Google has updated its privacy policy in a way that could change how some of the most personal information in its ecosystem is used for advertising. The revision adds an exception to a long-standing promise about not using data from Google Drive, Gmail, and Google Photos for personalized ads. Under the new language, that promise no longer applies if a user chooses to make data from those services available to other Google services that support personalized advertising. The change was made on October 16 and applies to users who opt into features that connect personal content with AI-powered tools.
The practical effect is tied to Google’s Personal Intelligence features, which allow services such as Search and Gemini Apps to draw on information from Gmail, Drive, and Photos to provide more relevant answers and recommendations. If a user connects those accounts, the updated policy says Search may process some of the data it is allowed to access to personalize content, including ads. That means an email, a photo library, or a document stored in Drive could help shape the advertising a user sees, even though advertisers themselves are not given direct access to the underlying content.
What changed in the privacy policy
Before the update, Google’s policy stated that it did not use information from Drive, Gmail, or Google Photos for personalized ads. The revised version adds a qualifier: Google will not use that data for personalized ads unless the user chooses to make it available to other Google services that support personalized ads. The exception is narrow in legal language but broad in potential impact, because it links two areas that had previously been separated: AI personalization and advertising.
The policy now explains that users may allow certain Google services, including Search or Gemini Apps, to access data from other Google services such as Google Photos and Workspace apps like Gmail and Drive. The purpose is to provide a more personalized experience, subject to the policies and settings of the service receiving the data. The policy gives a concrete example: Search may process some of the data that a user allows Search to access in order to personalize content, including ads. A second example says that depending on settings, Google may show personalized ads based on interests, activity, or personalized content from Google services.
The advertising example is deliberately simple: if a person searches for mountain bikes in Search, they may see ads for sports equipment on YouTube. That example does not necessarily involve Gmail or Photos, but it illustrates the general model. Google already uses search activity and other signals to personalize ads. The new policy makes clear that content from connected personal services can also feed into that model when users enable the relevant features.
How Personal Intelligence connects personal data to AI tools
Personal Intelligence is the umbrella for features that let Google’s AI systems know more about the user. Instead of treating Gmail, Drive, and Photos as isolated storage products, these features can let Search and Gemini Apps use information from those services to answer questions, make suggestions, or provide context. A user might connect a photo library so an AI tool can help organize memories, or connect Gmail so an assistant can find details from past messages. Those connections can make the AI more useful, but they also move personal content into a broader set of processing pipelines.
The updated policy does not say that every Gmail message or every photo will be used for advertising. It says that if a user chooses to make data from those services available to other Google services that support personalized ads, the earlier restriction no longer applies. The key phrase is choice. Google’s position is that the user controls whether the connection exists and which services are connected. The policy also points users to settings where they can review or change those connections.
That distinction matters because the change is not a blanket announcement that Google will start mining Gmail and Photos for ads. It is a conditional expansion. The condition is that the user has enabled a data-sharing arrangement between services. For people who never connect Gmail, Drive, or Photos to Search or Gemini personalization features, the old promise may still describe their setup. For people who do connect them, the new exception gives Google a clearer policy basis for using that data in ad personalization.
What advertisers can and cannot see
Google says advertisers do not get access to a user’s Drive, Gmail, or Photos information. Advertisers also do not receive personally identifying details such as a name or email address. That is an important boundary. The ad system may use signals derived from personal content to decide which ad to show, but the advertiser is not supposed to see the raw email, photo, or document that triggered the targeting. This is similar to how ad platforms often describe their systems: advertisers choose audiences or goals, and the platform handles matching and delivery without handing over individual user records.
Google also says it will not show ads based on sensitive categories such as race, sexual orientation, religion, or health. Those restrictions are significant because Gmail and Photos can contain extremely sensitive information. A photo library may reveal health conditions, religious practices, or family relationships. An inbox may contain medical appointments, financial records, or personal correspondence. The policy’s sensitive-category limits are meant to keep those topics out of ad targeting, even if the content is processed for other personalization purposes.
Still, the line between using data to personalize an AI answer and using data to personalize an ad can be difficult for users to see. A system might learn from a document that a person is planning a trip, then use that context to improve a Search response. If the same context informs an ad, the user may not know which signal mattered. Google’s challenge is to make the distinction understandable without exposing the underlying content to advertisers.
Why the change is drawing attention
The revision matters because it touches one of the most sensitive boundaries in digital advertising: the use of private communications and personal media. Gmail and Google Photos are not public social feeds. They are places where people store messages, receipts, family photos, and documents they may never expect to see reflected in advertising. Even if advertisers never see the content, the idea that personal files could influence which ads appear is likely to make some users uncomfortable.
The change also arrives at a moment when AI features are becoming more deeply embedded in everyday products. Search engines and assistants are being redesigned to use context from a user’s broader digital life. That context can make AI tools more helpful, but it also creates new pathways for data to move between products. Privacy policies are where those pathways are formally described. A small wording change can therefore signal a larger shift in how a company thinks about personalization, advertising, and user consent.
There is a regulatory dimension as well. Privacy regulators in many countries have focused on whether users understand what they are agreeing to when they enable personalization features. Clear consent, limited data use, and easy controls are common expectations. Google’s updated policy gives users settings to disconnect services or disable personalized recommendations, but the effectiveness of those controls depends on how easy they are to find and how clearly they are explained. A policy exception that is buried in legal language can be technically disclosed while still being practically obscure.
How users can limit ad personalization
Users who want to prevent personal data from being used for targeted ads have two main options described in the policy. First, they can choose which apps they want to disconnect from Search’s Personal Intelligence features. That means reviewing the connections between Search or Gemini and services such as Gmail, Drive, and Photos, then removing access for any service they do not want included. Second, they can disable Personalized Recommendations entirely through the Search Services Personalization settings page. That option is broader and may reduce personalization across Search-related features.
These controls are important because the policy’s exception is built around user choice. If a user disconnects a service, the data from that service should no longer be available to the receiving service for personalization. If a user turns off personalized recommendations, the ad system should not rely on that personalization stream. The practical question is whether the settings are prominent enough and whether changes take effect across all relevant products. Users who want a stricter setup may also review their Google account’s ad settings and activity controls.
For people who rely on Gmail, Drive, or Photos for work or family records, the safest approach is to treat AI personalization connections as a separate decision from storage. Using Gmail does not require connecting it to Search’s personalization features. Using Google Photos does not require making the library available to AI recommendations. The updated policy makes that separation more important because the two choices now have clearer advertising implications.
The broader debate over AI and private data
The policy update reflects a wider tension in the technology industry. AI systems work better when they have context, and the most valuable context often comes from private data. But the same data can be used for advertising, which is a different purpose from answering a question or organizing photos. Companies often argue that personalization improves the user experience and that advertisers never see the raw data. Critics argue that users cannot meaningfully consent to complex data flows that span multiple products and purposes.
In this case, the debate is not about whether Google collects data from Gmail, Drive, or Photos. It already does, and it already uses that data to run and improve those services. The debate is about whether data connected for AI personalization can also support ad personalization. The new policy says it can, if the user has chosen to make the data available to services that support personalized ads. That is a subtle but consequential expansion of the conditions under which personal content can influence advertising.
Users may also wonder how long the data is retained, how it is used for model training, and whether ad signals derived from personal content can persist after a connection is removed. The policy excerpt does not answer every operational question. It sets the legal framework and points to settings. The details of retention and processing will depend on the specific services and the user’s account settings. That gap between policy language and day-to-day practice is likely to be a focus for privacy advocates and regulators.
What to watch as the policy takes effect
The first thing to watch is how Google presents the connection between Personal Intelligence and advertising inside its products. If users see clear prompts explaining that connecting Gmail or Photos to AI features may also affect ad personalization, the choice is more meaningful. If the connection is presented only as a way to get better answers, users may not realize the advertising implication. Transparency at the point of consent will matter as much as the policy text itself.
The second thing to watch is the rollout of controls. Disconnecting a service or disabling personalized recommendations should be straightforward and should apply consistently across Search, Gemini, and any other service that receives personal data. If users have to hunt through multiple settings pages, the control may exist in theory but be weak in practice. The policy’s effectiveness will depend on how accessible those settings are and whether changes are reflected quickly.
The third thing to watch is how advertisers and ad systems use the new signals. Google says advertisers will not see personal data, but the ad platform may still use derived insights to shape targeting. That could make ads more relevant, but it could also make the boundary between AI personalization and advertising harder to perceive. The policy example about mountain bikes and sports equipment ads is simple; real-world data flows are likely to be more complex.
For now, the change is a reminder that privacy policies are not static documents. They evolve as products evolve, and small clauses can have large effects. The updated language gives Google more flexibility to use connected personal data for ad personalization while maintaining limits on advertiser access and sensitive categories. Users who want to keep their Gmail, Drive, and Photos data out of that system should review their Personal Intelligence connections and personalized recommendation settings before assuming the old separation still applies.
Source: The Verge News