Executive Summary

Key Figures

What moved in this revision was a set of dates and a word count. The last card is about who the exception actually reaches.

Source: Google Privacy Policy (effective 2026-10-16) · PPC Land, version comparison

The live Google privacy policy carries an effective date of October 16, 2026. In the section that deals with advertising, one sentence now reads: "We don't show you personalized ads based on your content from Drive, Gmail, or Google Photos, unless you choose to make data from these services available to other Google services that support personalized ads." No personalized ads from the content of Drive, Gmail and Google Photos, that is, unless the user has chosen to make that data available to other Google services that support personalized ads.

What sits before the comma is not new. PPC Land compared the 54 versions Google has kept since June 9, 1999, and found the opening clause word for word as the July 1, 2021 version had it. Counting the July 2021 version itself, it came through seventeen versions without a letter changing, the last of them dated October 1 of this year. The same comparison turned up no earlier case of Google rewriting existing wording in the advertising section and adding fresh explanation alongside it.

The table below puts the July 2021 version and the live one next to each other.

Fifteen plus eighteen is thirty-three, yet the current sentence runs to thirty-four words. The spare word did not come from the condition. It came from the list, where Photos became Google Photos. The meaning turns entirely on the eighteen words after the comma.

Two more sentences entered the same section. The first sets out what Search may do: "For example, Search may process some of the data that you allow Search to access to personalize content, including ads." Search may process some of the data it has been allowed to reach in order to personalize content, and ads count as content here. Drop the opening two words and the meaning changes. It is not a standalone new permission but an illustration of the sentence immediately before it, the one about choosing to allow. It takes Search as the example of what happens once a user lets one service use another service's data. The other restates the basis for personalized ads. According to PPC Land's comparison, that basis used to be interests and activity across Google services; it now reads interests, activity, or personalized content from Google services. What was derived from the data, rather than the data itself, has arrived as a third basis.

The dates are tight as well. The previous revision landed on October 1 and brought in the phrase about activity across devices. That version lasted fifteen days.

The weight of the exception rests on the word choose. What is being chosen is written down in the policy itself: "If you choose to allow certain services to process data from other services, including for features such as Personal Intelligence, the same data may be used to personalize your experience." Allow one service to process data from another, for a feature such as Personal Intelligence, and the same data may go on to personalize your experience.

The permission language sitting earlier in that same section has the same shape. It says a user may choose to let certain Google services, Search and the Gemini apps among them, reach data from other Google services such as Google Photos and Workspace apps like Gmail and Drive, in order to provide a more personalized experience, and that the access follows the policies and settings of the service doing the reaching. The two sentences describe one act: opening your inbox and your photo library to the AI side in exchange for better answers.

What that permission means in practice is something the policy illustrates on its own. Ask Search about a recent hotel booking, it says, and Search may consult the reservation sitting in your mail to suggest things to do near the hotel. One email read in order to change a set of search results. The section carrying that example is headed Provide personalized services, including content and ads, and all three sentences quoted in section 1 sit inside it too. Reading mail to reshape a recommendation and choosing an ad are explained as one bundle in this policy.

The feature's name is Personal Intelligence. It opened in January to paying AI Pro and Ultra subscribers and widened in March to the whole of the United States, free users included. It connects Gmail, Calendar, Drive, Google Photos, YouTube watch history and Search to Gemini and to AI Mode in Search so that answers can be personalized. The default is off, so the user has to opt in; leave it off and the October 16 exception never applies. Put another way, this revision is not something that happened to every Gmail user. A line has been drawn between the people who opted in and the people who did not.

When Personal Intelligence reached all of the United States in March, Google raised the subject of advertising before anyone asked. According to TechSpot's account of what was said then, the experience would stay ad-free for now, though the company expected ads to work similarly for connected users down the line. The promise came with a clock attached from the start. The only thing missing was when the clock would run out.

The October 16 clause looks very much like the second half of that remark moving into the document. Rather than a promise quietly reversed, it reads as a direction announced seven months earlier taking up residence in the policy's own wording. One difference separates the forecast from the clause, though. What was said in March was an expectation of what would probably happen. What the policy now says is that it is permitted to happen. An expectation can be set aside; a permission has effect.

Pull the timeline back further and the reason the sentence existed at all comes into view. In 2017 Google stopped scanning consumer Gmail content for ads personalization. Ads did not leave Gmail as a result. Advertising aimed using data from outside the inbox, such as Search or YouTube activity, stayed where it was. The state of affairs in which the inside of the mailbox was held apart from advertising was nailed down in the privacy policy in 2021, and that state of affairs became conditional this October.

TechSpot read the new wording as the first time since 2017 that, in its words, "Google's own policy has allowed inbox content to play a part in ads, even if only indirectly." The qualifier about indirectness travels with that assessment. Even so, a conditional passage has opened in a direction the policy language had kept shut for nine years. Five dates make up the sequence so far.

Nothing has visibly changed on the advertiser side. No new targeting option or ad setting has been published alongside this revision. What has moved so far is the document, not the product.

The safeguards Google has set out are not empty words. The connection starts only when the user switches it on and can be switched off at any time. Advertisers cannot reach Gmail, Drive or Photos. Identity details such as a name or an email address do not pass to advertisers unless the user allows it. Sensitive categories including race, religion, sexual orientation and health are excluded from ad targeting. The statement that ads are not directly based on the inbox or the photo library is Google's own, published as it stands.

The next sentence of that same explanation lays out the route. AI Mode may draw on summaries, extracts and inferences taken from connected apps, and the same information may be used in serving ads. The body of an email does not cross into the advertising system; the summary and the inference built from reading it do. That is why the statement about not being directly based and the statement about ads being tailored with that data can both be true at once. The third basis added to personalized ads in section 1, personalized content, points at the same place.

The way out is open as well. Under Data and privacy in a Google Account, the personalization settings hold an entry for managing personalized suggestions in Search services, and the connected content apps listed there can be disconnected from Workspace and Google Photos. Personalized suggestions can also be switched off altogether. Disconnecting, however, does not erase what Google has already stored. Android Authority reported that data saved before an app is disconnected, or before personalized suggestions are turned off, may remain in the Search services record.

There are conditions on opting in, too. A user has to be at least 18, signed in to a personal Google account, with personalized suggestions turned on, before apps can be connected at all. That route is not open in every country, and within the countries where it is, Google Photos drops out in certain regions. Which is to say that whether this exception touches a given user today is partly a matter of where they are.

Two gaps remain. The first is the distance between the document and the product. The policy wording is drawn more widely than anything Google is currently doing, and the clause already has effect even with no advertiser settings released. The second is verifiability. A user who turned the connection on has no way, from any product screen, to take a single ad and tell whether it arrived by way of a summary and an inference or out of their search history. From here on this is not a verified fact but this article's judgment. A consent that cannot be checked from outside survives only as a sentence describing its own scope.

Where the advertising business goes is not ours to follow. What makes this worth reading is where the consent gets recorded. The user pressed a single toggle, and what the toggle promised was a better answer. How far that one action lets the data travel was not written beside the toggle. The privacy policy that settles it can be rewritten inside two weeks. The limit is set by what the terms permit, not by what the model is capable of.

This blog covered a case of the same kind once before. In smart TVs and automatic content recognition, removing the app left the consent to viewing-data collection standing on its own. The structure in which what you switched off in the product and what the terms still allow fail to line up is the same structure as this one. The more mail and photos get opened to AI assistants, the more places this gap has to appear.

If your company data is being connected to AI tools, four things are worth pinning down.

• Is there a record of the date each connection was switched on and which version of the terms applied then? Terms get revised, and the scope after the revision governs consent given before it
• Are the connected data and the summaries and inferences drawn from it treated as two separate things? As in this case, more and more terms handle the two differently
• Has anyone checked in writing what happens to already stored data when a connection is cut? Disconnecting and deleting are not the same action
• Who rereads the terms to see whether the scope of consent has shifted, and when? With nobody assigned to read, a changed clause simply goes unnoticed

None of the four is an argument against doing it. Connect, and keep your own record of what you agreed to. Which sentence Google rewrites next is not knowable from outside, but what our own organization has left open is something we can go and check.

Thank you for reading this far. The clauses quoted here were checked directly against the live Google privacy policy, and for the items that rest on reporting alone, such as the version comparison and the March remarks, the source is named in the text. We would be glad to hear what standard you use to set the boundaries when you connect personal data to an AI assistant.

Pebblous Data Communication Team
October 26, 2026

Primary Sources

• 1.Google. (2026). "Google Privacy Policy." Effective 2026-10-16.
• 2.Google. (2026-01-14). "Personal Intelligence: a more helpful Gemini app." The Keyword (Google Blog).
• 3.Greene, D. (2017-06-23). "As G Suite gains traction in the enterprise, G Suite's Gmail and consumer Gmail to more closely align." The Keyword (Google Blog).

Press Coverage

• 4.Rijo, L. (2026-10-23). "Google lets connected Gmail and Photos data shape ads, 5 years after pledge." PPC Land.
• 5.Ahmed, Z. (2026-10-25). "Google's privacy policy now has a loophole for using your Gmail and Photos data in ads." TechSpot.
• 6.Sood, S. (2026-10-23). "Google makes a privacy policy exception to use your Gmail and Photos data for ads." Android Authority.