I thought it was pretty clear--despite saying they wouldn't, they sold the students' data.

The article doesn't claim that Google sold students' data. As is par for the course with Google, any data that Google processes is used to build up a profile of the user and then used to target advertising towards that user. The data itself is never sold, and the advertiser has no knowledge of who their advertising was delivered to nor does the advertiser know, if the person clicks through on the ad, why the person was served up that ad. It may have been because of the contents of their email; it may be because of prior searches; it may be because at one point they visited a website which was related; or it could be because Google couldn't figure out what was best and just served up some random ad.

I guess I missed the part where data was "stolen" and used in some bad way?

The data belongs to the students and there was an agreement not to mine it; the complaint is that this agreement was ignored and the data was mined.

That kind of thing carries regulatory fines in EU. There may be a bit of culture clash happening in this thread between Europeans ("this is my data and you need my permission to use it") and SV ("this data is gathered by the company and it's theirs to do with what they wish")

An important concept in American law is harm, and what's unclear to me is what exact harm was caused.

Why am I being down voted for this question?