Thanks for pointing to this. I am a grad student. My institution recently moved to Apps for Education and away from an in-house system, which I was not very happy about. Privacy for my data (including communications with the undergrads I teach) was, and remains, one of my concerns.

There's an awful lot of very slippery language in this post:

"So, if you’re a student logging in to your Apps for Education account at school or at home, when you navigate to Google.com, you will not see ads." Great -- but does anyone see ads on the google.com homepage? Seeing ads is not the issue; the issue is how Google is collecting and processing data. So:

"We’ve permanently removed all ads scanning in Gmail for Apps for Education, which means Google cannot collect or use student data in Apps for Education services for advertising purposes." I was with you until that last qualifier, "for advertising purposes." That just makes me wonder what sort of "collection" and "use" purposes Google is reserving for itself. What's really off the table here? Even if "ads scanning" is turned off, what protections are in place to make sure that no one, including Google itself, has the ability to use the data associated with Apps for Education accounts in privacy-violating or nefarious ways? The technology the post actually mentions, like HTTPS, is all about the channel between users' computers and Google's servers. But are there any protections to keep student data from being abused by Google employees?

This last possibility is an important one, as many of my students may one day be applying for jobs at Google. What assurance do they have that the person who hires them or their future manager will not, in a moment of weakness, troll through their email from their undergrad days? see the photos they sent to friends? read the papers they wrote and stored on Google Drive?

I understand that much of the language here is probably slippery for legal reasons, and to keep the explanations simple, not because it is hiding some bad intent on Google's part. But good intentions are not enough when you are asking to be trusted with other people's data, especially student data.