Google Classroom

Is Google Classroom safe?

Yes, for its main job. Google Classroom is a closed space where teachers post work and pupils hand it in, and Google says it carries no ads and that its data is not used to target advertising. We score it 69/100, level with Google Drive (70) and well ahead of the consumer Google apps that pay for themselves with ads, such as Gmail (62).

The catch is who decides. With a school account, the school is the customer and Google works on its instructions. That keeps Google's commercial use in check, but it also means a parent usually cannot say no to Classroom, cannot delete the data directly, and has to trust that the school set it up well. Denmark's data regulator spent four years finding out that many schools had not.

What data does Google Classroom collect?

Apple's privacy label for Classroom lists no data used to track you and no advertising purpose. It is still a long list of data linked to the user: email address, contacts, coarse location, search history, user and device IDs, photos and audio from assignments, and how you use the app. Google Play shows a similar picture and says nothing is shared with other companies.

How much Google itself can do with that data depends on the account:

• School accounts (Workspace for Education). Google's education privacy notice, updated in August 2026, says core services such as Classroom show no ads and that their personal data is not used for advertising. Google for Education also says this data is not used to train AI models, and that the school, not Google, owns it.
• Extra services. If the school allows YouTube, Search or Maps, those run under Google's normal terms. Primary and secondary pupils get no personalised ads there, but Google acts as an independent controller.
• Personal Google accounts. Anyone can create or join a class with a personal account. Then Google's ordinary privacy policy applies, with no school contract in between.

Why did Denmark ban Chromebooks and Google Workspace in schools?

The case began in Helsingør, where a parent complained about how the municipality handled a child's data. In July 2022 Datatilsynet banned the municipality from using Chromebooks and Workspace for Education until it had done a proper risk assessment and stopped transfers outside the EU without adequate protection. It suspended the ban in September 2022 and gave the same four orders to 52 more municipalities, about half the country.

The key finding came on 30 January 2024. After reading the municipalities' own analysis, the regulator ruled that there was no legal basis for passing pupils' personal data to Google for some of Google's own purposes, and ordered 53 municipalities to stop by 1 August 2024. In July 2024 it accepted that 52 had complied, helped by contract changes under which Google processes the data only on the schools' instructions. In February 2026 it issued serious criticism and warnings to 51 municipalities over Google sub-processors outside the EU.

None of these decisions fined Google, and they were addressed to schools, which are the legal controllers. We count them because they describe how the product handled children's data, but less heavily than an order against Google itself.

The Netherlands took a negotiated route. Assessments for the Dutch education bodies SIVON and SURF found eight high privacy risks in Workspace for Education in 2019 and 2020. After the Dutch data protection authority stepped in, Google became a processor for Dutch public-sector users in 2021, and a 2024 verification concluded that no known high risks remain if schools apply the recommended settings. In the US, New Mexico's attorney general sued Google in 2020 over student data on Chromebooks; a federal judge dismissed the federal claims, accepting Google's argument that FTC guidance lets it rely on schools to give notice and obtain consent. The state appealed in November 2020; we found no published appeal ruling.

Fake class invitations

Classroom has no public feed, and teachers control who posts in a class. The weak spot is the invitation system. Between 6 and 12 August 2025, scammers created fake classes and sent more than 115,000 invitations to about 13,500 organisations, according to Check Point. The emails came from Google's own Classroom address, so they passed many spam filters, and they pushed people to continue the conversation on WhatsApp.

For pupils, the practical rule is simple: accept invitations only from teachers you know, for classes you expect. Schools can stop outsiders by allowing only accounts from their own domain to join.

How parents can check a school's setup

1. Ask the school whether pupils use school accounts (Workspace for Education) or personal Google accounts. School accounts carry the stronger contract.
2. Ask which extra services are switched on. Schools can block YouTube, Search and other consumer services for pupils' accounts.
3. Ask whether classes are limited to the school's own domain, which blocks fake invitations from outside.
4. Use guardian email summaries, if the school enables them, to see missing and upcoming work without logging in as your child.
5. Send data access or deletion requests to the school, not to Google. The school's administrator holds the controls.

How we scored it

Scams and harmful content (75) and security (74) are Classroom's strongest factors: classes are closed, held back by large-scale invitation phishing, and accounts get Google's protection, audited systems and no known breach of Classroom data. Transparency and control (58) is the weakest, because parents depend on the school for both consent and deletion. The Danish orders lower the regulatory record (72), though no fine has named Google.