Only Evil When You're Not Looking

I generally get the salt shaker out when privacy advocates start complaining about Google. Do I care if Google knows that someone from this IP shops for bulk hydraulic fluid? Nope, I don't give it a second thought. But this is a little creepy:

"Doodle-4-Google" is so much more than an art contest. Sure, the game, which received 33,000 entries last year, celebrates "the creativity of young people" by having them send in a drawing under the theme "What I’d like to do someday …" But, there's another component, as well. It also helps Google collect some very personal data on students K through 12. Along with the submission, the contest's initial Parent Consent Form asked for the child's city of birth (not current city, mind you), date of birth, the last four digits of the child's social security number, as well as complete contact info for the parents. Bob Bowdon, who directed The Cartel, a documentary about corruption in the public-school system explained the significance:

You see what Google knows and many parents don't know is that a person's city of birth and year of birth can be used to make a statistical guess about the first five digits of his/her social security number. Then, if you can somehow obtain those last four SSN digits explicitly — voila, you've unlocked countless troves of personal information from someone who didn't even understand that such a disclosure was happening.

If the information Google culled from the contest was linked with other databases to target ads, it could prove lucrative for the company, which enlists promotional help from schools by offering prize money. But Bowdon says he has no evidence that Google has used what it learned for marketing purposes.

OK so looks like Google overstepped in their information gathering. So they'll apologize and never do it again, right? Well no; Google responds:

This year we started accepting doodles from kids even if their school hadn't registered for the contest. To help us keep entries distinct and remove duplicate entries from any particular student, we asked parents for limited information, including the last 4 digits of a student's social security number. We later updated our forms when we recognized that we could sufficiently separate legitimate contest entries while requesting less information. To be clear, these last 4 digits were not entered into our records and will be safely discarded.

The city of birth helps us identify whether contestants are eligible for the contest, as winners must be either U.S. citizens or permanent legal residents of the U.S. The information isn't used for any other purpose.

What? an e-mail address wouldn't be identification enough? And wouldn't it be easier to check your winner for citizenship after they win, rather than check every contestant? No, Google, it's obvious you were gathering data, and "Oh, we gathered that by accident" won't cut it this time. Stop being creepy and evil guys.

(I post this with some trepidation, because AWL has a pretty good Google page rank. Would they downgrade me because of criticism? I wouldn't think so, but up until today I wouldn't have expected them to be data mining children.)