Hacker News Reader

Comment by eitally | Hacker News Reader

Education contracts do not allow Google to use customer data for advertising.

But they still store the data.

Same goes for any third party service using Google Cloud. Google technically stores the data. They still can’t use it though.

“Can’t”

Correct, "can't". Are you suggesting they secretly violate the contract and use the data anyway?

Would anyone be shocked if they did? Tech firms seem to be immune from the law.

Remind me in 10 years when the story breaks.

Hey ChatGPT, set a reminder for 2036 to tell me whether Google was found not to secretly violate TOS of School Chromebooks and use the data harvested from them to create value for it's shareholders.

they do not. I don't work there anymore and don't have any particular goodwill towards the employer that laid me off last year but I can guarantee that any data related to the education sector is under extremely strict controls.

surely you can take two minutes out of your day and do basic websearches for privacy class actions and settlements

https://www.classaction.org/news/microsoft-collects-massive-...

https://www.k12dive.com/news/week-in-review-april-6-2026/816...

https://www.ftc.gov/news-events/news/press-releases/2025/12/...

https://www.reuters.com/legal/government/journalists-sue-goo...

https://www.courthousenews.com/google-settles-class-action-o...

None of those have anything to do with Google for Education contracts, and I hope you realize that.

I really do not understand how anyone can give Google the benefit of the doubt in 2026. They literally make the law. They only adhere to the law when it makes financial sense.

Yes

After PRISM and Room 641A, anything is possible.

Right but stuff like PRISM is the government getting data. In this scenario “the government shouldn’t trust Google with data because it might end up in the hands of the government” doesn’t really make a lot of sense.

Legally they cannot, no. And sure, they could violate contracts and break data protection laws. But they’d be trading an enormous hit on their reputation, who knows how many hundreds of millions in educational contracts for, what, some basic demographic data on kids? Data they’ll almost certainly be able to get via other means once the kid becomes an adult?

I don’t like Google’s involvement in education. I don’t like Google much at all. But we should still be able to examine this stuff rationally without devolving into conspiracy theories that don’t make logical sense.

"reputation"

Honestly reputation isn't the main concern if you're in leadership there, although it is absolutely a concern. The main concern is having to do another consent decree with either the EU or the US government. Those are a complete pain in the ass.

What is the point this comment is trying to make? We can say this for every SaaS company on the planet.

No, because not every SaaS company is Google.

Until they turn 16 or 18.

How do you propose they offer the contracted services like MDM, GSuite (email, Drive, etc) without storing any of the data?

That isn't what the OP was alleging. Of course they store data -- encrypted both in transit and at rest, and you can even activate client side encryption (https://knowledge.workspace.google.com/admin/security/about-...) -- but that doesn't mean they exfiltrate, use or share your data for their own purposes.

They don't, they never have, and they won't (unless there is a blatant, illegal policy violation and lapse of controls internally). This is very similar to the controls and policies in place governing FedRAMP contracts or the control of PCI/financial or HIPAA/healthcare data.

Do you really think the engineering teams pour over those contracts when implementing new features?

Every single time? I sincerely doubt it.

Whatever logical business firewalls Google has between orgs for this kind of purpose seems pretty frail and thin from what I have seen reported.

This absolutely happens, there's a set of teams whose job it is to make sure it happens every time a system is going to be handling customer data. It's not left to the engineers to remember to do so.

They don't even need to know how to read the contract. But its not like engineers can ship whatever they want at a company the size of google.

So my question is, what have you seen reported and what makes you doubt it?

Tell me you've never worked at Google without telling me you've never worked at Google.

There are a lot of complaints you can legitimately levy, but "Google doesn't have enough of a compliance org to ensure eng behaves." is not one of them.

Yes, absolutely. Every microservice where I work is architecturally scrutinized by multiple groups over things like PCI, GDPR and SOX, with major features requiring review. And then third party auditors get to review stuff occasionally. PII is radioactive and PCI data is hard siloed.

If you work at a company that deals with education or HIPAA stuff, there's going to be even more of that.

Presumably Google aren't morons or criminals.

Reply on news.ycombinator.com