'Doodle-4-Google' Collected Kids' Art, Social Security Numbers
The annual contest, called 'Doodle-4-Google,' was launched as a campaign to celebrate "the creativity of young people," and asked students to send in illustrations adhering to a simple theme: "What I'd like to do someday." In order to submit their drawings, though, all 33,000 students who entered the contest were required to provide Google with some of their personal data, including the last four digits of their social security numbers, hometown, date of birth, and parents' full contact information.
According to Bowdon, who recently directed a documentary on corruption in public schools, these basic data are all anyone would need to find out a lot more about any given child. "You see what Google knows and many parents don't know is that a person's city of birth and year of birth can be used to make a statistical guess about the first five digits of his/her social security number," he writes. "Then, if you can somehow obtain those last four SSN digits explicitly -- voila, you've unlocked countless troves of personal information from someone who didn't even understand that such a disclosure was happening."
Bowdon, by his own admission, has absolutely no evidence that Google used this information for private gain. But shortly after others notified the FTC about Bowdon's findings, the company removed the questionable fields from its application forms, except for the city of birth.
In response, Google defended its actions, on the grounds that the information it collected had been necessary to determine whether or not a child was eligible, and to make sure no student entered the contest twice. "We later updated our forms when we recognized that we could sufficiently separate legitimate contest entries while requesting less information," the company said in a statement. "To be clear, these last 4 digits were not entered into our records and will be safely discarded."
The city of birth, meanwhile, is apparently crucial to keeping the contest free of non-Americans. "The city of birth helps us identify whether contestants are eligible for the contest, as winners must be either U.S. citizens or permanent legal residents of the U.S," Google added. "The information isn't used for any other purpose."
Bowdon, however, still isn't convinced. As he points out, Google could have easily determined whether a contestant was a citizen or legal resident by adding a simple, 'yes/no' query to its forms, rather than asking for an exact city. Furthermore, the claim that "these last four digits were not entered into our records and will be safely discarded," does seem a bit contradictory. "How can they delete something that is not in their records?" the author asks.
Regardless of Google's ultimate intent, it's pretty clear that no kids' art contest should ever require that much personal information. What's even more startling, though, is that thousands of parents filled out these forms without ever asking themselves if they really should.