAppsforEducationagreement
andthe
DataProcessingAmendment
(whichschools
canacceptintheGAFEAdminconsole).GoogleusesstudentspersonaldatainGAFEcore
servicesonlytoprovidetheseservices,sostudentscandothingslikecommunicateusingemail
andcollaborateonassignmentsusingGoogleDocs.TherearenoadsinGAFEcoreservices,
andstudentdataintheseservicesisnotusedforadvertisingpurposes.

IfaschoolpermitsaccesstooneofGooglesadditionalservicesoutsidetheGAFEcore
services,suchasGoogleMaps,Googlecollectstheinformationdescribedinour
PrivacyPolicy
.
TheinformationwecollectintheseservicesissimilartothatcollectedfromanyotherGoogle
user,andincludes:

Informationtheusergivesus,includingpersonalinformationlikename,emailaddress,
ortelephonenumber.

Deviceinformation(suchasyourhardwaremodel,operatingsystemversion,unique
deviceidentifiers,andmobilenetworkinformationincludingphonenumber).
Loginformation,includinguserentrieslikemapsqueries,thenetworksIPaddress,and
deviceeventinformationsuchascrashes,systemactivity,hardwaresettings,browser
type,browserlanguage,thedateandtimeoftherequestandreferralURL.

IfanyofthisdataisassociatedwithastudentsGAFEaccountwhichmayhappenwhena
studentisloggedintotheirGAFEaccountweconsiderittobethestudentspersonal
information.Aswepromiseinthe
GAFEPrivacyNotice
,noK12studentpersonalinformationis
usedtotargetads,andinsomeservicesweshownoadsatall.InGoogleSearch,forexample,
weshownoadswhenK12studentsareloggedintotheirGAFEaccounts.

Asdescribedinmoredetailinresponsetoquestiontwo,below,userswhohaveChromeSync
enabled(whetheronaChromebookorusingtheChromebrowser)willhaveadditional
informationabouttheirbrowsersettingsstoredintheirGAFEAccount,includingbrowsing
history,anysavedapps,extensions,bookmarks,andpasswords.Inaddition,Chromebooks
collectanonymoususagestatisticsandcrashreportsaboutusersinteractionswithChrome
features.Thesestatisticsandcrashreportsarecollectedanonymously,meaningthatwedonot
associatethemwithyourGoogleAccountwhenwecollectthem.

2. WhenastudentisusingaChromebookbutisnotusingoneoftheGAFEservices,
whatkindofdatadoesGooglecollectonanindividualstudent?

ThereisverylittledifferencebetweenthedatacollectedfromastudentusingGoogleservices
onaChromebookversususingaGoogleserviceonanyotherdevice,whichwedescribe
above.Bydefault,Chromebooksanonymouslycollectusagestatisticsandcrashreports,which
involveinformationabouttheusageofChromefeatures.Otherthanthat,thefactthatyouare
accessingaGoogleservice,suchasGmailorGoogleSearch,withaChromebookdoesnot
causeGoogletoreceiveanyadditionalordifferentinformationaboutyou.Notethatschool
administratorsmayrestrictthewebsitesandservicesaccessibleviatheChromebook,whereas
otherdevicesmaynotbesolimited.

UserswhohaveChromeSyncenabled(whetheronaChromebookorusingtheChrome
browser)willhaveadditionalinformationabouttheirbrowsersettingsstoredintheirGoogle
Account,includingbrowsinghistory,anysavedapps,extensions,bookmarks,andpasswords.
Seeour
HelpCentertolearnmoreaboutChromeSync
.Ifanyofthisdataisassociatedwitha
studentsGAFEaccountwhichisthecasewhenastudentisloggedintoaChromebookwith
ChromeSyncenabledwiththeirGAFEaccountweconsiderthisdatatobethestudents
personalinformationanddonotuseittotargetads.

3. IfGoogledoescollectanyindividualizeddataonastudent,suchasbrowsing
informationorviewinghabits,whenastudentisusingaChromebookorislogged

intotheirGAFEaccountbutisnotusingoneofGAFEservices,pleaseaddress
thefollowingquestions:
a. ForwhatpurposesdoesGooglecollectthisinformation?

InGAFEcoreservices,studentspersonaldataisusedonlytoprovidetheservicesthemselves.
InGooglesadditionalservices,Googlecollectsinformationforthepurposesdescribedinthe
GAFEPrivacyNotice
andour
PrivacyPolicy
,suchasproviding,maintaining,anddeveloping
ourservices,andprotectingusersfromharm.Wespecificallypromiseinour
GAFEPrivacy
Notice
thatK12studentspersonalinformationisnotusedtotargetads.

b. IsitnecessarytocollectallofthisinformationfortheprovisionofGAFE
servicesortodeliverothervaluablefeaturesthatmayberelevantfor
educationalpurposes?

PersonalinformationcollectedinGAFEcoreservicesisusedsolelytoprovidethoseservices.
SchoolsareresponsibleforcompliancewiththeChildren'sOnlinePrivacyProtectionActof
1998,includingobtainingparentalconsentforcollectionofstudents'personalinformationin
GAFEcoreservices.Schooladministratorschoosewhich,ifany,additionalGoogleservices
outsideoftheGAFEcoreservicestoallowtheirstudentstoaccess.ManyofthesenonGAFE
services,suchasSearch,Earth,MapsandYouTube,havefunctionswhichschoolsfind
educationallyrelevantandvaluable.Thoseservicesmayuseinformationsuchasbrowsingor
viewinginformationtoimproveservicesandmakethemmorerelevantforusers,andforother
purposespermittedbytheGoogle
PrivacyPolicy
.Ifanadministratorallowsaccesstoanyof
thesenonGAFEservices,theymaydosoonlyforeducationalpurposesandwithparental
consentforanystudentsunder18.

c. HasGoogleeverusedthiskindofdatatotargetadstostudentsinGoogle
services,eitherintheGAFEservicesorotherGoogleservices,suchas
GoogleSearch,GoogleNews,GoogleBooks,GoogleMaps,Blogger,or
YouTube?

SinceGAFEwaslaunched,adsintheGAFEcoreserviceshavealwaysbeenoffbydefault.In
2014,we
tooktheadditionalstep
ofremovingtheenable/disabletoggleforadsintheGAFE
Adminconsole.ThischangeensuredthatadswouldalwaysremainoffinGAFEcoreservices
andthatusersdataintheseserviceswouldnotbeusedforadvertisingpurposesa
commitmentthatisreflectedinour
AppsforEducationagreement
.

ManyofouradditionalservicesoutsideoftheGAFEcoreservicesnormallyshowtargetedads
(whichishowweofferthemforfree).WehaveworkedtorestrictuseofK12studentpersonal
information:our
GAFEPrivacyNotice
promisesnottouseanyK12studentpersonal
informationtotargetads,includinginservicesoutsidetheGAFEcoreservices.Insome
products,likeSearchandMaps,wehaveremovedtheadsaltogetherforsignedinK12GAFE

users,whileotherservicesmayshowonlycontextualadstotheseusers.Contextualadsare
selectedwithoutreferencetoanyuserprofileorotherpersonalinformationabouttheuser.

d. HasGoogleeverusedthiskindofdataforitsownbusinesspurposes,
unrelatedtotheprovisionofGoogleseducationalofferings?

GooglemayusethedatafromadditionalservicesoutsideoftheGAFEcoreservicesforthe
purposesdescribedinour
PrivacyPolicy
,whichinclude,forexample,productimprovementand
productdevelopment.WemakefurthercommitmentsforGAFEusersinour
GAFEPrivacy
Notice
,includingacommitmentnottousepersonalinformationfromK12GAFEuserstotarget
ads.Inotherrespects,theadditionalservicesoutsideoftheGAFEcoreservicesworkfor
studentsjustastheydoforanyotheruser.Werequireschooladministratorstoobtainparents
consentforminorstudentsforourdatacollectionanduseiftheyenabletheseadditional
servicesforstudents.PersonalinformationcollectedincoreGAFEservicesisusedsolelyto
providethoseservices.

e. Isitpossibletomakethisdatacollectionoptin?

GoogleprovidescontrolstoadministratorsoverGAFEcoreservicesandtheadditionalservices
intheAdminconsoletoassisttheminrestrictingstudentaccesstothoseservicesiftheywishto
doso.Furthermore,schoolsmustobtainparentalconsentforminorstudentstoGoogles
collectionofthedatawehavedescribedandtotheuseofanyadditionalservicesbeyondthe
GAFEcoreservices.InadditiontoadministratorcontrolsoverservicesandsettingsintheGAFE
Adminconsole,eachstudentsaccountalsohasaccessto
controlsofferedtoeveryGoogle
account
(someofwhichcanalsobecontrolledthroughtheAdminconsole),
andthesecanbe
usedtoreflectschoolpoliciesandparentalconsents
.

f. DoesGooglesharethisinformationwithadditionalparties?

WedontsellGAFEdataoranyofour
userspersonaldata
.Wedonotsharepersonal
informationwiththirdpartiesexceptinthefewexceptionalcircumstancesdescribedinthe
GoogleAppsforEducationagreement
andour
PrivacyPolicy
,suchaswhenschoolsaskusto
shareitorwhenwearerequiredtodosobylaw.

4. Googlehasindicatedthatitcompilesdataaggregatedfromstudentusersof
ChromeSync,anonymizesthedata,andusesittoimproveitsservices.Canyou
expandonhowtheaggregatedinformationistreated?Forexample,doesthis
includesharingtheaggregateddatawiththirdpartiesforresearchpurposesor
otherwise?

Aswementionedinour
blogpost
,wecompileaggregatedandanonymizeddatafromallusers
ofChromeSyncwhosynctheirbrowsinghistoryandhavenotencryptedtheirChromeSync
datawithasyncpassphrase.Beforeusingthisdatawecompletelyremoveidentifying

informationaboutindividualusers.Inmostcases,thisisaccomplishedbyaggregatingthedata
andreducingtheinformationtoacountforexample,wemightusethefactthatawebpage
hasbeenseenbythousandsofusers.Thereisnowaytopersonallyidentifyanyuserbasedon
thiscount.This
aggregated,anonymizedChromeSyncdataisusedtoimproveGoogle's
products,primarilywebsearch,byhelpingtodetectmobilefriendlypages,pageswhichhave
stoppedservingcontent,anddownloadsofmalware.
Unlessrequiredbyavalidlaw
enforcementrequest,wedonotshareaggregatedChromeSyncdatawithanythirdparties,for
researchpurposesorotherwise.

5. CanyoudescribeGooglesrelationshipwithschooldistrictsandadministrators
thatchoosetouseGoogleforEducationproductsandservices?Apartfrom
publiclyavailableprivacypolicies,doesGoogleofferanyexplanationtoparents,
teachers,andeducationofficialsabouthowstudentinformationiscollectedand
used?

Googleoffersa
privacyandsecuritysite
,includingdetailedFAQs,toschoolsandparents
consideringorusingGAFEservices.Itcontainsmuchoftheinformationdescribedinthisletter,
includinginformationabouttheStudentPrivacyPledge,Chromebooks,anduseofadditional
GoogleservicesoutsideoftheGAFEcoreservices.

Our
GAFEPrivacyNotice
reflectsourcommitmenttodisabletargetedadsbasedonpersonal
informationinallGoogleservicesforK12students.
Weprovidea
HelpCenter
andmessage
boardwhereadministratorscanfindhelp.ThroughtheAdminconsole,weprovide24/7phone
andemailsupport.

Weenableeducatorstoconnectwitheachotherbecausewefindthatpeersarethemost
helpfulresources.
Forteachers,thereareGoogleEducatorGroupsrunforeducatorsby
educatorstosharepracticesinpersonoronline.Theycancomparenotesabouthowtheyuse
tools,whichtoolstheydoanddon'tallowforcertaingradelevelsofstudents,andother
importantinformation.Foralleducatorsweofferthe
GoogleforEducationTrainingCenter
,aset
ofonlineresourceswecreatedwitheducatorsforeducators.

We
reachouttoschoolleaders,educators,andparentsthroughchannelslikeourGooglefor
Educationnewsletter,GoogleforEducation
Twitter
and
G+
accounts,andthe
Googlefor
Educationblog
.Weregularlymeetwithorganizationsthatrepresentstateadministratorsand
schoolleaders,presentatandparticipateinconferences,andhostwebinarsthatinclude
informationaboutprivacyandsecurity.

6. Canyoudescribeallthecontextsandwaysinwhichbothschooladministrators
andparentsofstudentsusingGoogleforEducationproductsandserviceshave
controloverwhatdataisbeingcollectedandhowthedataarebeingused?

Googleseducationalproductsaredesignedtobedeployedandmanagedbyschool

administratorsandteachers,sotheyhavecontroloverwhetherandhowGoogleservicesare
availabletostudents.Schoolsalsoactonourbehalftoobtainparentalconsentforminor
studentstouseGoogleservicesoutsidetheGAFEcoreservices,andtothecollectionoruseof
datainvolvedinthoseadditionalservices.Asnotedabove,schoolsareresponsiblefor
compliancewiththeChildren'sOnlinePrivacyProtectionActof1998,includingobtaining
parentalconsentforcollectionofstudents'personalinformationinGAFEcoreservices.

Administratorshavefinegrainedcontrolovermanyoftheservicestheydeploy.Forexample,a
schooladministratormaychoosetolimittheaccessofmiddleschoolstudentstoGoogleDrive
andDocs,butallowhighschoolstudentstoalsoaccessGmail.Aschooladministratormayalso
choosetoallowstudentstoexchangeemailonlywithrecipientswithinthedistrict,theschool,or
evenjusttheirclass.SchoolscanalsoblockstudentaccesstoGoogleservicesoutsideofthe
GAFEcoreservices,likeYouTubeandBlogger.Inadditiontoadministratorcontrolsover
servicesandsettingsintheGAFEAdminconsole,eachstudentsaccountalsohasaccessto
controlsofferedtoeveryGoogleaccount

andthesecanbeusedtoreflectschoolpoliciesand
parentalconsents
.

ForthoseschoolsthatuseChromebooks,ChromeSyncisonbydefault(inaccordancewith
feedbackfromschoolsthathavehighlightedthisasacrucialfeature),butanadministratorcan
disableitforallstudents,orjustforsomegroups.Our
HelpCenter
describeshowtoturnoff
servicesintheAdminconsole.IndividualstudentsalsohavecontroloverChromeSync.
Studentscan
choosewhattosync
insettings.Usersalsocanelecttoseta
syncpassphrase
.
Whenyousetasyncpassphrase,yourdataisstillstoredinyourGoogleaccount,butitis
encryptedwithyourpassphrasesoGooglecantreadit.Regardlessofwhetherstudentsuse
thisfeature,however,GoogleusesthepersonaldatastoredinChromeSyncdatapurelyto
providefeaturesinChromeforthatperson,forexampleallowingstudentstosecurelyaccess
theirownbrowsingdataandsettingsacrossdevices.

WeappreciatethechancetoexplainGooglesprivacyandsecuritypracticesofGoogleAppsfor
EducationandChromebooks.Pleaseletusknowifwecanaddressanyotherquestionsyou
mighthaveorbearesourcetoyouonoursharedgoalsofimprovingstudentperformanceand
protectingstudentsprivacyandsecurity.

Sincerely,

SusanMolinari
VicePresident,PublicPolicyandGovernmentRelations,Americas
Google