Google has updated its privacy policy to allow the use of data from Gmail, Drive and Google Photos for personalised advertising when users enable its AI‑driven features. The change, first spotted by Android Authority and reported by The Verge, adds an exception to the company’s earlier promise not to use those services for ads. Business owners who rely on Google tools should review the impact because ad targeting can affect both customer perception and marketing spend.

What happened

According to The Verge, the revised terms took effect on 16 October 2026 and state that data may be used for ads "unless you choose to make data from these services available to other Google services that support personalised ads." In practice, anyone who links Gmail, Drive or Photos to Google’s Personal Intelligence or AI Mode may see ads that reflect the content of those files. The policy clarifies that advertisers will not receive direct access to the raw data or identifying details such as names or email addresses. Google also pledges not to serve ads based on sensitive categories like race, sexual orientation, religion or health.

Why it matters for businesses

For small and mid‑size firms, the shift introduces a new privacy vector that can influence brand reputation. Customers increasingly expect that personal communications and media remain separate from commercial advertising. If a client’s email or photo collection inadvertently shapes the ads they see, the business could be perceived as over‑reaching, even though the data never leaves Google’s servers.

The change also has practical cost implications. More targeted ads can improve conversion rates, but they may also increase the price of ad inventory as competition for the same data‑driven audience intensifies. Companies that have built their marketing budgets around Google’s previous guarantee of separation may need to adjust forecasts.

From a compliance standpoint, the policy touches on data‑processing obligations under regulations such as the GDPR, the CCPA and emerging UAE and Pakistani data‑protection laws. While Google says it will not share personally identifying information, the mere act of processing personal content for advertising purposes can trigger additional documentation, impact data‑impact assessments and require clear consent from users.

Finally, the update underscores the importance of data governance within the organisation. When employees enable AI features across Google Workspace, they may unintentionally broaden the data pool that feeds ad algorithms. A lack of oversight can lead to inconsistent practices across departments, increasing the risk of regulatory scrutiny.

Practical steps for business owners

  1. Audit Personal Intelligence settings – Review which Google services (Search, Gemini Apps, etc.) have access to Gmail, Drive or Photos. Disable any connections that are not essential for daily workflows.
  2. Turn off personalised recommendations – Use the Search Services Personalisation page to switch off the feature if you prefer a clear separation between work data and advertising.
  3. Update employee guidelines – Communicate the policy change to staff and provide a short checklist for safe use of AI tools, emphasising that personal or client‑sensitive files should remain offline from Google’s AI features.
  4. Adjust ad‑targeting preferences – Within Google Ads, review the “Ad Personalisation” settings and opt out of using your own Workspace data where possible. This can limit the extent to which your own content influences the ads shown to you and your team.
  5. Consider alternative AI solutions – If the policy does not align with your privacy stance, evaluate third‑party AI agents or on‑premise tools that integrate with your CRM or automation platform without exposing internal data to external ad networks.

The bottom line

Google’s policy amendment means that data stored in Gmail, Drive and Photos may now inform the ads you see when you use its AI features. The change does not give advertisers direct access to that data, but it does broaden the scope of personalisation within Google’s ecosystem. For business owners, the priority is to understand the new settings, ensure compliance with relevant privacy regulations, and decide whether the convenience of Google’s AI outweighs the potential reputational and cost implications. A proactive review of permissions and a clear internal policy can help maintain customer trust while still benefiting from the productivity gains that AI tools provide.