In 2015, Google signed the Student Privacy Pledge — a promise not to collect children's data for non-educational purposes. The same year, EFF caught Chrome Sync silently uploading every student's browsing history, passwords, and bookmarks to Google's servers. Google promised to fix it. In 2020, New Mexico sued over the same thing. In 2025, another federal lawsuit alleged the same thing. Three lawsuits in ten years. The pledge is a decade-old broken promise Google renews every time it gets caught. Google tells schools it never uses student data for advertising. A 2025 federal lawsuit alleges Google builds a unique digital fingerprint of every student — what they browse, what apps they use, what they search — then uses those profiles to sell more Google products to schools. Seventy percent of American schools use Google Workspace. That's potentially 50 million children profiled to help Google sell more Google.
What they claim: Google claims it does not collect biometric data from students without consent.
What we found: A class action lawsuit alleged Google collected voiceprints and facial templates from children using school-issued Chromebooks, in violation of Illinois BIPA and federal COPPA. Children using Google services on school devices had biometric identifiers collected without parental knowledge or consent.
What they claim: Google claims student data stays within the education environment and is used only for educational purposes.
What we found: New Mexico AG documented that data collection "bled over" into children's home activities. When students took Chromebooks home, Google's surveillance extended from the classroom to the living room, tracking browsing, search, and YouTube activity 24/7 — evenings, weekends, and holidays.
What they claim: Google Education privacy page: "We do not use personal information from users in primary and secondary schools to target ads." "Student personal data is never sold to third parties."
What we found: The 2025 Schwarz v. Google lawsuit alleges Google creates unique "fingerprints" of each student's online activity — recording internet activity, websites visited, and apps used — then uses these profiles to market additional Google products to schools. The lawsuit covers approximately 70% of US schools that use Google Workspace for Education.
What they claim: Google markets ChromeOS as "secure by design" and "privacy-first."
What we found: After the Auto Update Expiration date, Chromebooks receive zero security patches. Unlike Windows or macOS laptops which receive updates for 10+ years, pre-2021 Chromebooks get as few as 6 years of support. Google extended to 10 years only for devices from 2021 onward — leaving millions of older devices permanently vulnerable.
What they claim: Google claims Chromebooks reduce costs for schools and are an economical choice for education.
What we found: The forced obsolescence cycle means schools must replace entire fleets every 4-6 years. Doubling Chromebook lifespan would save taxpayers $1.8 billion and cut carbon emissions equivalent to taking 900,000 cars off the road for a year. Only 1/3 of end-of-life Chromebooks are recycled; 2/3 go to landfill.
What they claim: Google signed the Student Privacy Pledge promising not to collect student data for non-educational purposes.
What we found: EFF's 2015 FTC complaint found Chrome Sync was enabled by default on school Chromebooks, uploading students' entire browsing history, bookmarks, saved passwords, and open tabs to Google servers. The 2020 New Mexico AG lawsuit and 2025 Schwarz v. Google lawsuit allege the same practice continues a decade later — three lawsuits over ten years for the same violation.
What they claim: Google for Education: "Google Workspace for Education can be used in compliance with FERPA, COPPA, and GDPR."
What we found: In Helsingor, Denmark, schools created Google accounts for students without parents' knowledge or consent — children's real names appeared on YouTube and Gmail. New Mexico AG Hector Balderas found Google collected location data, voice recordings, browsing history, and search terms from children as young as 7 without parental consent. COPPA requires verifiable parental consent for children under 13.
What they claim: Google Workspace for Education FAQ: "School data is owned and managed by the organization, not Google." Google's response to Danish DPA: "Schools own their data."
What we found: The Danish Data Protection Authority found Google acts as an independent data controller — not just a processor — processing student data for its own purposes, not just at the school's direction. The DPA noted its conclusions "will probably apply to other municipalities." Denmark banned Chromebooks and Google Workspace in schools outright in July 2022.
What they claim: Google claims Workspace for Education is GDPR-compliant and meets European data protection standards.
What we found: Denmark banned Chromebooks and Google Workspace in schools in July 2022 for GDPR violations — the fourth EU country to impose restrictions. The Netherlands forced schools to disable ad personalization, spell-checking, and machine translation just to meet baseline privacy. Google eventually built a special Dutch version of ChromeOS, tacitly admitting the standard version wasn't safe for children.
What they claim: Google markets Chromebooks as affordable, cost-effective devices for education.
What we found: Chromebooks have an Auto Update Expiration (AUE) date after which they receive zero security patches. Average lifespan: ~4 years vs 6-8 for traditional laptops. 31 million Chromebooks sold during the pandemic are expiring in 2025-2026. Only 1/3 of expired devices are recycled. PIRG estimates extending Chromebook lifespans could save taxpayers $1.8 billion. Doubling lifespan would cut emissions equivalent to taking 900,000 cars off the road.
What they claim: Google promises Chrome Sync settings give users control over their data.
What we found: New Mexico AG found the option to disable sync was "buried in settings that parents and students likely never see." Students as young as 7 are expected to navigate Google's privacy settings to protect themselves from data collection by one of the world's largest companies.
What they claim: Google promised the FTC it would reform Chrome Sync practices after EFF's 2015 complaint.
What we found: Ten years and three lawsuits later (EFF 2015, New Mexico 2020, Schwarz 2025), the same fundamental allegation persists: Google collects student data through Chrome Sync and uses it for non-educational purposes. Each time, Google promises change. Each time, the next investigation finds the same practices.
What they claim: Google claims students' education accounts are "completely separate" from personal Google accounts and services.
What we found: Senator Al Franken wrote to CEO Sundar Pichai noting "a discrepancy" in how Google treats data from education-specific apps versus other Google services students access while logged into their education accounts. Students logged into Workspace for Education still access YouTube, Search, and other Google services where different data policies apply.