Google changed the privacy policy that governs its AI search tools, and the new wording opens a door that used to be bolted shut. Under the update that took effect on October 16, 2026, data that users allow Search or Gemini Apps to read from Gmail, Google Photos, and Drive may be used to personalize content, including ads, according to The Hacker News. The key word is “allow,” because Google says the pathway only opens when a user chooses it.
That choice matters, but so does the wording around it. We covered the first wave of reaction to the policy earlier. This analysis goes a step further: it audits the four safeguards Google itself cites, separates what the company has confirmed from what headlines imply, and looks at what the Personal Intelligence opt-in means for advertisers, rivals, and the people who use Gmail every day.
A quick note on sourcing. Every specific claim below comes from Google’s own policy language as relayed by named outlets, or from Google documentation quoted verbatim. Where the record is silent, this article says so rather than filling the gap.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Google Changed in the Google Privacy Policy on October 16
The revised Google privacy policy became effective on October 16, 2026. Its relevant passage says users may allow Search or Gemini Apps to access data from Google Photos and from Workspace apps such as Gmail and Drive for a more personalized experience. It then adds that Search may process the data a user permits in order to personalize content, including ads.
The Verge framed the shift bluntly in its headline, saying Google now says it might use Gmail and Google Photos data to target ads. Its report, published on The Verge, ties the policy change to Personal Intelligence, the feature that lets Google’s AI products draw on connected personal services. 9to5Google reached a similar conclusion on October 23, 2026, writing that ads can be targeted from Gmail and Photos data if Personal Intelligence is enabled.
The language shift is easy to miss in a long legal document. For years, the framing around Google’s consumer products treated Gmail, Photos, and Drive content as separate from advertising. The new text keeps that separation as the starting point, then adds a conditional exception. If you opt in, the wall has a door.
How Personal Intelligence Connects Gmail, Photos, and Gemini
Personal Intelligence is the product layer that makes the policy change matter. Google’s documentation, as summarized in reporting on the update, describes it as a feature that lets Gemini and other AI experiences use connected Google services to tailor responses. Services that can be connected include Gmail, Google Photos, and YouTube.
Two surfaces are named in the policy. Gemini Apps is the chat assistant. Search, including AI Mode, is the conversational layer that sits on top of Google’s core product. When a user enables Personal Intelligence in Search and connects Google Photos, Google’s help documentation says Search may process some of the data the user allows it to access to personalize content, including ads.
Think about what that connection buys the user. Ask a question about a trip and the assistant can, in principle, look at a confirmation email or at photos from a past visit. That is useful, and it is the reason the connectors exist. The privacy policy question is what else happens to that signal once the connector is switched on.
Google has not published, in the material reviewed for this article, a numbered Gemini or AI Mode version tied to this policy. Reporting identifies the relevant products by capability: Gemini Apps, Gemini Personal Intelligence, and Search AI Mode. This article follows that convention and does not assign version numbers. Readers tracking Google’s model lineup can see how the paid tiers stack up in our look at Gemini 4 Argon and its paid plans.
Google’s Own Words: Four Verbatim Statements
Because the fight over this update is mostly a fight over wording, the cleanest way to read it is to quote Google directly. The four statements below come from Google’s published documents. None is a paraphrase.
First, the exception clause in the Google Privacy Policy: “We don’t show you personalized ads based on your content from Drive, Gmail, or Google Photos, unless you choose to make data from these services available to other Google services that support personalized ads.”
Second, the same policy explains how personalization works in Search: “When Personalized Recommendations in Search services is on, these services can provide results, curated feeds, and AI responses that are personalized to you based on info in your Google Account, including Search Services History.”
Third, the Google Photos Help page gives a concrete example: “For example, if you enable Personal Intelligence in Search and choose to connect Google Photos, Search may process some of the data that you allow Search to access to personalize content, including ads.”
Fourth, Google’s ads privacy FAQ says: “No, we never tailor ads to you based on what you say over the phone and your content in Drive, Gmail and Photos is never used for ads purposes.”
Read together, the third and fourth statements sit in tension. The FAQ speaks in absolutes, while the policy and the Photos help page describe an opt-in exception. That gap is the heart of the controversy. It does not prove Google is contradicting itself, since the exception depends on a user choice. It does show that the plain-language promise and the legal text now describe different things.
The Four Safeguards Google Cites
Google has not left the change unqualified. Reporting on the policy points to four protections, and each one narrows how Gmail data Gemini or Search touches could reach an ad. The table below lays them out against what the source material does and does not confirm.
| Safeguard | What Google says | What remains unclear |
|---|---|---|
| Default off | Drive, Gmail, and Google Photos content is not used for personalized advertising by default | How prominently the opt-in prompt appears inside Search and Gemini |
| Advertisers get no content | Advertisers do not receive users’ Drive, Gmail, or Google Photos content | Whether derived signals or interest categories are shared in aggregate |
| No personal identifiers | Advertisers do not receive details such as a user’s name or email address | How other identifiers, if any, are handled |
| Sensitive categories excluded | No ads based on race, sexual orientation, religion, or health | How the exclusion is enforced when a photo or email touches these topics |
These are real constraints, and they deserve credit. They are also promises about intent and process, not independently audited facts. No outlet in the reporting reviewed here describes a third-party audit of how the sensitive-category filter works on photo or email content.
What Google Has Not Confirmed
The headline in circulation, that shared Gmail and Photos data “could be used for targeted ads,” is a summary of the policy’s implications. The policy itself says the data may be used to personalize content, including ads, when users allow access. Those are close, but they are not identical, and the difference is worth stating plainly.
Several details are not on the public record in the sources reviewed. Google has not, in this material, stated what share of users have enabled Personal Intelligence. It has not published how many ads, if any, are currently served using connector data. It has not named the “other Google services that support personalized ads” beyond Search. And no source here describes a change to how Gmail’s own inbox ads work.
Readers should treat any figure claiming to size the opt-in population as unverified until Google or an independent researcher publishes one. That caution applies to this article too: where a number is missing, it is missing on purpose.
Why Headlines and Policy Text Read Differently
Coverage of the update split into two registers. NDTV and Techlicious ran headlines saying Google might use or can now use Gmail and Photos data to target ads. The Hacker News used the phrase “could be used.” Those headlines are accurate about the policy’s permission and silent about its precondition, which lives in the body text.
The Precondition Most Headlines Skip
The policy ties the ad use to a user decision to make data available to services that support personalized ads. Without that decision, the default stands. A reader who stops at the headline could conclude that Google is scanning every inbox for ad signals, and nothing in the policy language supports that reading.
The Concern Headlines Get Right
Yet the concern is legitimate. A categorical exclusion became a conditional one, and conditional protections depend on consent design. If opting in to a better assistant also opts the user into ad personalization, many people will say yes without registering the second consequence. Techlicious addressed that risk directly by pairing its report with guidance on changing Search personalization settings.
Where Gmail Data and Gemini Meet Ads
Google says its ads may remain based on the query, the context of an AI response, and a user’s broader interests, rather than being picked from the text of an inbox or the contents of a Photos library. That distinction is the company’s main defense, and it shapes how the Gmail data Gemini sees could matter commercially.
Ads inside AI answers are already a live experiment. Trade publication Relevant Audience reported that Google is testing ads in AI Mode for Personal Intelligence. That headline matters because it connects the policy language to an actual ad surface. A privacy permission without an ad product is theoretical. A permission paired with a test is a business plan.
For the user, the practical question is simple. If you connect Gmail to Gemini to summarize a thread, does that connection change the ads you see next? Google’s policy says the answer depends on whether you made data available to a service that supports personalized ads. Whether that happens as a side effect of enabling a connector, or only through a separate toggle, is the detail that the public documents leave less clear than users deserve.
Google Photos AI Mode Privacy and the Sensitive-Category Line
Photos carry a different kind of risk than email. A photo library records faces, locations, medical appointments, children, and religious events, often without any caption. Google says it will not show ads based on sensitive categories including race, sexual orientation, religion, or health. The Photos help documentation also states that Photos data is never used for ads unless users choose to make it available to other services that support them.
The exclusion is only as strong as the classifier behind it. A picture of a mosque, a pride march, or a hospital waiting room can reveal a sensitive category without any text. Whether Google’s systems treat image-derived signals the same way as text-derived ones is not addressed in the reporting reviewed here. That is a fair question for regulators and for independent researchers to put to the company.
For anyone weighing Google Photos AI Mode privacy, the safest reading is narrow. The policy permits a path from Photos to ad personalization only after consent. It does not describe automatic scanning. And it names the categories it will not use. Those three points are what the public record supports today.
Historical Context: A Categorical Promise Becomes Conditional
The Verge reported that the new wording adds an exception to language that previously ruled out personalized ads based on Gmail, Photos, and Drive content without qualification. That is the single most important piece of history in this story. The product changed first, with connectors that let AI read personal data, and the policy followed to describe what the product now does.
Privacy policy edits tend to follow product launches by weeks or months, and a wide gap between what a policy says and what a product does invites regulatory attention. Our analysis of Meta’s $25B verdict and the privacy-code reckoning shows how costly a mismatch between data practice and disclosure can become in 2026.
Google published the change with an effective date, and its earlier policy versions remain archived. Whether the notice reached the people it affects is a separate matter. Several outlets, including LCX, described the update as quiet, and coverage kept arriving a week after the effective date.
Market Impact: AI Search Needs a Business Model
Search advertising built Google’s business, and conversational AI threatens it. A chatbot answer leaves little room for ten blue links and the ad slots around them. Any company in that position has two options: charge for the assistant, or find a way to monetize the answers. Google is trying both, with paid Gemini plans on one side and ad tests in AI Mode on the other.
Personalization is the lever that makes ads inside AI answers worth more to advertisers. An ad matched to a query is useful. An ad matched to a query plus a user’s connected context could be far more valuable, and that is the commercial logic behind letting consented personal data inform content, including ads. The incentive is obvious, even though Google has not published revenue figures tied to the feature.
For the ad industry, the signal is cautious optimism. Google says advertisers receive neither content nor personal identifiers, so the buy-side relationship does not change. Agencies will watch for new targeting options, reporting changes, and any disclosure requirements that follow from an AI-answer ad surface. None of these has been announced in the sources reviewed.
Competitive Comparison: Three Consent Models for AI Personalization
Every company building a personal AI assistant faces the same design choice about how consent, data access, and monetization fit together. Rather than guess at rival policies we have not verified, the table compares four archetypes. Google’s October update is closest to the first row.
| Consent model | How it works | Strength | Weakness |
|---|---|---|---|
| Connector opt-in with conditional ad use | User connects services, policy allows personalization of content including ads | Funds a free assistant, user keeps a default-off baseline | Consent can bundle usefulness with ad personalization |
| Connector opt-in, ads never use connected data | User connects services, a hard rule bars ad use | Simple promise, easy to audit | Loses an ad signal, pushes cost to subscriptions |
| No ads, paid assistant only | Revenue comes from subscriptions, not advertising | Removes the conflict of interest | Excludes users who will not pay |
| Account-wide default on | Personalization applies unless the user opts out | Maximum data for relevance | Highest regulatory and trust risk |
Google’s design sits mostly in the first row, with a default-off baseline that keeps it clear of the fourth. The default is off, which protects the baseline. The exception is conditional, which preserves the ad business. Users who want certainty can compare the free and paid tiers of the major assistants, and our roundup of the best AI chatbots in 2026 covers how those plans differ.
The Workspace and Enterprise Angle
The policy language mentions Workspace apps such as Gmail and Drive, which raises an obvious question for employers. Corporate mailboxes hold contracts, personnel records, and client data. The reporting reviewed here concerns the consumer privacy policy and says nothing about how Workspace administrators control connectors or whether business accounts are treated differently.
Security teams should not wait for clarity. Employees often use personal accounts for work tasks, and a connector enabled on a personal Gmail account can touch work correspondence forwarded there. Surveys of workplace AI habits already show how often staff reach for tools their employer never approved, a pattern we examined when 45% of workers were found using shadow AI. A policy that links personal data to ad personalization adds one more reason to write clear rules about connectors.
The broader trend is that institutions are drawing lines around AI access to sensitive data. Banks, for example, have moved to restrict outside AI agents from reaching customer accounts, as covered in our report on five big US banks blocking third-party AI agents. Expect similar caution in corporate IT as connectors spread.
How to Check Your Own Settings
Users do not need to wait for a regulator. The controls exist, and the policy’s structure makes the logic easy to follow: the ad pathway opens only when you opt in. Menu names and locations change often, so the steps below describe what to look for rather than quoting exact labels.
Audit Connected Services
Open your Google Account settings and look for the section covering connected apps and services in Gemini and Search. If Gmail, Google Photos, or Drive appear as connected, decide whether the convenience justifies the exposure. Turning off a connector removes it as an input. Also review whether Personal Intelligence is enabled in Search, since Google’s documentation names that feature specifically.
Review Ad and Search Personalization
Check the ad personalization and Search personalization settings as well. The policy says personalized recommendations in Search can use info from your Google Account, including Search Services History. If you prefer less tailoring, turn those options off. Users who want to cut tracking more broadly can pair account changes with a privacy-first browser, and our guide to the best browsers for privacy compares the main choices.
Five Predictions for AI Search and Personal Data
These are analytical forecasts, not reported facts. They rest on the incentives visible in the policy language and in the reporting above.
- Clearer consent prompts will follow. Pressure from press coverage and regulators will push Google to separate “use my Gmail to answer questions” from “use my data for ads” in the interface, if it has not already.
- Regulators will ask about the FAQ gap. The distance between the “never used for ads purposes” FAQ line and the opt-in policy exception invites questions from data protection authorities, particularly in Europe.
- Rivals will market a no-ads promise. Competing assistants that rely on subscriptions will use Google’s change as a selling point.
- AI Mode ads will expand. The reported tests suggest Google intends to scale the format once it proves out.
- Sensitive-category audits will become a demand. Advocacy groups will push for independent testing of the image and email filters Google describes.
None of these predictions assumes bad faith. They assume that a company with an ad business, an AI product, and a new legal permission will use all three. Readers can follow the wider pattern in our coverage of the AI and machine learning category.
The Takeaway
Google did not announce that it reads your inbox for ads. It rewrote a categorical promise into a conditional one, tied the condition to a user choice, and listed four safeguards around it. That is a meaningful shift, and also a narrower one than many headlines suggest.
The real test is design, not drafting. If the opt-in is clear, separate, and reversible, the policy is defensible. If it hides inside a bundle of AI features, the safeguards become a legal shield rather than a user protection. Until Google publishes more about how consent is collected and how the sensitive-category filter works, the honest position is cautious: the door exists, the lock is on your side, and it is worth checking where you left the key.
Frequently Asked Questions
Is Google using my Gmail and Google Photos data for ads right now?
Not by default. Google’s policy says content from Drive, Gmail, and Google Photos is not used for personalized advertising unless you choose to make that data available to other Google services that support personalized ads.
When did the Google privacy policy change take effect?
The update became effective on October 16, 2026. Outlets such as 9to5Google and The Verge reported on it in the days that followed.
What is Personal Intelligence?
It is a Google feature that lets Gemini and AI experiences in Search use connected Google services, such as Gmail and Google Photos, to tailor responses. Google’s Photos help page says that if you enable it in Search and connect Photos, Search may process data you allow to personalize content, including ads.
Do advertisers see my emails or photos?
No, according to Google. The company says advertisers do not receive Drive, Gmail, or Google Photos content, and they do not receive personally identifying details such as a name or email address.
Can ads target sensitive topics like health or religion?
Google says it will not show ads based on sensitive categories including race, sexual orientation, religion, or health. How that rule is enforced on image and email content has not been independently documented in the reporting reviewed here.
How do I stop Gmail data from reaching Gemini or AI Mode?
Review the connected services in your Google Account, disconnect Gmail, Photos, or Drive where you do not want AI access, and check whether Personal Intelligence is turned on in Search. Also review your ad and Search personalization settings.
Does this apply to Workspace business accounts?
The policy language mentions Workspace apps such as Gmail and Drive, but the reporting reviewed for this article does not explain how administrators control connectors on business accounts. Organizations should check their admin console documentation directly.
