Google's privacy policy now lets connected Gmail and Photos data shape ads
- Since 16 October, Google's privacy policy says Gmail, Drive and Photos content can shape ads if you connect those apps to Google services such as Search.
- Nothing changes by default. The exception applies only to people who turn on Personal Intelligence and connect their apps.
- Advertisers don't get your inbox or photos. You can disconnect apps or switch off personalisation in your Google Account.
Think about what sits in your inbox: flight bookings, bank alerts, a message from your doctor. For five years, Google’s privacy policy has said in plain words that none of it would be used to pick the ads you see.
That promise now has an exception. A Google privacy policy update, in effect since 16 October, says Gmail, Drive and Google Photos content can help shape ads if you choose to connect those apps to other Google services, such as Search. Nothing changes for people who never connect them.
The timing matters. Google is asking people to let its AI read their personal apps so it can give better answers. This update says, for the first time, that the same access can also serve advertising.
How the Google privacy policy update rewrites a 2021 promise
Google added the line “We don’t show you personalized ads based on your content from Drive, Gmail, or Photos” to its policy in July 2021. Google’s own comparison page shows the 16 October edit. The sentence now ends: “unless you choose to make data from these services available to other Google services that support personalized ads.”
A new paragraph explains the path. You can let services “like Search or Gemini Apps” read data from Gmail, Drive and Photos. “For example, Search may process some of the data that you allow Search to access to personalize content, including ads.”
The doorway is Personal Intelligence. It came to AI Mode in Google Search in January. Once connected, AI Mode can use a hotel booking in your email to suggest things to do nearby. For Search, Google’s help page lists Gmail, Google Calendar and Google Photos as the apps you can connect today.
Google’s help page is direct about ads: they “will not be based directly” on your inbox or photo library. Instead, Search may use “summaries, excerpts and inferences” from them, and “that same info may be used to show you ads.”
What Google rules out, and what it leaves open
Some limits stay firm. Google says advertisers never get your inbox or photo library, or your name and email. It does not show personalised ads based on sensitive categories such as health, religion, race or sexual orientation.
Other questions stay open. The policy names Gemini Apps alongside Search, but its ads example and help page cover only Search. Google has not said how many people have connected their apps. Nor has it explained how it would tell a flight booking from a hospital letter when both get summarised.
How to check your Personal Intelligence settings
If you never connected your apps, there is nothing to do. If you did, or you’re not sure, Google’s help pages describe these steps. Google notes these settings are being updated, so names may differ slightly.
- In your Google Account, open Search Services Personalization.
- Go to Additional Personal Intelligence, then Connected Content Apps, and disconnect Google Workspace or Google Photos.
- To switch off personalisation in Search completely, turn off Personalized Recommendations.
- Old data stays in your Search Services History after you disconnect, so delete what you don’t want at activity.google.com.
That turns off Personal Intelligence for Search. In Gemini, go to Settings & help, then Personal Intelligence, then Connected Apps. Your general ad choices live in My Ad Center.
Personal Intelligence is for adults with personal accounts, and Google’s help page says the Gemini version isn’t yet offered in the UK, Switzerland, Nigeria or the European Economic Area.
Fair as an opt-in, but the trade deserves a clearer label
On balance, Google has done more right than the headlines suggest. The default is unchanged, the ads rule only follows a choice you make, and the edit sits in a public archive anyone can check. And ads are part of how Google pays for free services like Gmail.
The concern is about how the choice is framed. People connect Gmail to get a smarter answer about their trip, not to feed an ad system. Sharing your data for help and sharing it for ads are two different deals. The fairest design would ask for each one separately. If you want to see how fast Google is weaving AI into email, our look at Gmail’s AI Inbox shows the other half of that story.
The change to Google’s Gmail privacy promise is small in words and large in meaning. The next thing to watch is whether Google makes the ads part its own clear switch, or whether regulators ask it to.
Sources (8): every key fact checked against at least two
- Google Privacy Policy (effective 16 October 2026)
- Google Privacy Policy: comparison of the 1 October and 16 October 2026 versions
- Google Search Help: Connect your Google content apps to Search services
- Google Search Help: Personal Intelligence in AI Mode
- Gemini Apps Help: Connect your Google apps to personalize your Gemini experience
- Google: Personal Intelligence in AI Mode in Search (22 January)
- The Verge: Now Google says it might use your Gmail and Google Photos data to target ads (23 October)
- Android Authority: Google makes a privacy policy exception to use your Gmail and Photos data for ads (23 October)
Related stories
Spotify Family plan QR code check: what the 7-day rule means for your family
Spotify's Family plan QR code check asks some members to scan in person within 7 days, or face a 12-month bar. Who it affects and what to do.
Arc browser is shutting down on 22 December: how to save your data and move on
The Arc browser is shutting down on 22 December 2026. Here are the key dates, how to export your data, and how to move to Dia or another browser.
PHP2Shell: PHP rushes out fixes for two critical server flaws as Node.js patches 10 bugs
PHP2Shell: PHP fixed two critical flaws that could let attackers take over web servers, and Node.js patched 10 bugs. Who is affected and what to do now.