Secret browser monitoring of schoolchildren? Google sued

70 percent of US schools use Chromebooks and Google cloud services. Google is said to be tracking children across the internet even when cookies are switched off – through secret fingerprinting in the Chrome browser. This allegation is made in a new lawsuit that seeks to represent all affected families as a class action. The data company would use the harvested data for commercial purposes for itself and its advertising customers.

By law, the children affected must go to school and use Chromebooks and around two dozen Google cloud services, from the email service Gmail to chat services and Google Docs to the AI language model Gemini. Opt-outs are not provided. The vast majority of these schoolchildren are minors. Parents or guardians would have to consent to Google processing their data; Google does not even try to obtain their consent, but relies on the contracts concluded with the schools. However, these cannot replace the consent of the parents or guardians, the statement of claim explains.

The complaint filed with the US Federal District Court for Northern California on Monday accuses Google not only of violating civil law, but also criminal law and constitutional law. According to the complaint, the latter is relevant because Google provides Chromebooks and numerous cloud services on behalf of the school authorities. The case is called Joel Schwarz et al v Google and bears the case number 3:25-cv-03125.

"Through its services, Google monitors students and continuously extracts their personal data," the introduction to the extensive lawsuits states, "Google and its customers process this information into intimate, detailed profiles of schoolchildren." The companies would exploit these profiles to market their products and services to the children, "manipulate how the children think and act, shape their information environment, and make significant decisions that affect the children's lives and futures – all without the knowledge of the children or their parents, with no way to avoid or limit the improper collection and dissemination of the children's personal and private information."

Fingerprinting is almost impossible to avoid

Technically, Google uses browser fingerprinting for this. There are several variants of this, which are difficult to defend against. In canvas fingerprinting, a script writes text in the browser window, often invisibly or barely visible. The same script then reads the corresponding screen content as graphical information. The rendered result differs slightly depending on the operating system version, browser version, graphics card and graphics driver version. If the same script is running on another website visited, it is highly likely to recognize the computer – without cookies.

Data dealers can use similar tricks thanks to software interfaces (API) for sound, battery status or WebRTC. For example, a script secretly calculates a sound sequence that is then not output at all. The next time, the tracker can recognize and assign the result. The lawsuit does not say which forms of fingerprinting Google uses.

"This means that Google can use (fingerprinting) to track any child, even if he or she or the school administrator has disabled cookies or uses technology that blocks third-party cookies (...). The profile created by fingerprinting identifies users and their online activities across websites." Google's "massive data harvesting exposes children to serious and irreversible risks to privacy, property, and self-determination, and harms them in serious, covert ways," the plaintiffs complain. These are children from different US states.

Such data collection and use is only legally permissible on the basis of the well-informed, voluntary consent of a responsible person in exchange for adequate compensation. The legal guardians, who were not even asked, are responsible for this. In addition, there is no compensation for the data harvesting, nor can consent be given voluntarily in view of compulsory school attendance. There is also no question of information. Google had scattered the relevant information across more than 20 different documents, the content of which was vague, incomprehensible, confusing and sometimes contradictory.

The legal allegations

The lawsuit alleges numerous legal violations. Since Google is acting on behalf of the authorities, the data collection violates the Fourth Amendment of the US Federal Constitution, which prohibits arbitrary searches, as well as the Fourteenth Amendment, from which a right to data protection is derived. Google's secret surveillance also violates the Federal Wiretap Act and the Children's Online Privacy Protection Act (COPPA) and Children's Internet Protection Act (CIPA). In addition, the complaint alleges intrusion into private areas and unjust enrichment.

Furthermore, the claim is based on the law of the US state of California, where Google has its company headquarters. The claim violates the California Constitution's right to data protection, the criminal prohibition of intrusion into private spheres, criminal computer law (Comprehensive Computer Data Access and Fraud Act, CDAFA) and the prohibition of unfair competition. The plaintiffs seek a jury trial, class action certification, declaratory relief, injunctive relief, costs, compensatory and punitive damages, all with interest.

• The Klageschrift Joel Schwarz et al v Google

(ds)