Monday, July 25, 2011

Google forgets "Do No Evil" slogan?

Originally published 2/23/11 on

A week or so ago I noticed a "Doodle-4-Google" contest asking for artwork from kids. I intended to go back later because I thought my kids might be interested, but got busy and forgot. Then today I see an article by Bob Bowden in the Huffington Post, "Why Has Google Been Collecting Kids' Social Security Numbers Under the Guise of an Art Contest?" It turns out that Google has been asking parents for information that could be used to guess their children's Social Security numbers.

Google has changed the entry form so that it just asks for the childs school and parents address. It originally asked for the childs city of birth and date of birth as well as the last four digits of their SS#. It's not widely known, but if you know the city of birth, date of birth, and last four of the SS# it is possible to guess with very high probability the first five digits of the SS#.

Why was Google asking for this information? It was hardly necessary to ask for any Social Security information for a children's art contest. When a letter was sent to Google asking about the legality of asking for children's SS#'s the entry form was rapidly changed. It's possible that Google simply hadn't thought about the legality of what they were doing, but I don't really believe that. If Google guessed the children's SS#'s and sold them they would make millions. Having a person's SS# gives you unprecedented access to their lives.

Bob noted that the contests privacy policy did nothing to protect privacy, saying:


At least the contest "privacy notice" is clear enough: "participation constitutes consent to the storage, use and disclosure of the Entrant's entry details...." It should really be called the "privacy waiver."


It has since been changed:


Privacy Notice. By participating in this Contest, you agree that Google can collect your personal information, and that if Google cannot collect the required data, you may not be eligible to participate in the Contest. Any personal information collected during the course of the Contest by Google will only be used for administering this Contest and for other purposes as outlined in these Rules, and will be subject to the practices described in the Google Privacy Policy located at You will have the right to access, review, rectify or cancel any personal data held by Google by writing to Google (Attention: Privacy Matters) at the Google address listed in Section 2.


When Google realized what it had done (or that it had been caught) it quickly fixed the problems. But this just underscores the fact that you should never fill out anything online (or anywhere) without reading the fine print and making sure you understand it. Especially if you are doing it for children.