Privacy Law

District Court Denies Motion to Dismiss COPPA Claim

Please share:

By Aaron Lawson[1]

A motion to dismiss filed by Google, LLC in an enforcement action by the Mississippi Attorney General under the Children’s Online Privacy Protection Act (“COPPA”) was recently denied by the U.S. District Court for the Northern District of Mississippi.

Mississippi’s lawsuit generally alleges that, through its G Suite for Education (or “GSFE”), tracks the online behavior of students, and uses that data to build profiles of individual students that Google uses for commercial purposes.[2] The lawsuit began in state court in 2017, and was limited at the time to a state-law unfair-practices claim, under the Mississippi Consumer Protection Act, in which the State alleged that Google misrepresented its data-collection practices through its GSFE privacy policies and by signing the Student Privacy Pledge, a set of industry-backed measures meant to assuage concerns surrounding data privacy and educational technology. In state court, Google moved to dismiss on venue grounds, and the venue question went up to the state supreme court before it was resolved in the State’s favor.

After some discovery, Mississippi amended its complaint. It alleges that Google assigns GSFE users a unique ID that allows Google to track that individual’s behavior across devices. The State further alleges that Google retains all of this information and builds profiles on individual students, which it uses for commercial purposes. The State acknowledged that Google does not use data collected within certain “core” GSFE services to serve advertisements, but nevertheless alleges that Google uses this data to improve its advertising product overall. By virtue of these new allegations, the State expanded its unfair-practices theory to assert that Google misrepresented GSFE as COPPA-compliant.

On the basis of these COPPA references, Google removed the complaint to federal court, prompting the State to amend again to allege a freestanding claim under COPPA. As relevant to the lawsuit, the FTC’s COPPA regulations require operators of online services who know that they are collecting personal information from children to make “reasonable efforts to obtain verifiable parental consent” to that collection and to any subsequent use of that data. 16 C.F.R. § 312.5. Google moved to dismiss, arguing that Google had adequately obtained consent to its collection and use from GSFE account holders.[3] Google’s motion implicated a statement published by the FTC in the Statement of Basis and Purpose for its 1999 final rulemaking under COPPA: “The Rule [specifically § 312.5] does not preclude schools from acting as intermediaries between operators and parents in the notice and consent process, or from serving as the parents’ agent in the process.” Google asserted that the terms of use to which schools were bound required the schools to act as intermediaries.

The district court denied Google’s motion, concluding that “whether the efforts taken by Google” to obtain parental consent “were reasonable is an issue that should not be decided at this stage of the proceedings.” The court specifically disagreed with the resolution of essentially the same arguments by the United States District Court for the District of New Mexico.[4] The New Mexico court concluded that Google’s terms of use did demonstrate compliance with COPPA. The Mississippi court took care to note that it was not concluding that Google was not in compliance with COPPA, only that compliance could not be determined at the pleadings stage because the reasonableness of Google’s approach is a fact question. The Mississippi court also sidestepped questions about how to interpret the 1999 Statement of Basis and Purpose, and whether it is consistent with the regulation, both of which were resolved by the New Mexico district court, and which are challenged on appeal in that case.

[1]           Aaron Lawson is an associate at the law firm Edelson PC, and is a member of the firm’s Issues & Appeals Group. He is also a member of the Executive Committee of the CLA’s Privacy Section.

[2]           Google changed the name of this product to “Google Workspace for Education” after the lawsuit was filed.

[3]           Google also argued that the second amendment to the complaint was improper because the State had not sought leave. The State urged that it had one amendment as of right post-removal. The district court sidestepped that dispute by determining that granting leave to amend was in the interests of justice.

[4]           The author’s firm represents the Attorney General of the State of New Mexico in this litigation against Google. The author has appeared on behalf of the New Mexico Attorney General in the appeal in that case.

Forgot Password

Enter the email associated with you account. You will then receive a link in your inbox to reset your password.

Personal Information

Select Section(s)

CLA Membership is $99 and includes one section. Additional sections are $99 each.