Case 1:20-cv-00143 Document 1 Filed 02/20/20 Page 1 of 24 IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF NEW MEXICO STATE OF NEW MEXICO, ex Case No. HECTOR BALDERAS, Attorney General for the State of New Mexico, Plainti? v. GOOGLE LLC, a Delaware limited liability company, Defendant. COMPLAINT Plaintiff, State of New Mexico, by and through Hector Balderas, Attorney General for the State of New Mexico, brings this Complaint against Defendant Google LLC, and alleges as follows: NATURE OF THE ACTION 1. Throughout the country, school districts are racing to bring technology into classrooms and Google has quickly become a dominant player in this space. In just a few years, Google has in?ltrated more than half the nation?s primary- and secondary-schools by offering a ?free? web-based service called Suite for Education (?Google Education?), which gives students access to Google?s Gmail, Calendar, Drive, Docs, and other applications. 2. Though Google Education has been marketed to schools, parents, and students as a free and purely educational tool, the use of Google Education and other Google products comes at a very real cost that Google purposefully obscures. 3. Google Education is now used by more than 80 million educators and students in the United States?including more than 25 million who use Google-powered laptops, called Case 1:20-cv-00143 Document 1 Filed 02/20/20 Page 2 of 24 ?Chromebooks,? in schools?essentially giving Google sole and exclusive access to millions of students? digital lives and their personal data. More valuable still, Google has captured generations of future customers who are trained to use Google?s platform as early as kindergarten. 4. To drive adoption in more schools?and to alleviate legitimate concerns about its history of privacy abuses?Google has been making public statements and promises that are designed to convince parents, teachers, and school of?cials that Google takes student privacy seriously and that it only collects education-related data from students using its platform. Google has also publicly promised never to mine student data for its own commercial purposes. 5. Unfortunately, Google has broken those promises and deliberately deceived parents and teachers about Google?s commitment to children?s privacy. In direct contradiction of its numerous assurances that it would protect children?s privacy, Google has used Google Education to spy on New Mexico children and their families by collecting troves of their personal information, including: their physical locations; websites they visit; every search term they use in Google?s search engine (and the results they click on); the videos they watch on YouTube; personal contact lists; voice recordings; saved passwords; and other behavioral information. 6. And until April 2014, Google also mined students? email accounts, extracted information about them, and used that data?along with the personal information described above?for advertising purposes. 7. These privacy concems?and the effects of Google?s misrepresentations and Case 1:20-cv-00143 Document 1 Filed 02/20/20 Page 3 of 24 exploitation of information asymmetry between itself, on one hand, and parents and teachers, on the other?cannot be overstated. While Google publicly positions Google Education as a benign tool that is an answer to resource-deprived schools nationwide, it secretly uses Google Education as a means to monitor children while they browse the Internet, including in their private homes, on their private computers and phones, and on their private networks. This is particularly concerning considering that teenagers turn to the Internet to search for issues they otherwise would be too embarrassed or afraid to ask ?'iends, parents, or relatives, such as general health information, sex education, diet advice, how to deal with bullying, anxiety and depression, puberty, and more.1 In fact, as many as four out of ?ve teenagers turn to the Internet to learn about health information, such as anxiety, ADHD, and sexually transmitted diseases."a 8. Google is aware of how problematic it is to mine children?s data in a commercial context. Outside of its Google Education platform, Google forbids children under the age of 13 in the United States from having their own Google accounts.3 But Google attempts to get around this by using Google Education to secretly gain access to troves of information about New Mexican children that it would not otherwise have. 9. The data Google accumulates is then stored in pro?les attributed to each student and used by Google for its own commercial purposes?as Google itself admitted in response to a 1 Teens, Heah?h, and Technology: A National Survey, Center on Media and Human Development, School of Communication, Northwestern University (June 2015), content/uploadszOl 15.pdf. 2 Id. 3 Age Requirements on Google Accounts, Google FAQs, (last visited February 20, 2020). Case 1:20-cv-00143 Document 1 Filed 02/20/20 Page 4 of 24 Congressional inquiry into the privacy practices associated with Google Education.4 10. Beyond breaking its own promises to respect and safeguard children?s privacy and exploiting the vulnerability of the parents, educators, and children of New Mexico, Google brazenly violates federal law prohibiting this very conduct. In 1998, Congress enacted the Children?s Online Privacy Protection Act, 15 U.S.C. 6501, et seq. in response to a growing concern over the collection of children's data on the Internet. In passing COPPA, Congress speci?cally sought to increase parental involvement in children?s online activities, ensure children?s safety during their participation in online activities, and most importantly, protect children?s personal information. Ultimately, Congress enacted COPPA with the speci?c goal of placing parents in control over what information is collected from their young children online. 11. To that end, COPPA requires?in relevant part?that websites and online services fully and clearly disclose their data collection, use, and disclosure practices, and obtain ?veri?able parental consent? before collecting, using, or disclosing personal information from children under 13. Further, COPPA requires websites and online services to permit parents to review all personal information they collect and maintain from children under 13, and to allow parents to refuse further use or maintenance of those data. Similarly, websites and online services may not condition a child?s use of a site or service on the collection of more personal information than is reasonably necessary, and must take reasonable steps to keep con?dential and safe any personal information in its possession. 4 Susan Molinari, Vice President, Public Policy and Government Relations, Americas, Google LLC February 12, 2016 Letter to Senator Al Franken, available at may use the data from additional services outside of the GAFE core services for the purposes described in our Privacy Policy, which include, for example, product improvement and product development?). Case 1:20-cv-00143 Document 1 Filed 02/20/20 Page 5 of 24 12. Google violates its obligations mandated by COPPA. Not only does it use its Google Education platform to collect children?s personal and sensitive information for its own commercial purpose without ?rst informing parents, let alone obtaining ?veri?able parental consent,? it also (1) fails to provide parents the ability to meaningfully review or limit the data collected and used, and (2) conditions use of its product on expansive (and unnecessary) collection and use of personal information. 13. These practices do not simply violate federal law, nor do they merely impact children under the age of 13. Covertly monitoring children of all ages, despite unambiguous representations to the contrary, violates longstanding rights rooted in the common law, as well as New Mexico?s statutory prohibitions on unfair, deceptive, and unconscionable business practices, codi?ed in the New Mexico Unfair Practices Act, N.M. Stat. Ann. 57-12-1, et seq. And, although not protected by COPPA, educators are likewise victims of Google?s practices as?in addition to its deceptive promises?Google similarly monitors teachers utilizing the Google Education platform when they browse the Intemet, including in their private homes, on their private computers and phones, and on their private networks. 14. Accordingly, the State of New Mexico, by and through Hector Balderas, Attorney General for the State of New Mexico, seeks all appropriate injunctive relief to address, remedy, and prevent harm to New Mexico residents resulting from Google?s misconduct, as well as civil penalties, fees, costs, and any other relief this Court deems proper. PARTIES 15. This action is brought for and on behalf of the sovereign State of New Mexico, by and through its duly elected Attorney General, Hector Balderas. The Attorney General, as chief legal of?cer of the State, is statutorily authorized to initiate and prosecute any and all suits Case 1:20-cv-00143 Document 1 Filed 02/20/20 Page 6 of 24 deemed necessary for the protection of the interests and rights of the State. See N.M. Stat. Ann. 8?5-2 (duties of the Attorney General). Speci?cally, the Attorney General is authorized to initiate and prosecute suits to penalize conduct that constitutes an unfair or deceptive trade practice. See N.M. Stat. Ann. 57-12?15 (enforcement of UPA). The Attorney General is further empowered to enforce COPPA via an action ?led in federal court. See 15 U.S.C. 6504 (civil actions by state attorneys general). The Attorney General is also charged with the duty of guardian of the public interest, which includes protecting the privacy interests of New Mexico?s citizens and the welfare of New Mexico?s children online. The State brings this action in its parens patriae and/or sovereign capacity. 16. Defendant Google LLC is a limited liability company organized and existing under the laws of the State of Delaware, with its headquarters and principal place of business located at 1600 Amphitheatre Parkway, Mountain View, California 94043. JURISDICTION AND VENUE 17. This Court has subject matter jurisdiction over this action pursuant to 28 U.S.C. 1331, 1337(a), and 1367. 18. This Court has personal jurisdiction over Google pursuant to NM. Stat. Ann. (.5 38-1?16 because Google engages in business transactions within the State of New Mexico, purpose?Jlly directs and/or directed its actions toward the State of New Mexico, collects and uses personal data from students, including those under the age of 13, in New Mexico, and/or has the requisite minimum contacts within the State of New Mexico needed to permit this Court to exercise jurisdiction. Further, Google has registered to do business within New Mexico in accordance with the New Mexico Business Corporation Act, N.M. Stat. Ann. 53-17-1 et seq., which amounts to consent to personal jurisdiction under relevant New Mexico law. See Case 1:20-cv-00143 Document 1 Filed 02/20/20 Page 7 of 24 Rodriguez v. Ford Motor Co., P.3d 2018 WL 6716038, *11-12 (N.M. Ct. App. Dec. 20, 2018) (?nding foreign corporation consented to jurisdiction in New Mexico by registering under N.M. Stat. Ann. 53-17-11); see also Schmidt v. Navistar, Inc, 2019 WL 1024285, *5-6 (D.N.M. March 4, 2019) (Slip Op.) (agreeing with Rodriguez . 19. Venue is proper in this district pursuant to 28 U.S.C. 1391 because a substantial part of the conduct giving rise to the State?s claims occurred in this District, and because Google transacts business in this District. FACTUAL BACKGROUND 1. An Overview of Suite for Education. 20. Google?s Suite for Education platform (formerly referred to as Google Apps for Education) is a web?based service marketed by Google as a free service to educational institutions, including K-12 schools. 21. The Suite for Education core services are at the heart of Google?s educational offering to schools and include Gmail (email), Calendar, Drive (cloud storage), Docs (word processing software), Sheets (spreadsheet software), Slides (presentation software), and more. 22. Google also provides Google-powered laptops to schools, called Chromebooks, which are low-cost laptop computers running on Google?s Chrome OS operating system and include the Chrome web browser. 23. Over 80 million educators and students now use Suite for Education and more than 25 million use Chromebooks in schools, including within New Mexico.5 5 All types of Chromebooks for all types of learners, Google, (last visited February 20, 2020). Case 1:20-cv-00143 Document 1 Filed 02/20/20 Page 8 of 24 II. To Drive Adoption Among Schools, Google Promises to Protect Student Privacy and Signed on to a Pledge Designed to Convince Parents, Teachers, and School Districts That There Are No Privacy Concerns With Google Education. 24. Google recognizes that ?trust is earned through protecting teacher and student privacy?6 and has made a number of public promises designed to convince parents, teachers, school districts, and students that it will protect the privacy of students who use Google Education. 25. To that end, in order to reaf?rm the commitments it has made over the years to safeguard and protect student privacy, including to school districts, Google signed the K-12 School Service Provider Pledge to Safeguard Student Privacy (the ?Student Privacy Pledge?) in or around January 2015. 26. The Student Privacy Pledge is a set of principles and promises developed by the Future of Privacy Forum and The Software Information Industry Association regarding the collection, use, and maintenance of student data? 27. Though not an original signatory, and hesitant to sign on3 (only succumbing after public outrage), Googled eventually signed the Student Privacy Pledge and af?rmatively and expressly committed to: Not collect, maintain, use or share student personal information beyond that needed for authorized educational/school purposes, or as authorized by the parent/student; 6 Privacy and Security, Google LLC, (last visited February 20, 2020). 7 Student Privacy Pledge Signatories, Future of Privacy Forum and The Software Information Industry Association, (last visited February 20, 2020). 8 Google Changes Course, Signs Student Data Privacy Pledge, Wall Street Journal, pledge! (last visited February 20, 2020). Case 1:20-cv-00143 Document 1 Filed 02/20/20 Page disclose student information collected through an educational/school service (whether personal information or otherwise) for behavioral targeting of advertisements to students; Not build a personal pro?le of a student other than for supporting authorized educational/school purposes or as authorized by the parent/student; Not knowingly retain student personal information beyond the time period required to support the authorized educational/school purposes, or as authorized by the parent/student; Collect, use, share, and retain student personal information only for purposes for which Google was authorized by the educational institution/agency, teacher, or the parent/student; and Disclose clearly in contracts or privacy policies, including in a manner easy for parents to understand, what types of student personal information Google collects, if any, and the purposes for which the information Google maintains is used or shared with third parties. 28. Google publicly promoted its decision to sign the Student Privacy Pledge and received positive coverage of its commitment. 29. As described in Section IV below, in direct contradiction to the express assurances and promises made through the Student Privacy Pledge, Google collects and records each student?s web browsing activities, the videos they watch on YouTube, and other information not generated for or related to educational purposes whatsoever. 111. Google Likewise Deceptively Markets Its Google Education Platform to Educators in Order to Increase Enrollment. 30. Beyond its privacy pledges, Google takes additional steps to encourage educators to adopt Google Education in their classrooms. 31. In its marketing materials, Google promotes the myriad bene?ts of implementing Google Education in the classroom. (See Figures 1?3, showing screenshots of Google?s webpages promoting some of the many resources available to teachers who implement Google Case 1:20-cv-00143 Document 1 Filed 02/20/20 Page 10 of 24 Education in their classrooms.) Spark learning with (3 Suite for Education A suite of tools designed to empower educators and students as they learn and innovate together. Sign up your institution for 6 Suite for Education. Get started Fi .1. To help expand learning for everyone Working to support education through our products, programs, and philanthropy. Fi .2. Teaching resources to empower learning in the classroom 55 Discover a broad selection oi apps. activities. lesson plans. digital literacy tools. and games to advance learning In the classroom including virtual field trips, lessons on coding. and more. 7A Explore teaching resources tal Literacy E. Fi . 3. 32. Google likewise provides various training tools and manuals designed to convince teachers to implement Google Education into their classrooms. 33. What is conspicuously absent from these marketing materials is any adequate ii} Case 1:20-cv-00143 Document 1 Filed 02/20/20 Page 11 of 24 disclosure that, by introducing Google Education to the classroom, Google will track and monitor students? web browsing activities and other information not generated for or related to educational purposes whatsoever. 34. In fact, Google actively misrepresents its privacy-violative conduct and provides educators with a false sense of security about its data collection practices. For example, on one of its promotional webpages, Google notes that its core services ?do not contain advertising nor do they use information in those services for advertising purposes." Google also claims that all of its Suite for Education core services support COPPA and FERPA compliance.? (See Figure 4 below, showing a screenshot from Google?s Google Education marketing website. Emphasis added.) Transform how your school works with our suite of free, secure tools 6 Suite core services do not contain advertising nor do they use information in those services for advertising purposes Plus, all Suite for Education core services support COPPA and FERPA compliance Fi . 4. 35. These representations are misleading. First, advertising is but one of an entire constellation of commercial purposes Google is prohibited from using student information for under COPPA, and a purported lack of advertising does not in any way mean COPPA compliance. Second, Google is implying that its products are compliant, but in reality Google is saying that its products merely ?support? compliance. It is unclear what ?supporting compliance? means in this context. Both of these statements are misleading because in reality, once Google Education is introduced into the classroom, Google uses it to vociferously collect children?s (and older students? and educators?) personal and 11 Case 1:20-cv-00143 Document 1 Filed 02/20/20 Page 12 of 24 sensitive information for Google?s own commercial purpose without ?rst informing parents, let alone obtaining ?veri?able parental consent? as required by COPPA. IV. Google Collects Virtually Everything That Students?Including Those Under 13? Do Online Through Google Education for its Own Commercial Purposes. 36. Today, more than half the students in the country use Google Education. 37. In schools that use Google Education, students are automatically assigned a unique username and password that identi?es the student with a particular Google Education account. 38. Students are typically given their Google Education credentials the ?rst day of classes and are immediately instructed?in the classroom?to log into their Google accounts on their private computers, mobile devices, and/or school-issued Chromebooks in order to use Google Education. 39. When students log into a school issued or personal Chromebook, Google will turn on the Chrome function by default. This, in turn, automatically starts uploading students? Chrome usage data?such as bookmarks, web searches, passwords, and online browsing habits?to Google?s servers. Google acknowledges in a help page that it can read this data but states: ?With a you can use Google?s cloud to store and your Chrome data without letting Google read it.?9 Unfortunately, the option to set such a to stop Google from reading private student data is off by default, and buried in settings that parents likely never see. 40. Students also are often encouraged to logon to their Google Education accounts 9 GoogIe Chrome Help, Google LLC, (last visited February 20, 2020). 12 Case 1:20-cv-00143 Document 1 Filed 02/20/20 Page 13 of 24 on the Chrome browser of their family?s personal computers. When doing so, an option exists to turn on Google and link the family?s existing Chrome usage data to the student's Google Education account?which associates even more personal data to the student?s Google pro?le. 41. Additionally, once students are signed into their Google Education accounts, Google uses cookies to identify students and begins collecting essentially everything they do online, including the names and URLs of websites searched and visited, and what videos they watch on 42. Google routinely and automatically collects this highly sensitive data regardless of whether students are using a school issued device or are logged into their Google Education account through a personal device. 43. Even if students af?rmatively log out of their accounts through a settings page, Goo gle permanently ties this data to their pro?les. 44. In its marketing materials, Google even boasts that kids as young as kindergarten- age in New Mexico now have Google email accounts and that all students will have access to their accounts for years after they graduate. (See Figure 5, showing a screenshot of Google Stories of Impact.) '0 This should be no surprise to Google. On September 4, 2019, the Federal Trade Commission, together with the New York Attorney General?s Of?ce, announced a $170 million settlement with Google?s video sharing subsidiary?YouTube?over allegations that it collected children?s personal information without their parents? consent in violation of COPPA. Until recently, Google also collected, on information and belief, children?s precise physical locations, mobile device contact lists (when signed into their mobile devices), and audio recordings of children?s voice notes and searches. 13 Case 1:20-cv-00143 Document 1 Filed 02/20/20 Page 14 of 24 OUTCOMES: Saving Money and Cultivating Relationships Cost Savings Sometimes It's the Little Things Pr or to Gorng Google. we put signi?cant time and money into file MESD is able to provide an additional perk that storage. software licensing. email servers, and local virus scanning wouldn't be possible if it wasn?t free' Now we enjoy all the features and bene?ts of Suite for Education for FREE . Graduating students have access to their accounts for years after they I 1130: account: to? all staff :an 1 Students Inc'od rig grunt graduate This helps them maintaln Ith Craniatlcatej spam and control: contact with teachers and community Web-based of?ce suite comparable to competing products members important to them as they 1 Unlrn ted ?le storage in the Google Drive cloud - and it?s all move into the workplace or further incrementai :y backed up! education. 1- Google Vault allows us to maintain extremely reliable and rapid backups and monitoring of email and documents for staff and students w.thout the fear of lost data or legal failures We are 7+ years into our Google adoption, and it still costs $0 per user! Grow lFig. 5.) 45. By tracking and cataloguing everything children do online and on their digital devices, Google has unprecedented visibility and access into the online lives of children across the country and speci?cally, in the State of New Mexico. 46. Ultimately, though it is marketed to schools as a purely educational tool, Google Education provides far more bene?t to Google than it does to students or schools. Google recognizes that by giving children free access to its online tools and habituating them at a young age, Google obtains something much more valuable: generations of future customers. 47. Google also uses the data it accumulates through Google Education for its own commercial purposes?as Google itself admitted in response to a Congressional inquiry into the privacy practices associated with Google Education.?2 48. Google likewise tracks and documents the online activity of teachers using ?2 Susan Molinari, Vice President, Public Policy and Govemment Relations, Americas, Google LLC February 12, 2016 Letter to Senator Al Franken, available at (?Google may use the data from additional services outside of the GAFE core services for the purposes described in our Privacy Policy, which include, for example, product improvement and product development?). 14 Case 1:20-cv-00143 Document 1 Filed 02/20/20 Page 15 of 24 Google Education through a Chrome browser or Chromebook without their prior knowledge or consent. V. Google?s Collection of Non-Educational Data from Students Violates its Own Privacy Promises as Well as Federal Law. 49. Despite its numerous assurances, Google has been using Google Education to spy on New Mexico children, teachers, and their families by collecting troves of their personal information?including by monitoring kids while they browse the Internet in their private homes, on their private computers and phones, and on their private networks?and using that data for its own commercial bene?t. 50. In addition to breaking its own promises, including those identi?ed in Sections 11? 111, Google does not provide adequate notice to the parents or the teachers of the tracked children about these data collection practices and, worst of all, does not obtain any form of veri?able parental consent before doing so. 51. Beyond thwarting parental autonomy by unlawfully collecting children?s information in the ?rst place, Google also robs parents of any control over the subsequent use of collected data. Further, it does not allow children to use the Google Education platform in a manner that allows children to avoid gratuitous collection of their personal information. Thus, Google uses its ability to provide schools?and thereby children, parents, and educators?with much needed resources in a deeply exploitative manner, forcing children to use products and services that will secretly (and unlawfully) monitor them, in order to receive an education. 52. Google?and not school districts?has an obligation to provide notice to parents and obtain their consent. After all, schools that partner with Google are not in a position to properly inform parents of the types of information that Google will be collecting from students, or to describe each use to which that information is put (indeed, only Google has full knowledge 15 Case 1:20-cv-00143 Document 1 Filed 02/20/20 Page 16 of 24 of the extent of its practices), and are likewise victims of Google?s practices themselves. 53. Google is required to inform parents of its data collection practices. It is also required to direct this notice at the parents of children whose data it seeks to collect and to obtain veri?able parental consent. 54. Google did not obtain veri?able parental consent via an online form, a toll-free number, a video-conference call?or by any other method allowed under COPPA or recognized under any other law?enabling a parent to accept or reject Google?s data collection practices. 55. Furthermore, the pop-up noti?cations that Google displayed to students when ?rst accessing their Google Education accounts are not intended nor available for review by the child?s parent. The noti?cations appear when the child uses his or her Chromebook computer or logs on to 3 Chrome browser in order to complete school work. 56. Even if such noti?cations fully informed a child of Google?s collection practices (they do not), such notice is insuf?cient under COPPA because children under 13 do not have the capacity to consent to Google?s data collection practices. 57. The consequences of Google?s tracking cannot be overstated: children are being monitored by one of the largest data mining companies in the world, at school, at home, on mobile devices, without their knowledge and without the permission of their parents. Vast amounts of personal data generated by the student while online will be captured by Google and added to the student?s pro?le. While purporting to offer only educational services, Google instead has stripped children and parents of autonomy and control of their most sensitive personal information, forcing children to acquiesce to constant monitoring, in perpetuity, in exchange for their education. 16 Case 1:20-cv-00143 Document 1 Filed 02/20/20 Page 17 of 24 FIRST CAUSE OF ACTION Violations of the Children?s Online Privacy Protection Act 15 U.S.C. 6501, et seq. 58. Plaintiff State of New Mexico incorporates the foregoing allegations as if fully set forth herein. 59. The Attorney General of the State of New Mexico is authorized to bring a civil action in the name of the State, against Google, to enforce regulations prescribed by COPPA and to secure remedies for violations of such regulations. See 15 U.S.C. 6504. 60. Under COPPA, an operator of a website or online service that collects personal information ?'om children must provide notice to the child?s parent about its data collection practices and obtain veri?able parental consent prior to any collection or use of personal information from children. A violation of this regulation is deemed unlawful. 16 CPR. 312.3. 61. COPPA de?nes a ?child? as ?an individual under the age of 13.? 16 312.2. 62. Google is required to comply with the requirements set out in COPPA because it has speci?cally developed the Google Education platform for use by students in grades K-12. Furthermore, Google has actual knowledge that children under the age of 13 use its apps and services. 63. Google is an ?operator? as contemplated by 16 CPR. 312.2 because it operates a ?Web site located on the Internet or an online service and who collects or maintains personal information from or about the users of or visitors to such Web site or online service . . . where such Web site or online service is operated for commercial purposes involving commerce among the several States or with or more foreign nations.? Indeed, students can access Google?s services online and Google provides its Google Education platform to schools in New Mexico 1? Case 1:20-cv-00143 Document 1 Filed 02/20/20 Page 18 of 24 and throughout the country. 64. Google ?collects? personal information from New Mexico children because it requests, prompts, or encourages a child to submit personal information online or it passively tracks children online. 65. Speci?cally, Google collects or has collected, on information and belief, New Mexico children?s browsing histories, their contact lists, and their audio notes and memos in the form of audio ?les containing the child?s voice. Google attributed, and continues to attribute, all data it collects ?'om children to their Google accounts with the child?s unique school email address. 66. Pursuant to 16 C.F.R. shall be the obligation of the operator to provide notice and obtain veri?able parental consent prior to collecting, using, or disclosing personal information from children. Such notice must be clearly and understandably written, complete, and must contain no unrelated, con?Jsing, or contradictory materials.? 67. Google has failed to provide notice to children?s parents of its data collection practices as required by 16 C.F.R. 312.4. Speci?cally, Google failed to give direct notice to parents, stating the types of personal information it seeks to collect from the child. 68. Any notice that Google provides is not intended for the child?s parent and contains terms that no child under the age of 13 would comprehend or would have the capacity to accept. 69. Further, Google failed to obtain?or even adequately attempt to obtain?upmental consent authorizing it to collect and use minors? personal and sensitive information. 70. Each instance of collection and use of a New Mexico child?s personal information in which Google violated COPPA in one or more ways described above constitutes a separate [3 Case 1:20-cv-00143 Document 1 Filed 02/20/20 Page 19 of 24 violation for which the State seeks: an injunction enjoining the practice and requiring compliance with COPPA, damages, restitution, or other compensation on behalf of residents of the State, and such other relief as the Court may consider to be appropriate. 71. Prior to ?ling this action, the State provided to the FTC written notice of this action and a copy of this Complaint, consistent with the requirements of 15 U.S.C. 6504. SECOND CAUSE OF ACTION Violations of the New Mexico Unfair Practices Act N.M. Stat. Ann. 57-12-1, et seq. 72. Plaintiff the State of New Mexico incorporates the foregoing allegations as if fully set forth herein. 73. Pursuant to Section 1303(c) of COPPA, 15 U.S.C. 6502(c), a violation of COPPA constitutes an unfair or deceptive act or practice in or affecting commerce, in violation of the FTC Act. 74. Section 57?12-4 of the New Mexico UPA provides that is the intent of the legislature that in construing Section 3 Stat. Ann. 57-12-3] of the Unfair Practices Act the courts to the extent possible will be guided by the interpretations given by the federal trade commission and the federal courts.? 75. As such, Google has engaged in unfair and deceptive acts or practices in violation ofN.M. Stat. Ann. 57-12-1, et seq. 76. Additionally, Google has made material misrepresentations and omissions, both directly and indirectly, related to the privacy-invasive and unlaw?11 behaviors and practices detailed herein. 77. Google has made material misrepresentations and omissions directly through, inter alia, its signing of the Student Privacy Pledge and through other public-facing documents 19 Case 1:20-cv-00143 Document 1 Filed 02/20/20 Page 20 of 24 such as websites, privacy policies, marketing materials, and public statements, in which it omits or otherwise conceals the full extent of the privacy violations detailed herein. 78. Similarly, Google has made material misrepresentations and omissions indirectly through representations and warranties as to, inter alia, the privacy-protective nature of its Google Education platform and its suitability for children. 79. As such, Google has engaged in additional unfair and deceptive acts or practices in violation of NM. Stat. Ann. 57-12-1, et seq. 80. Additionally, Google has engaged in unconscionable practices in violation of NM. Stat. Ann. 57-12-1, et seq. Google?s secret and unlaw?JI monitoring of children through Google Education takes advantage of the lack of knowledge, ability, experience, or capacity of the children, parents, and educators of New Mexico to a grossly unfair degree. Google purposely misrepresents and ob?Jscates its COPPA-violative conduct, which in turn results in the children of New Mexico being forced to use Google Education in order to participate in school. Google has complete control over the data collection, use, and retention practices of Google Education, and uses this control not only to secretly and unlawfully monitor and pro?le children, but to do so without the knowledge or consent of those children?s parents. Such exploitation, by Google, of its unique position and its unique knowledge occurs to the detriment of the children, parents, and educators in the State of New Mexico. 81. Google?s unfair, deceptive, and unconscionable acts or practices alleged herein may have, tended to, or actually have deceived or misled New Mexico consumers, including parents, teachers, school of?cials, and students. Further, Google has taken advantage of the lack of knowledge, ability, experience, or capacity of New Mexico consumers to the detriment of those consumers. Elf} Case 1:20-cv-00143 Document 1 Filed 02/20/20 Page 21 of 24 82. Each wrongful act or practice committed by or engaged in by Google in violation of the statute is an unfair, deceptive, and/or unconscionable act or practice in the conduct of trade or commerce, which is unlawful under the UPA. 83. Google?s violations were, and are, will?Jl, deceptive, unfair, and/or unconscionable. Google is aware of the violations, yet has failed to adequately and af?rmatively take steps to cure the misconduct. 84. Google?s willful violations justify assessing civil penalties of up to $5,000 for each violation of the UPA. 85. The State has determined that Google is using, and has used, methods, acts, and practices prohibited by the UPA, such that the imposition of an injunction against Google prohibiting the conduct set forth herein is in the public interest. Therefore, to prevent Google from continuing to engage in the violations as set forth herein, the State hereby seeks temporary and permanent injunctions prohibiting Google from engaging in the unfair, deceptive, and unconscionable policies, practices, and conduct described in this Complaint. 86. Google is liable to the State for restitution, in an amount to be determined at trial, arising out of Google?s deceptive and/or unfair methods, acts, and practices. THIRD CAUSE OF ACTION Intrusion Upon Seclusion 87. Plaintiff the State of New Mexico incorporates the foregoing allegations as if fully set forth herein. 88. The State of New Mexico brings this claim in its parens patriae capacity pursuant to New Mexico?s quasi-sovereign interest in the health and well-being of its residents. The State of New Mexico possesses an interest in this matter apart from the interests of private parties. The State of New Mexico acts herein as a representative of its citizens to redress injuries that affect Case 1:20-cv-00143 Document 1 Filed 02/20/20 Page 22 of 24 the general population of New Mexico in a substantial way. 89. Citizens of the State of New Mexico have reasonable expectations of privacy in their online behavior. New Mexico citizens? private affairs include their behavior on the Internet, including the Google Education platform, other Google services, and any other behavior that may be monitored by the surreptitious tracking employed or otherwise enabled by Google?s behavior described herein. 90. The reasonableness of such expectations of privacy is supported by Google?s unique position to monitor New Mexico citizens? behavior through the Google Education platform, a suite of technological services that students must use in order to receive their education. It is further supported by the surreptitious, highly-technical, and non-intuitive nature of Google?s tracking. 91. Google intentionally intruded on and into New Mexico citizens? solitude, seclusion, and/or private affairs by intentionally designing the Google Education platform to surreptitiously obtain, improperly gain knowledge of, review, and/or retain New Mexico citizens? activities through the monitoring technologies and activities described herein. 92. These intrusions are highly offensive to a reasonable person. This is evidenced by, inter aka, the legislation enacted by Congress, including COPPA itself, rules promulgated thereunder, enforcement actions undertaken by the FTC and State Attorneys General, and countless studies, op-eds, and articles decrying the online tracking of children. Further, the extent of the intrusion cannot be fully known, as the nature of privacy invasion involves the collection and use of New Mexico citizens? personal information, for undisclosed and potentially unknowable purposes, in perpetuity. Also supporting the highly offensive nature of Google?s conduct is the fact that Google?s principal goal at all times has been to surreptitiously monitor 22 Case 1:20-cv-00143 Document 1 Filed 02/20/20 Page 23 of 24 New Mexico children?in one of the most private spaces available to an individual in modern life?under the au5pices of providing educational services, which students and their parents are o?en powerless to refuse. 93. New Mexico citizens were harmed by the intrusion into their private affairs as detailed throughout this Complaint. 94. Google?s actions and conduct complained of herein were a substantial factor in causing the harm suffered by New Mexico citizens. 95. As a result of Google?s actions, the State seeks injunctive relief in the form of Google?s cessation of practices in violation of COPPA and the UPA, and destruction of all personal data obtained in violation of COPPA and the UPA. 96. As a result of Google?s actions, the State seeks nominal and punitive damages in an amount to be determined at trial. The State seeks punitive damages because Google?s actions?which were malicious, oppressive, and willful?~were calculated to injure New Mexico citizens and made in conscious disregard of New Mexico citizens? rights. Punitive damages are warranted to deter Google from engaging in future misconduct. PRAYER FOR RELIEF WHEREFORE, Plaintiff State of New Mexico reSpectfully requests that this Court enter an Order granting the following relief: A. Declaring that Google?s actions constitute violations of COPPA, violations of the FTC Act, violations of the UPA, and intrusion upon seclusion; B. Enjoining Google and its employees, of?cers, directors, agents, successors, assignees, merged or acquired predecessors, parent or controlling entities, subsidiaries, and all other persons acting in concert or participating with it, from affecting commerce within the State 23 Case 1:20-cv-00143 Document 1 Filed 02/20/20 Page 24 of 24 of New Mexico by engaging in unfair methods of competition and unfair or deceptive trade practices in violation of New Mexico or federal law, and ordering temporary, preliminary, or permanent injunctive relief; C. Awarding the State civil penalties in the amount of $5,000 for each will?Jl violation of the D. Awarding the State damages, restitution, or other compensation; E. Awarding the State its reasonable attorneys? fees and costs; F. Awarding the State pre- and post-judgment interest, to the extent allowable; G. Awarding such and other injunctive and declaratory relief as is necessary; and H. Awarding such other and further relief as the Court deems reasonable and just. Dated: February 20, 2020 Respectfully submitted, ATTORNEY GENERAL OF NEW MEXICO HECTOE H. BALDERAS By: Brian E. McMath bmcmath@nmag. gov P. Cholla Khoury ckhoury@nmag.gov CONSUMER ENVIRONMENTAL PROTECTION DIVISION NEW MEXICO OFFICE OF THE ATTORNEY GENERAL Post Of?ce Drawer 1508 Santa Fe, New Mexico 87504 Tel: 505.717.3531 Fax: 505.318.1050 24