Table of Contents
Google Workspace for Education and Kids' Google Accounts: What Schools Can See and How to Stay Safe
Your child's school Google account gives the district real visibility into their activity — and personal Google accounts have their own risks. Here's what parents need to know about both.
During a school board meeting in a suburban district, a parent stood up and asked: “Can the school actually read my kid’s emails?” The district technology director paused, then answered honestly: yes, under certain conditions, and with appropriate policy oversight. The parent had assumed the school email account worked like personal email — private, individual, owned by the user. Instead, Google Workspace for Education gives school districts administrative tools that include the ability to review emails, audit Drive file access, and monitor search history on school-managed devices. This is not a scandal — it is disclosed in most districts’ acceptable use policies and serves legitimate purposes like preventing cyberbullying and detecting academic dishonesty. But very few parents have read those policies carefully, and most are operating on incorrect assumptions about what the school can and cannot see. This article covers both sides of the Google equation that affect your child: the school Workspace account and the personal Google account they use at home.
Key Takeaways
- Google Workspace for Education accounts (school-issued, ending in @schoolname.edu or similar) give school administrators visibility into Gmail, Drive, Classroom, and — on school-managed Chromebooks — browsing history.
- School visibility is governed by FERPA (Family Educational Rights and Privacy Act) and the district’s acceptable use policy; parents can request copies of their child’s activity logs as educational records in most cases.
- Personal Google accounts for children under 13 must be created through Google Family Link, which gives parents approval rights over apps, location access, and daily activity summaries.
- Children 13+ can create personal Google accounts without any parental involvement, oversight, or monitoring by default — Google treats them as adult users.
- The most common security risks for kids’ Google accounts are phishing via Google Forms (used in school contexts), account sharing (sharing Google credentials for “school collaboration”), and third-party app permissions accumulation.
Part 1: Google Workspace for Education — What Schools Can See
What Google Workspace for Education Is
When your child logs into Google at school using their school-issued email address (typically @students.districtname.org or similar), they are using Google Workspace for Education, not consumer Google. Google offers Workspace for Education in four tiers: Education Fundamentals (free), Education Standard, Teaching and Learning Upgrade, and Education Plus. As of 2025, over 170 million students and educators worldwide use Google Workspace for Education.
The key distinction: consumer Google accounts (gmail.com, personal) give Google data rights under its consumer privacy policy. Google Workspace for Education accounts are governed by a contract between Google and the school district. Under this contract, Google does not use student data for advertising purposes. But the school district, as the administrator of the Workspace domain, has extensive monitoring capabilities.
What School Administrators Can Access
Google gives Workspace administrators — typically district IT staff and designated administrators — a set of tools through the Admin Console and Google Vault (available in higher Education tiers).
Google Admin Console capabilities:
| Tool/Feature | What Administrators Can See |
|---|---|
| Gmail Audit | Email content, sent/received, attachments, search queries within Gmail |
| Drive Audit | Files created, shared, deleted, download history, sharing settings |
| Classroom | Assignment submissions, grades, teacher/student communication |
| Meet Audit | Meeting attendance logs, when calls started/ended |
| Chrome Browsing (managed devices) | Sites visited, search queries in Chrome if using school-managed Chromebook |
| Login Audit | When and from which IP address the account was accessed |
| Google Search (within Workspace) | Search queries performed while logged into school account |
Google Vault (archiving/legal hold): Vault allows administrators to retain and search all communications (Gmail, Chat, Meet transcripts) for legal, compliance, or disciplinary purposes. Not all districts pay for Vault, but districts with Education Standard or higher tiers have access to it.
What Schools Cannot See (On Non-Managed Devices)
If your child uses their school Google account on a personal device (home computer, personal phone), the school’s visibility is more limited:
- The school cannot see activity in other browser tabs that are not Google products.
- The school cannot see what the child does when logged OUT of the school account.
- Chrome browsing history is only visible to school administrators if the device is school-managed (a district Chromebook or a device enrolled in the district’s Mobile Device Management system).
In practice: on a school-issued Chromebook or iPad with MDM enrollment, the school has significant visibility. On a personal device using only the school Google account for Gmail and Classroom, the school can see account-related activity (emails, Drive) but not device-level browsing.
FERPA and Your Rights as a Parent
The Family Educational Rights and Privacy Act (FERPA) gives parents of students under 18 the right to inspect and review their child’s educational records. Courts and the Department of Education have increasingly interpreted digital school account data — emails about assignments, Classroom submissions, communications with teachers — as educational records subject to FERPA.
What this means practically:
- You can request that the district provide copies of your child’s Google Workspace activity logs by submitting a FERPA records request to the school principal or district records officer.
- Districts must respond within 45 days.
- Districts can decline to provide certain records if doing so would reveal information about other students (e.g., a thread with classmates), but they cannot wholesale deny access to records about your own child.
Most districts publish their Acceptable Use Policy (AUP) on their website. Search for your district’s name + “acceptable use policy” + “Google Workspace” to find what your district has disclosed about monitoring practices.
Part 2: Personal Google Accounts for Children
Under 13: Google Family Link
For children under 13, Google requires that personal accounts be created through Google Family Link — a free app that acts as a parental management layer. A parent sets up their own Google account as the supervisor, then creates the child’s Google account through Family Link.
What Family Link gives parents:
- Daily, weekly, or monthly activity reports showing apps used and time spent
- App approval: any Android app download requires parent approval via the Family Link app
- Location sharing: the child’s device location is visible on the parent’s Family Link app
- Screen time limits: daily limits and downtime schedules for Android devices (not iOS)
- Content filters: Google SafeSearch is enforced, Google Play Store content is filtered by age rating, YouTube access can be restricted to YouTube Kids
- Account supervision: the child cannot change their account settings, password, or birthday without parent approval
Critical limitation: Family Link on iOS is more limited than on Android. On an iPhone, Family Link can send app approval requests and show activity summaries, but the deeper device-level controls (screen time, downtime) are not available — Apple’s Screen Time system handles those on iOS devices. See our article on Apple ID Family Sharing settings for parents for the iOS side of this.
The 13-Year-Old Cliff
When a child reaches 13 (or the age of digital consent in their country — 16 in EU/GDPR regions), Google transitions their supervised account to a standard adult account. The parent receives a notification that supervision will end. After the transition:
- The parent loses all Family Link oversight automatically.
- The child’s activity reports, app approvals, and location sharing from Family Link end.
- The child gains full control of their Google account — including the ability to change their password, turn off two-factor authentication, and download any app.
Google offers the option to extend supervision after 13 if both parent and child agree, but the child can decline and Google does not compel continued supervision. This is the “Google at 13” problem — a sudden and complete removal of oversight at a developmental stage when, research shows, adolescent risk-taking tends to increase.
What parents can do at the transition: Have a direct conversation before the birthday. Agree on continued Google Family Link use voluntarily. Set up Google’s Safety features on the account together (Safe Search, YouTube Restricted Mode) as a shared agreement, not as enforced controls.
How to Secure a Teen’s Personal Google Account
For 13–17 year olds who have personal Google accounts outside Family Link, security hygiene matters. These accounts are targets for phishing and account takeover.
Two-Step Verification: Enable two-step verification (2FA) on every Google account, including teens’. Go to myaccount.google.com → Security → 2-Step Verification. Use the Google Authenticator app or passkeys rather than SMS verification, which is susceptible to SIM-swapping attacks.
Recovery account: Set a parent’s phone number and email as the account recovery options. If the teen forgets their password or loses access, recovery goes through the parent’s contact information.
Third-party app permissions: Over time, teens grant permissions to many third-party apps (“Sign in with Google” for gaming sites, school tools, etc.). These apps accumulate access to the Google account’s data. Review and revoke unused permissions at: myaccount.google.com → Security → Third-party apps with account access. Remove any app that was only used once or is no longer active.
Google Workspace Phishing: The School-Specific Threat
School Google accounts are targeted by a specific type of phishing attack that leverages the school context: Google Forms phishing.
A bad actor creates a Google Form — which generates a legitimate google.com URL — that mimics a school survey, a “verify your account” prompt, or a homework submission. The form asks for Google login credentials, name, or other personal information. Because the link comes from google.com (not a suspicious domain), students and even some adults do not recognize it as a phishing attempt.
In 2023, CISA (Cybersecurity and Infrastructure Security Agency) issued guidance specifically warning K-12 schools about phishing attacks using legitimate cloud service infrastructure, including Google Forms, to bypass email filtering.
What to tell your child: No Google Form will ever ask for your Google password. Google account login always happens at accounts.google.com, not inside a form. If any form asks for your school password, close it and tell your teacher immediately.
Other Google-Related Risks in School Contexts
Account sharing: Classmates sometimes share Google accounts to collaborate on Docs or “help” with assignments. Sharing credentials is against most schools’ acceptable use policies and creates security risk — anyone with the credentials can access the account’s Gmail, Drive, and personal data.
Google Meet recording: In schools using Google Meet for virtual classes or tutoring, meetings can be recorded by the host (teacher). Students should be aware that recordings may exist and could be reviewed by administrators.
Google Photos auto-backup: If a school Google account is signed into a phone and Google Photos is enabled, photos taken on that phone may auto-upload to the school-managed Drive or Google Photos. Review whether auto-backup is enabled: Photos app → Library → Photos on device.
Comparing School vs. Personal Google Account Privacy
| Feature | School Workspace Account | Personal Google Account (under 13) | Personal Google Account (13+) |
|---|---|---|---|
| Who administers | School district IT | Parent (via Family Link) | User (child) — no oversight by default |
| Can see email content | School admin can | Parent cannot | No oversight |
| Drive file visibility | School admin can | Parent cannot | No oversight |
| Browsing history | School managed devices only | Activity summary in Family Link | No oversight |
| App install approval | District-controlled | Parent approval required | User controls |
| Account recovery | District controls | Parent controls | User controls (parent can be recovery contact) |
| Advertising use of data | Google contractually prohibited | Google contractually prohibited | Google may use for ad targeting (personalization can be disabled) |
| Data deletion at graduation | District controls — varies | Parent can request deletion | User controls |
Privacy Settings Every Parent Should Verify
For school accounts, these settings are typically controlled by the district — but it is worth knowing what to ask about:
- Does your district use Google Vault? Vault stores all communication indefinitely. Ask the district’s IT department whether Vault is enabled.
- What happens to data when your child changes schools or graduates? Google Workspace data is owned by the district, not by Google. The district sets retention and deletion policies.
For personal Google accounts:
- myaccount.google.com → Data & Privacy → Ad personalization: Turn off personalized ads. Google will still show ads but cannot use your child’s activity data to target them.
- myaccount.google.com → Data & Privacy → My Activity: Review and delete search history, YouTube history, and app activity. Set auto-delete to 3 months.
- myaccount.google.com → Security → Your devices: Review which devices are logged into the account. Remove any unrecognized devices.
- YouTube Restricted Mode: On a teen’s account, turn on Restricted Mode in YouTube settings. It is not perfect but filters a significant portion of adult content.
What to Watch For Over 3 Months
- Month 1: Read your school district’s Acceptable Use Policy. Set up Google Family Link for any child under 13 who does not already have it. Enable 2-Step Verification on all Google accounts in the household. Set a parent’s email as the recovery contact for any teen’s personal Google account.
- Month 2: Review third-party app permissions on all Google accounts together (myaccount.google.com → Security → Third-party apps). Remove apps neither you nor your child recognizes. Check whether Google Photos auto-backup is uploading to unexpected locations.
- Month 3: Ask your child what Google tools they use most at school. Review the school’s AUP for any updates. If your child is approaching 13, discuss the Family Link transition and agree on voluntary continued safety practices before the account converts to adult.
Frequently Asked Questions
Can my child’s teacher read their Google Drive files?
If the files are shared with the teacher (which most Classroom assignment submissions are), yes. Teachers and administrators with domain-level Workspace administrative access can also access files that are not explicitly shared, depending on the district’s IT configuration and Google Workspace tier. Files in a student’s “My Drive” that have not been shared are generally not routinely reviewed, but can be accessed in an investigation.
Will Google’s Family Link let me see my child’s search history?
Google Family Link provides a summary of apps used and time spent, but it does not show specific Google search queries. You can view the child’s Google My Activity page (myactivity.google.com) if you have access to the child’s account credentials — it shows search history in detail. For Family Link-managed accounts, administrators can also access My Activity from the child’s device.
My child has a school Google account and a personal Gmail. Does the school see the personal account?
No. The school only has administrative access to the domain they manage (e.g., @students.districtname.org). They have no visibility into a separate personal Gmail account. However, if your child is logged into both accounts simultaneously on a school device, and the device has MDM enrollment, some district monitoring tools capture device-level activity regardless of which Google account is active.
Can I delete my child’s Google data after they leave a school?
The school district controls school account data — you would need to request deletion from the district, which has its own retention policies. For personal Google accounts, go to myaccount.google.com → Data & Privacy → Delete your Google Account or request a data takeout through Google Takeout (takeout.google.com) to download all data before deletion.
Is it safe for my child to use “Sign in with Google” on third-party websites?
“Sign in with Google” is generally safer than creating a new username/password on a site, because it does not expose a password to the third-party site. However, it does grant the third-party site access to basic Google account information (name, email, profile picture). More importantly, it creates a persistent connection that should be reviewed periodically and revoked for unused sites at myaccount.google.com → Security → Third-party apps.
About the author
Ricky Flores is the founder of HiWave Makers and an electrical engineer with 15+ years of experience building consumer technology at Apple, Samsung, and Texas Instruments. He writes about how kids learn to build, think, and create in a tech-saturated world. Read more at hiwavemakers.com.
Sources
- Google LLC. (2024). Google Workspace for Education privacy and security. Edu.google.com.
- Google LLC. (2024). Google Family Link help center: Manage your child’s account. Families.google.com.
- U.S. Department of Education. (2023). Family Educational Rights and Privacy Act (FERPA). Ed.gov.
- CISA (Cybersecurity and Infrastructure Security Agency). (2023). K-12 cybersecurity: Phishing and cloud services threats. CISA.gov.
- Pew Research Center. (2024). How teens navigate privacy and surveillance. Pewresearch.org.
- Federal Trade Commission. (2023). COPPA and children’s online privacy. FTC.gov.
- Electronic Frontier Foundation. (2023). Student privacy and school surveillance: What parents need to know. EFF.org.
