In January 2024, the Danish Data Protection Agency issued a landmark ruling, challenging the integration of Chromebook laptops in Danish public schools under the EU's General Data Protection Regulation (GDPR). This article presents a study of the Chromebook case to explore the entanglement of commercial tech infrastructures and welfare state principles. Drawing on studies of rentiership and educational privatization, we analyze five types of lock-in at stake in the Chromebook case. In different ways, these lock-ins are suggestive of an infrastructural dependency in the datafied welfare state which, we argue, points to a pervasive democratic deficit in the digitalization of public domains, whose consequences reach far beyond the lack of privacy regulation and data control stipulated in the Chromebook ruling.