Google Additional Services

[Tech13]

Hi all,

 

I'm sure you have now been faced with the requirement for parental consent for Google Additional Services. 

 

How have you gone about getting this additional consent? For things like YouTube / Maps / Translate

 

Thanks!

[Tech13]

**Bump**

[dmj]

Afaik this isn't a legal requirement for schools if it's used for education, the school can authorise this without parental consent.

[Tech13]

1 minute ago, dmj said:

Afaik this isn't a legal requirement for schools if it's used for education, the school can authorise this without parental consent.

Thanks for this, I don't suppose you have a source for this? It's very helpful. 

[dmj]

1 hour ago, Tech13 said:

Thanks for this, I don't suppose you have a source for this? It's very helpful. 

The 'lawful basis' would come under a 'public task' ie to provide education using the software means you don't need to get parental consent.

https://www.legislation.gov.uk/eur/2016/679/contents

[paulkerton]

dmj beat me to it.
"public task" should do it.

[Tech13]

Thanks all! I'll take that.

[mrstrong]

Interesting as our DPO said we needed parental consent !

 

Apparently "Google insist in their contract that you confirm you have parental consent." ?

[dmj]

15 hours ago, mrstrong said:

Interesting as our DPO said we needed parental consent !

 

Apparently "Google insist in their contract that you confirm you have parental consent." ?

 

 

If s/he reads the wording 

https://workspace.google.com/terms/education_terms/:

 

"""

If the Customer intends to enable End Users under the age of 18 to access or use any Additional Products or Third-Party Offerings, then the Customer will, before allowing any such End User to access or use those products or offerings, obtain parental consent for the collection and use of personal information by (a) the Additional Products, and (b) to the extent required by applicable law, the Third-Party Offerings.

"""

 

The applicable law in this context is the GDPR and if  the software is being used for an educational it is already covered by public task. If it's used for something else that you are providing (clubs etc) you will need parental consent. 

[mrstrong]

asked our DPO about this and they said it still requires consent as it requires both a) AND b).

 

Seems like one for the lawyers but for us I guess that means we have to get parental consent as our DPO says it is needed

 

I guess you can restrict access for some pupils by putting them in a group and turning service off just for that group (?)

but how would this work in practice e.g. teaching a lesson with google maps when 5 kids don't have parental consent!

 

Is anybody just allowing access to the additional google services without getting parental consent  ?

[3s-gtech]

This may help, as it was done at a government level in Wales so sets a fairly strong precedent:

 

https://hwb.gov.wales/news/articles/76979aea-3819-42e9-9c10-121e907ef922

[paulkerton]

14 minutes ago, mrstrong said:

but how would this work in practice e.g. teaching a lesson with google maps when 5 kids don't have parental consent!

Exactly this. Good luck explaining to the teacher that they can't do their lesson because two parents out of 30 have not given consent.

 

[dmj]

2 hours ago, mrstrong said:

 

I guess you can restrict access for some pupils by putting them in a group and turning service off just for that group (?)

but how would this work in practice e.g. teaching a lesson with google maps when 5 kids don't have parental consent!

This is literally why the law says you don't need to do this, despite how your DPO decided to interpret it. 

[GrumbleDook]

On 23/09/2025 at 16:49, dmj said:

This is literally why the law says you don't need to do this, despite how your DPO decided to interpret it. 

Just to clarify on this, the reason you need consent on this is due to Google's terms and conditions for the additional services.

For the additional services Google is a separate Data Controller. They will used the personal data for purposes *they* decide on. This has been discussed with various folk at Google for some time and for the bulk of schools they will need consent for the additional services.

The post from Hwb was talking about the Hwb additional services, which included Google G Suite for Education ... *not* the Google Additional services. The previous advice from Hwb, IIRC, was that use of any additional integration with Hwb (M365, Google, etc.) may result in needing Consent ... and that was partly due to the additional services.

 

When looking at any SaaS, not just Google/Microsoft, if they say they will use any personal data for their own purposes, then they are becoming a Data Controller in their own right. That is what the law says. Moreover, they now also have to comply with the Age Appropriate Design Code ( aka The Children's Code) as the relationship is directly between the child and the provider of the additional services requiring consent. This has been discussed with the ICO policy teams, with DfE and with numerous children's rights stakeholders. The DPO is right in this case, and if anyone wants the warts and all for the above discussions I'm happy to talk to school DPOs and others about it.

[mrstrong]

so given the "official" advice is schools do need parental consent. What are the implications for those schools who don't obtain it

E.g. a possible fine from the ICO ?

[GrumbleDook]

On 29/09/2025 at 14:18, mrstrong said:

so given the "official" advice is schools do need parental consent. What are the implications for those schools who don't obtain it

E.g. a possible fine from the ICO ?

 

The ICO has a history of engaging and working with public sector organisations rather than fining. However, the PR aspect of it is likely to be quite a problem, as well as open the school up to complaints.

Even if the school ask for consent, it is unlikely to be considered as 'freely given', as without access to the additional services then the children whose parents refuse to give consent may be affected adversely, not having the same level of education as the others. This means the school is effectively forcing parents to give consent. There is no clear answer on how it can all be made to work, but the larger priority for schools look to be around managing their supply chain, incident management and transparency.

[psydii]

I've found when trying to explain why things should be on a risk register and managed as such, items so completely outside of SLT/Governor's comprehension and influence/control (like say, the shifting sands at the intersection of technology, education, the whims of a multinational corporation and implementation of UK legislation) the result is for the item to get scrubbed, and those raising it released  from responsibilities where they might be required to raise such matters again.

So bypassing that nonsense, we're going on a class by class basis. If a teacher wants it, then they have to do all the leg work to get permission. The admin then flags the parental consent in the MIS and the automation drops the users into the "consented" group for that service.