The small Danish city of Helsingør is not a place usually in national news headlines. Until now, most visitors come here to catch the ferry to nearby Sweden or to visit the castle where Shakespeare’s famous tragedy Hamlet was set. But the news crews arrived with the start of the new school term in August, to capture the chaos caused when local schools banned Google.
Google’s education products—its Chromebook laptops and school software—are deeply embedded in Denmark’s education system. Around half of the country’s schools use Google, and some students in Helsingør get their first Chromebook at the age of 6. So when Helsingør banned those products on July 14, the result was widespread disruption when schools reopened the following month. Some local children complained they were so unused to pen and paper they couldn’t read their own handwriting. Denmark’s data protection regulator found that local schools did not really understand what Google was doing with students’ data and as a result blocked around 8,000 students from using the Chromebooks that had become a central part of their daily education.
This chaos had its roots back in August 2019, when one local 8-year-old approached his father with a problem. One of his classmates, he said, had used the 8-year-old’s YouTube account to write a “very rude” comment under another person’s video, and the son was panicking about the possible consequences. He was worried he would be punished for harassment or become the target of an online revenge campaign.
His father, Jesper Graugaard, was initially confused; he hadn’t set up a YouTube account for his son, and he hadn’t given the school permission to create one either. His family was “proudly analog”; his three children don’t have their own smartphones. So when Graugaard realized that his son (who he declines to name) had a YouTube account that publicly listed his full name, school, and class, he was shocked and immediately contacted his son’s school. Staff there, he says, tried to wave the issue away as a mistake with private filters they could easily fix. Google declined to comment on the specifics of this case but said schools’ IT staff are typically in charge of which Google services students can access.
But Graugaard was not reassured. This stay-at-home dad—who had never before been involved in any kind of activism—embarked on a three-year campaign to fix what he considered to be a major flaw in the relationship between the Danish public school system and Google. It was his official complaint to Denmark’s data protection regulator, Datatilsynet, in December 2019 that inspired the Google ban in Helsingør. And his constant efforts to speak to local media and politicians have helped create one of the biggest debates ever to take place in Denmark about how to protect Danish data and have unleashed growing skepticism about the role of American companies in Europe’s public sector.
The Google ban was partly imposed because the data protection regulator discovered Helsingør never carried out a full risk assessment for Google’s school products before using them, as required under Europe’s GDPR privacy law, according to Allan Frank, IT security specialist at Datatilsynet. Schools that were plunged into chaos by the ban, however, received a respite on September 8, when the ban was suspended for two months, allowing students to keep using their Chromebooks while Helsingør and Google negotiate what happens next.
It’s up to Helsingør to get Google to mend its products to be in line with GDPR, says Frank. Helsingør municipality did not reply to WIRED’s request for comment. But Google implies it's the municipality that needs to improve. “We’re working with Helsingør municipality to answer questions, improve their technical settings, and share best practices from other European schools that have done risk assessments and use our products,” says Alexandra Ahtiainen, head of Google for Education for Northern Europe. If those negotiations fail, and the ban is reinstated, there is a chance it will apply not just to Helsingør but to schools all over Denmark. So far, 45 other municipalities have been in contact with Datasilynet about concerns related to their Google products, says Frank.
When Graugaard started his campaign, he was not worried about Google products specifically. “My concern was when I put a child into public school, private personal data is not allowed to go public without my consent,” he says. “I'm just a dad. I didn't understand the seriousness of the case.” But he now finds Google’s involvement in Danish public schools sinister, and he wants the company out of the system. “Everything [children do] in school is in the cloud, via Workspace, which means everything they write in their machine is sent to Google,” he says. “We have given Google access to a whole generation.”
The main issue Graugaard has highlighted is that they don’t really understand what students’ Google data is used for or where it goes. “Google is always saying, we don't use the data of pupils for targeted advertising. We do not sell the data to third parties,” says Jesper Lund, chair of digital rights group IT Pol Denmark. But there is concern that Google does use students’ data for other purposes, such as improving its services or training artificial intelligence, he adds.
Bymidten School is a modern red-brick building in central Helsingør, just a short walk from the Øresund strait, the stretch of water that separates Denmark and Sweden. An air of uncertainty now hangs over the school, which got a taste of a future without Google during the two-month ban. Teachers were forced to discard all their digital lesson plans and instead fetch discarded books out of the cellar, according to Anders Korsgaard Pedersen, who leads Bymidten’s middle school. In the weeks that followed, children were forced to adapt to pen and paper, while their Chromebooks—which had been deactivated by IT staff—sat useless at home.
The whole saga has been a huge dilemma for schools like his, says Pederson, who believes schools don’t have the resources or expertise to be GDPR compliant. “On the one hand, we really want to take care of students’ data,” he says. “I know from my [previous] job as a consultant that the data agreements with Google are not 100 percent transparent. And somehow, as a country, we somehow accepted it.” But he also wants to run a functioning, 21st-century school. “We have put ourselves in a situation where we actually pretty much rely on Chromebooks,” he says.
Some children could adapt better without them than others. Throughout his career in education, Pederson has never heard a single parent complain about data protection. But after the Google ban, he did receive complaints—mostly from parents of dyslexic students, who rely on Chromebook tools such as AppWriter.
There might be ambivalence among many Danish parents—but not all. “I hope [the ban] spreads, as we are giving too much information to multinational corporations, who by their very nature are untrustworthy,” says Jan Gronemann, a parent of four whose children go to a school in Haslev, another part of Denmark, that uses Microsoft not Google. Like other Danish privacy activists and local business owners who spoke to WIRED, Gronemann is concerned that the data Google has access to about how young people behave online could enable them to be manipulated, for advertising or politics, later in life.
“If you know the zip code of an individual, if you know their economic output, if you know their birthday, what their behavior is when they go from Amazon to Disney to Walmart to Target, guess what? Your prediction ability is huge,” says Omino Gardezi, a former Disney consultant who now runs Lirrn, a privacy-focused education startup based in Copenhagen.
This local issue is also fanning a Europe-wide debate about what happens to European data in the hands of American tech companies. European courts have ruled multiple times that European data sent to the US can potentially be snooped on by intelligence agencies such as the National Security Agency. Facebook-parent Meta has so far been the focus for concerns about data moved from the EU to the US. In July, the Irish data protection regulator said it will block this from happening. Meta has threatened to stop Europeans using services like Facebook and Instagram if that happens.
The Helsingør case is reminding locals that Google also sends some data overseas, and there is growing unease that this means Europeans' data could be accessed by a future administration the bloc might not consider to be an ally. “Trump might be the next president again,” says Pernille Tranberg, cofounder of Danish think tank Data Ethics EU, who says she has been trying to convince Danish schools to use European school software such as Nextcloud for years. Google says it has strict standards for government disclosure requests, and it challenges them where appropriate. “We’re also supportive of EU and US efforts to find workable solutions to protect privacy and transatlantic data flows, which remain essential for the internet to function and for students to access the digital services they rely on every day,” says Google’s Ahtiainen.
Back in Helsingør, teachers at Bymidten school are not thinking about transatlantic data flows. Instead they are wondering if they will be able to function after the final decision on the Google case, which is due November 5. “We can’t do anything but wait,” says Pederson. But despite those concerns, he still wants answers.“What are they using the data of children in Denmark for?” he asks. “It’s very important that we have clarity on this one, so we can be assured that we do not sell the children to an international company.”
