Why would Google need the date of birth, city of birth, and last four digits of children’s social security numbers for what is supposed to be an innocent art project? Was it to try to get parents to unknowingly hand over the full social security numbers of their own children, while providing Google with invaluable marketing data?
The fourth annual Doodle 4 Google contest kicked off in January, and one of the requirements on the original consent form required the last four digits of children’s social security numbers, as well as their date of birth and city of birth.
This information, when used together, can be used to make a pretty good guess about full social security numbers, according to Bob Bowdon, director of “The Cartel,” a documentary about corruption in American public education. Writing on the Huffington Post, he noted:
You see what Google knows and many parents don’t know is that a person’s city of birth and year of birth can be used to make a statistical guess about the first five digits of his/her social security number. Then, if you can somehow obtain those last four SSN digits explicitly — voila, you’ve unlocked countless troves of personal information from someone who didn’t even understand that such a disclosure was happening.
After Bowdown began investigating the legality of this, Google quickly changed the entry form. They also responded with the following statement:
This year we started accepting doodles from kids even if their school hadn’t registered for the contest. To help us keep entries distinct and remove duplicate entries from any particular student, we asked parents for limited information, including the last 4 digits of a student’s social security number. We later updated our forms when we recognized that we could sufficiently separate legitimate contest entries while requesting less information. To be clear, these last 4 digits were not entered into our records and will be safely discarded.
As for the city of birth:
The city of birth helps us identify whether contestants are eligible for the contest, as winners must be either U.S. citizens or permanent legal residents of the U.S. The information isn’t used for any other purpose.
Odd that Google claims they didn’t enter those four digits into their records, considering Google’s contest privacy notice said that “participation constitutes consent to the storage, use and disclosure of the Entrant’s entry details….”
Talk about Google getting right up to the creepy line…