Madrid school hit with €12k fine after kids roam free on google workspace
A Catholic primary in Madrid just discovered that “educational platform” and “digital babysitter” are not synonyms. Spain’s data protection authority, the AEPD, has slapped Holy Mary Catholic School with a €12,000 penalty for turning Google Workspace for Education into an all-you-can-eat buffet of YouTube, games and unfiltered web traffic—while silently harvesting pupil data.
The complaint that cracked the wall
A mother of two primary pupils filed the 2024 complaint that opened the hole. She told inspectors her children had been issued personal Gmail accounts “for classwork” yet spent lessons inside Minecraft videos and meme threads. When she asked the head teacher why Chrome browsers had zero filtering, the reply was essentially: “It’s Google, it must be safe.”
Investigators found the school activated Workspace with default settings: SafeSearch off, YouTube unrestricted, third-party cookies on, and location history quietly ticking. Worse, the consent form handed to parents mentioned only “digital tools” and never spelled out that Google’s ad machine would inhale every click.
What the fine really buys
The AEPD verdict slices through the usual ed-tech marketing fluff. By painting the platform as a benign textbook, the school ignored its role as data controller under the GDPR. Translation: teachers became de-facto product managers for a Silicon Valley giant, except they forgot the privacy impact assessment, the risk matrix and, crucially, the opt-out button.
Spanish regulators are sending a wider message. Last year they waved through pandemic-era tech rollouts; now they’re measuring the blood pressure of those same tools. If a parish school can rack up GDPR violations with 8-year-olds, universities handing enterprise licenses to tens of thousands of students should probably cancel their Friday drinks.
Meanwhile, Google keeps signing “education privacy agreements” across Europe, promising no ads inside Workspace. Yet the default configuration still leaks metadata like a rusty bucket. Engineers know it, regulators know it, and now parents do too.
Expect copy-cat complaints before Christmas. The AEPD’s docket shows three similar cases already queued in Valencia and Barcelona. Each could push total fines past the half-million mark—small change for Alphabet, but a career-limiting event for school boards that confuse “digital transformation” with “set it and forget it.”
Bottom line: a 12-grand receipt for one playground of data is cheap compared to the reputational cost of teaching kids that privacy is optional. The next head teacher who clicks “accept all” should remember this number and reach for the manual instead.