Safe File Sharing for Students: Google Drive, OneDrive, and What Parents Need to Set Up

A middle school teacher in Colorado discovered in 2022 that a student’s science project — containing the student’s full name, grade level, home city, and family photos — had been shared via a Google Drive link set to “Anyone with the link can view.” The student had sent the link to their teacher, who had forwarded it to another teacher for review, who had sent it to a parent volunteer, who had posted it in a parent Facebook group as an example of good student work. Within 48 hours, the link was accessible to anyone who found the Facebook post. The student had no idea. This is the default behavior of “Anyone with the link” sharing — a feature designed for convenience that creates a privacy gap few students understand.

Key Takeaways

• “Anyone with the link” sharing in Google Drive makes a file accessible to every person who receives or finds the link — there’s no limit on who that link can be forwarded to.
• Google Workspace for Education accounts have tighter defaults than personal Google accounts — files shared from school accounts are often restricted to the school domain by default.
• OneDrive in Microsoft 365 for Education has similar controls, but the default sharing settings vary by whether the institution has configured them.
• WeTransfer and similar services create temporary download links, which expire — safer for one-time homework submission than a persistent Drive link.
• The single most important habit: always use “Share with specific people” instead of “Anyone with the link” when sharing school documents.

How Students Actually Share Files (and What Goes Wrong)

The Four Common Sharing Scenarios

Scenario 1: Submitting homework to a teacher The most common school sharing scenario. Best practice: submit through the learning management system (Google Classroom, Canvas, Schoology) which manages permissions automatically. When done via email or a direct link, students often use “Anyone with the link” out of convenience.

Scenario 2: Collaborating with classmates on a group project Students need real-time co-editing. Google Docs/Slides collaborative editing is excellent for this. The risk: students sometimes share the edit link broadly instead of inviting specific classmates by email.

Scenario 3: Sharing finished work for a portfolio or presentation Students share links to parents, judges, or audiences. This is where “Anyone with the link” becomes an indefinite public share that may never get revoked.

Scenario 4: Transferring files between school and personal devices Students email files to themselves or use a shared Drive folder. Relatively low risk, but students sometimes create shared folders on personal (non-school) accounts with weak privacy settings.

What “Share With” Settings Actually Mean

Setting	Who Can Access	When It Ends	Risk Level
Specific people (by email)	Only named individuals	Never unless you remove them	Low
Anyone in your organization (school domain)	Anyone with a school login	Until you change it	Low-Medium
Anyone with the link — View	Anyone who gets the link, forwards it, or finds it	Never unless revoked	High
Anyone with the link — Edit	Same as above, plus anyone can change the document	Never unless revoked	Very High
Anyone with the link — Comment	Anyone can add comments, owner gets notifications	Never unless revoked	High

“Specific people” sharing is always the safest option. The file only appears in the named person’s Drive when shared to their email — it cannot be passed along by link.

Google Drive: Step-by-Step Privacy Configuration

Sharing a Single File Safely

1. Right-click the file in Google Drive → click Share.
2. In the “Add people and groups” field, type the recipient’s email address (teacher, classmate).
3. Set the permission level: Viewer for homework submissions (teacher can see but not change), Editor for collaborative work.
4. Uncheck “Notify people” if you’re adding a teacher to something they’ll review later.
5. Click Send.

Important: Before sending, click Copy link and look at what appears. If it says “Restricted — only people with access can open,” that’s correct for a specific-person share. If it says “Anyone with the link,” change it:

• Click the link permissions dropdown → select Restricted.

Reviewing What You’ve Already Shared

1. Open Google Drive → click Shared with me in the left panel to see what others have shared with you.
2. To see what you’ve shared: right-click any file → Share → review who has access.
3. To audit broadly: go to drive.google.com → in the search bar, type is:shared — this shows all files you’ve shared with anyone.

Revoking Access After a Project Is Complete

1. Right-click the file → Share.
2. Find the person’s email → click the permission dropdown → Remove.
3. For “Anyone with the link” files, click the link access dropdown → change to Restricted.
4. Click Save.

Teaching moment: Revoking access should be a routine step at the end of every school project, the same way students were taught to put materials away after a lesson.

Google Workspace for Education vs. Personal Google Accounts

If your child’s school uses Google Workspace for Education, the account is managed by the school’s IT administrator, not Google directly.

What this typically means:

• Files created on the school account may default to “school domain only” sharing — students cannot accidentally share with strangers using school accounts, because “Anyone with the link” may only work within the school domain.
• The school IT admin can see files in students’ Drive accounts on the school system.
• Files belong to the school, not the student — when a student leaves the school, the account (and files) may be deleted or transferred.

What parents should check:

• Does your child use their school Google account or their personal account for homework? Mixing personal files into a school account is common and creates confusion about who owns the data.
• Ask the school’s IT coordinator what sharing restrictions are in place on student accounts.

OneDrive and Microsoft 365 for Education

Microsoft’s school offering (M365 Education) functions similarly to Google Workspace. Students have school-managed OneDrive accounts.

How to Share Safely in OneDrive

1. Right-click the file in OneDrive → Share.
2. Click the link settings dropdown — it may show “Anyone with the link.”
3. Change to Specific people → type the recipient’s email.
4. Set an Expiration date (a powerful OneDrive feature Google Drive doesn’t have for free users) — set it to the project due date so access automatically expires.
5. Click Apply → Send.

OneDrive’s expiration date feature is underused by students and parents but valuable: a homework submission link can automatically expire after the grading period, so teachers’ access doesn’t persist indefinitely.

Checking OneDrive Sharing Settings

1. Open OneDrive (web browser at onedrive.live.com or Microsoft 365 portal).
2. Click My Files → hover over a file → click the Share icon.
3. Click Manage access to see a full list of who has access and with what permissions.

WeTransfer and Other File Transfer Services

For one-time homework submission to a teacher who doesn’t use Drive or OneDrive, WeTransfer is a practical alternative:

• Free tier: Upload up to 2GB, send a download link that expires in 7 days.
• No account required for the recipient.
• Automatically expires — no persistent public link.

Risk to understand: Files uploaded to WeTransfer (free tier) are not encrypted end-to-end. WeTransfer can access the files. For most homework submissions, this is acceptable. For documents containing sensitive personal information, it’s not ideal.

Other options for one-time file sharing:

• Google Drive “Specific people” share with expiration: Best for school-to-school sharing within Google ecosystem.
• Email attachment: Still appropriate for small files (under 25MB). The file goes directly to the recipient with no persistent link.
• Dropbox Transfer: Similar to WeTransfer, with 100MB free transfer limit and expiring links.

The “Edit by Accident” Problem

This is one of the most common student file-sharing mistakes: sharing a document with “Editor” access when only “Viewer” was intended, or sharing a collaborative group doc publicly with “Anyone can edit.”

When a Google Doc is shared with “Anyone with the link can edit,” anyone who finds the link — through a forwarded email, a post, or a search — can make changes to the document, delete content, and even add malicious links. This has been used to vandalize students’ projects.

Prevention:

• Default to Viewer for all homework submissions — teachers don’t need edit access to grade.
• Default to Commenter for teacher feedback — they can annotate without changing content.
• Reserve Editor for actual collaborative documents where all editors are named individuals.

What to Watch For Over 3 Months

Month 1: Audit your child’s Google Drive or OneDrive. Have your child log in while you watch. Search for is:shared in Google Drive. Look at every file with sharing enabled. For any file shared with “Anyone with the link,” change it to “Restricted” unless there’s an active reason to keep it public. This is usually a 15-minute exercise that reveals surprising things.

Month 2: Establish the “specific people” habit for new projects. When your child starts a new school project, watch them set up the sharing. Correct toward “specific people by email” sharing early rather than “anyone with the link.” One corrected project creates a habit more effectively than a general rule.

Month 3: Check for school account vs. personal account mixing. Look at what’s in the school Google or Microsoft account vs. the personal account. If personal photos, family documents, or sensitive files have ended up in the school account, move them to the personal account. School accounts are managed by the institution — school IT staff can potentially access them.

Frequently Asked Questions

My child shared a Google Drive link in a class group chat. How do I make it private again? Open the file in Google Drive → right-click → Share → find the link access setting → change from “Anyone with the link” to Restricted. Anyone who already has the link will immediately lose access. The link itself is now useless — you don’t need to know who had it.

Can Google search engines index files shared “Anyone with the link”? Google has stated that Drive files shared with “Anyone with the link” are not indexed by Google Search by default. However, if someone shares the link publicly (in a social media post, a webpage), search engines can find and index that link. The content itself would require clicking the link, which requires no authentication — so in practice, “Anyone with the link” shared files can become publicly accessible through indirect means.

My child submitted a Google Doc to a teacher. Is the teacher’s access permanent? Access persists until revoked. A teacher with View access to a document can continue viewing it indefinitely after the grading period. This is usually benign, but students with sensitive personal writing should know to revoke access after grading if they prefer. File access can be revoked at any time from the Share panel.

Is it safe to use WeTransfer for school documents? For most homework documents, yes — WeTransfer is appropriate. Avoid it for documents containing sensitive personal information (family financial data, medical information, social security numbers). The free tier doesn’t offer encryption beyond in-transit TLS, and WeTransfer staff can access uploaded files if required.

---

About the author

Ricky Flores is the founder of HiWave Makers and an electrical engineer with 15+ years of experience building consumer technology at Apple, Samsung, and Texas Instruments. He writes about how kids learn to build, think, and create in a tech-saturated world. Read more at hiwavemakers.com.

Sources

1. Electronic Frontier Foundation. (2023). “Student Privacy and School Cloud Services.” EFF. https://www.eff.org/issues/student-privacy

2. Student Data Privacy Consortium. (2023). “State of Student Data Privacy 2023.” SDPC. https://studentdataprivacy.org/

3. Google Workspace. (2024). “Google Workspace for Education Privacy Practices.” Google. https://workspace.google.com/intl/en/terms/education_privacy.html

4. Microsoft. (2024). “Microsoft 365 Education Data Governance.” Microsoft. https://www.microsoft.com/en-us/education/privacy

5. Common Sense Media. (2023). “The State of Kids’ Privacy.” Common Sense Media. https://www.commonsensemedia.org/kids-action/privacy

6. National Cybersecurity Alliance. (2023). “Safe File Sharing Practices for Students.” StaySafeOnline. https://staysafeonline.org/resource/safe-online-file-sharing/