By Lynette T. Owens
Earlier this week, Google was exposed for an issue with their 4th annual “Doodle 4 Google” contest. The contest is designed to encourage creativity among students in grades K-12 in the U.S… It asks them to create a drawing using the Google logo. The winning entry is then displayed on the Google home page and the winner receives a college scholarship and a technology fund for their school. It’s commendable to engage and reward students in this way and it’s a fantastic way to build goodwill around a brand (not many brands valued so highly will allow people to mess with their logo).
But the misstep Google made in this 4th year is stunning, especially for a company that is closely scrutinized and many times criticized for its privacy practices. I took particular interest in this story and contest because we are also currently running a contest aimed at youth and schools.
According to Google’s contest site, they made one change in this 4th year which seems to have contributed to their mistake. In the past, they only allowed kids to participate through their schools. But many parents had apparently expressed interest for their kids to participate despite the fact that their schools were not registered to do so. So they opened the gates to parent-sponsored entries as well as school-sponsored entries.
When you register your child for their contest as a parent, you are asked for some basic information. You have to register online, hit submit, and then you receive a unique pre-registration ID. You need to include this ID with the necessary paperwork, which includes a parent consent form, and submit it with your child’s doodle.
The question that everyone is fussing over is “Why did the parent consent form require the last 4 digits of your child’s social security number?”
After Bob Bowdon broke this story in the Huffington Post early this week, Google has corrected the consent form. They are no longer asking for your child’s social security number. (Although thanks to Bob, you can still see the original form.) Google’s explanation for the change? They originally needed this information to make sure there were no duplicate entries. They then realized they were already asking for enough information to help them identify duplicates.
So, isn’t that what the unique pre-registration ID was for in the first place? One doodle per child is allowed, the unique ID should be enough to distinguish one child from another. If you are a parent of 2 kids who enter, they will both have the same unique ID under your registration name, but each entry will have a different child’s name. Still I wondered, why on earth did they ever need any part of a kid’s social security number?
Bowdon and others who have written about this since jumped to the obvious conclusion – they want to help advertisers market to your kids. If you have a child’s city of birth, date of birth, and the last 4 digits of that number you can figure out the whole number. This is true and everyone – parents or not – should be wary of providing this combination of information to participate in a contest. But I asked an executive at a very large advertising agency in New York who knows a lot about the data Google will provide to her, since she has spent millions on behalf of her clients on Google services over many years. A social security number is not valuable in and of itself – it is the data attached to it that could be. But it was still baffling to her why Google would have asked for such information on top of everything else they were already asking for.
In our own contest, called the “What’s Your Story?” Internet safety video contest, we are trying to engage young people on being safe, responsible users of the Internet. Maintaining online privacy is one of the 3 contest categories (being a good online citizen (addressing issues of cyberbullying and harassment) and using a mobile phone wisely are the other 2 categories). So we of course we took great pains both last year and this year to ensure we were not infringing upon anyone’s privacy or security in the process of trying to teach kids about that very topic.
In comparison to Doodle 4 Google, the What’s Your Story contest requires you to be 13 or older to register for the contest, with parental consent required for minors. We don’t ask for city of birth, date of birth, or a social security number to participate. If a parent or school registers as the contestant, kids can be in the videos that are submitted, but again, they cannot register if they are under 13. That is why Google’s situation is so baffling to me. We agonized over making sure we were compliant with laws like COPPA (which ensures children’s information is not collected without the proper processes and security and privacy measures in place), while still trying to encourage youth participation.
Rather than piece together some huge conspiracy theory and take stabs at Google’s true motivations for requiring such detailed personal identifying information, I think it is more productive to focus on the lessons we can learn from this incident:
1 – Never, ever give any information to a site that you don’t have to. That goes for your kids, too. Many sites will denote the fields you “must provide” to proceed. But if you don’t have to provide it, skip it.
2 – In a contest submission, nobody should ever ask for your child’s social security number. You may need to later provide it if you win a cash prize, for tax purposes. But to register for the contest? Never.
3 – Be very careful when giving out personally identifying information like place of birth and social security numbers. There are very few business or government reasons to do this online. If you need to do it, read the site’s privacy polices, and know what they intend to do with the information. If it’s not clear to you, don’t use it or contact the organization and ask them.
4 – Always, always use a reputable, up-to-date security software product on any device you connect to the Internet on. We at Trend Micro obviously have many of options to choose from, including our product called Titanium. Click here for more information.
5 – And lastly, don’t lose heart on letting your kids engage in contests or other great services or forums online, including the Doodle 4 Google contest. Was it just a gross oversight by Google? Were they intending to do something more? Who knows? They’re not asking for the data now, so it’s a moot point. It looks like a great contest, so don’t shy away from participating in it.
And of course, consider participating in our 2nd annual “What’s Your Story?” internet safety video contest. You can actually even submit a video about protecting personal information online – and teach other kids and families while you are at it.
The cost? A video no longer than 2 minutes. The prize? $10,000. To win? Get your video in and get your family, friends and communities to view it.
For more information on our Internet safety contest, visit http://whatsyourstory.trendmicro.com
For more internet safety and security tips and advice, visit www.trendmicro.com/internetsafety
Lynette Owens is Vice President of Global Consumer Education & Marketing at Trend Micro and Founder of the Internet Safety for Kids and Families program. With 25+ years in the tech industry, Lynette speaks and blogs regularly on how to help kids become great digital citizens. She works with communities and 1:1 school districts across the U.S. and around the world to support online safety, digital and media literacy and digital citizenship education. She is a board member of the National Association for Media Literacy Education, an advisory committee member of the Digital Wellness Lab, and serves on the advisory boards of INHOPE and U.S. Safer Internet Day.
Follow her on Twitter @lynettetowens.