What does Google need with (part of) your child’s security number?
That’s what privacy advocates were asking, prompting Google to withdraw a requirement that parents entering their children in its popular “Doodle-4-Google” provide the last four digits of a child’s social security number.
The art contest, which drew more than 33,000 entries last year, was created by Google to highlight “the creativity of young people” by having them send in a drawing under the theme “What I’d like to do someday …”
It is open to children from kindergarten through the last year of high school and requires that a contestant provide a Parent Consent Form along with their submission.
The original form asked for the child’s city of birth, date of birth, the last four digits of the child’s social security number, and complete contact info for the parents.
But with all of that info, watchdogs worried about online sites having too much information pointed out it would be relatively easy to steal someone’s identity — or sell the data to marketers who could do just about anything with it.
You see what Google knows and many parents don’t know is that a person’s city of birth and year of birth can be used to make a statistical guess about the first five digits of his/her social security number. Then, if you can somehow obtain those last four SSN digits explicitly — voila, you’ve unlocked countless troves of personal information from someone who didn’t even understand that such a disclosure was happening.
Bowdon admits he has “no evidence that Google will use or sell this information for marketing purposes.”
But regardless of its motivations, 26 hours after the FTC was alerted about the requiqrement, Google had reconfigured its consent form and deleted the request for the last four digits of a child’s Social Security number.
To date, it is still requiring parents to list a child’s birth, not current, city.
Here’s the explanation that Google sent to New York Magazine:
This year we started accepting doodles from kids even if their school hadn’t registered for the contest. To help us keep entries distinct and remove duplicate entries from any particular student, we asked parents for limited information, including the last 4 digits of a student’s social security number. We later updated our forms when we recognized that we could sufficiently separate legitimate contest entries while requesting less information. To be clear, these last 4 digits were not entered into our records and will be safely discarded.
The city of birth helps us identify whether contestants are eligible for the contest, as winners must be either U.S. citizens or permanent legal residents of the U.S. The information isn’t used for any other purpose.
VB’s research team is studying mobile user acquisition: Chime in here, and we’ll share the results.