Google Chat CIPA Compliance in Remote Learning

Is Your District’s Use of Google Chat CIPA Compliant?

Google Chat CIPA compliance and G Suite for Education security are bigger issues today than in the past. The coronavirus has forced many districts to transition to remote learning while schools are closed. Before the pandemic struck, there was already a wave of school districts starting to use G Suite for Education. Today, that wave is a tsunami.

School closings happened just as suddenly as a tsunami, too. Educators needed to put together processes, tools, and technologies to support remote learning on the fly. As a result, many districts could be vulnerable to CIPA compliance issues, among others.

Planning for the next school year is another challenge. Some districts don’t know if they’ll be educating in classrooms next year or not, and many are creating contingency plans. Further, almost every district is considering which of their new remote learning tools they will continue to use, regardless of where education is going to take place.

Along with monitoring Google Meet, district IT teams are challenged with keeping their district’s use of technology compliant with student data privacy and safety regulations. Unlike monitoring Google Meet, in which IT teams can at least use Google Meet best practices and the Meet Quality Tool, Google Chat is a particular blind spot and compliance issue. The app has fewer controls and fewer auditing options built natively into the platform.

Every school district needs to ensure that the tools they use comply with regulations like CIPA, which requires not only protecting minors from inappropriate content on the internet but also monitoring the online activities of minors.

In the scramble to transition to remote learning, it would have been easy to overlook creating a way to monitor applications like Google Chat.

What is Google Chat?

Google Chat is a messaging platform that is included in G Suite for Education. Students use Chat to communicate with each other throughout the day, and they can message their teachers to ask for help.

Some school districts have disabled Google Chat because of the safety and compliance risks it can present. Others allow students to use the district’s Chat domain to prevent them from moving to another chat platform where there would be no oversight. Those districts can monitor what is happening on the Chat if they have the right tools.

Is Google Chat CIPA Compliance an Issue?

Google Chat is an internet activity that does fall under the CIPA requirement for monitoring activity. Google does provide a range of G Suite for Education security features included in its product—though the most comprehensive ones are reserved for the Enterprise license. While Google complies with FERPA and COPPA, the company doesn’t have any published CIPA compliance documentation.

It’s important to keep in mind that, when it comes to securing data and monitoring student behavior in G Suite, Google doesn’t take responsibility for ensuring that their apps comply with CIPA, or any other regulation for that matter. That responsibility always resides with the customer!

You know you need to take responsibility for things like Google cloud security, and for following G Suite security best practices to secure your district’s domain. And, the CIPA requirement for student activity monitoring is something that needs to be applied to all Google apps that are provided to students.

How to Monitor Google Chat for CIPA Compliance

These two steps will ensure that you have the activity monitoring in place that CIPA requires.

1. Configure Chat in Your Admin Console

Start by configuring Google Chat in your Admin Console. You can increase overall security by not allowing students to chat with anyone outside of the school’s domain. You’ll also want to archive chats in Google Vault. If there is a problem with an exchange in Chat, you can use the Vault archive to review that particular exchange.

2. Use Third-Party Google Partners to Monitor Chat Activity

Unfortunately, Google doesn’t provide robust Google Chat CIPA compliance monitoring tools natively. But, you can work with a third-party Google for Education partner to allow admins to continuously monitor G Suite for Education apps, including Google Chat, for CIPA compliance.

For example, you can use ManagedMethods to let admins set up both G Suite data loss prevention and student safety signals policies. That will ensure that your Google Chat is FERPA, HIPAA, and CIPA compliant. The software uses AI and text-based rules to flag:

• Student safety signals such as self-harm, cyberbullying, discrimination, domestic abuse, and more
• Data security and student data privacy risks such as the sharing of personally identifiable information using Chat

Google Chat has long been a data security and student safety blind spot for school districts. This problem has increased exponentially with the transition to remote learning. More and more students, teachers, and staff are now using Google Chat and very little activity monitoring is taking place. Google Chat CIPA compliance is required, whether students are in the classroom or learning remotely.

Further, if you don’t monitor and secure Google apps, you’re opening the door to data security and data privacy issues. Google cloud monitoring is something that needs to be a permanent part of your data security plan no matter how (or where) your students are attending classes.