As part of a an attempt to do a methodical test of the “claims” recently made by the Mississippi AG I started from what should be the logical first step, creating a new GSuite for Education domain. One important thing to note is that when doing this (as of 1/17/17), 25 of the non-core 52 services are turned on by default (list attached). A fair criticism might be that the better privacy by default practice would have been to default all of these to OFF and require the Admin to enable them.

The flow looks like this, As soon as an admin signs up, they must verify the domain (creating a DNS entry to prove they have control). As soon as they do this they get the following message

It is worth noting that YouTube is enabled by default on new GSuite EDU domains (as of testing on /19/17) , despite the under 13 prohibition in the terms], though location, web history and google + are not. Blogger is on by default for all users.

An example of the “notice and consent” for Admin when enabling new services can be seen below.

A fair point could be made about contradicting terms and it is reasonable to think that Districts might be confused about how to determine what take precedence between the pop up dialog the admin clicks overrides and the general prohibition on under 13 in the youtube terms (the same is true for chrome web store which prohibits under 13)

Also the default setting for new products is to enable them

The following table lists the default status of non-core services in a new EDU GAFE domain upon domain activation (as of 01/22/2017)