Google Nest Hub on school network

[jpark]

I'm asking this question, although I'm pretty sure I already know the answer. 

I've got a user with a Google Nest Hub they'd like in their office.  The last time we had a consumer grade smart device (a Google Home) on our network, whenever it played music, some of the chromebooks connected to the network were able to see what music was playing and control the playback.

Outside of all the massive security concerns with putting a consumer device on our network...

If I put the hub on an SSID that restricted devices from communicating with each other, would that help?  Would it essentially isolate that device's traffic from other devices?

[Kim_Nilsson]

First. Don't.

Technically, you can always isolate network devices in separate VLANs. But that also means no other devices can communicate with it to do things with it.

Also, AFAIK several features of the Nest are not covered by the Workspace agreement, so it's most likely not legal to use it in a school.

It's a consumer product, meant to be used with a consumer Gmail account on a consumer network at home, where it can't listen to conversations of unknown people.

[bethhughes]

+1 on Kim's advise. Your legal department should give you a hard NO on this one, too. In the US, anything that is recorded on the device while it is listening is open to public disclosure if requested through the legal system. While you may not have anything to hide, a sentence in a conversation could be taken out of context and create huge problems for another person or your district. This device's "convenience" is simply not worth it.

[npl]

I would agree with Beth and it should be hard NO to this, but there are always cases that you need external devices on a network. 
The best solution is to have this devices connected to a dedicated access point and wired directly back to a firewall port with a special external subnet with no access to the other lan networks.  If it is not possible to wire it back it could be achieved via vLan as per Kim's post. Non school devices should be on a separate subnet.