Google's privacy policy now allows ads informed by Gmail, Drive or Photos data you connect to its AI features

A connect your apps toggle is not a convenience setting. It is a data agreement.

What happened

Google updated its privacy policy on October 16, a change spotted by Android Authority and covered by Ars Technica and The Verge.

The ad personalization section used to say: "We don't show you personalized ads based on your content from Drive, Gmail, or Photos." It now adds an exception, "unless you choose to make data from these services available to other Google services that support personalized ads."

The mechanism is Personal Intelligence, released in early 2026, which lets users connect data from apps like Gmail, Drive and Photos to Gemini and to Search tools such as AI Mode. Per The Verge, anyone who connected those apps may now see ads targeted on the basis of that content.

Google told Ars that connecting apps is entirely opt-in, that ads "will not be based directly on your Gmail inbox or Photos library," and that sensitive information will not be used to tailor ads. The Verge reports advertisers do not get access to that content or to details like your name or email address. Ars notes Google uses prompts and pop-ups to encourage people to turn the feature on, so some users may have enabled it without realizing.

To turn it off, Ars points to the Gemini settings for Personal Intelligence, or Data & privacy, Personalization settings, Manage Personalized Recommendations in Search Services, Connected Content Apps.

My take

Plenty of the small businesses I work with still run sales and support from a personal Gmail account. That inbox holds client names, quotes and invoices. If the owner tapped "connect" on an AI prompt months ago, that data now feeds more Google services than they think.

What I do when I set up automations around a client's Google account:

1. Separate the business from personal accounts where possible, with the automations on an account that exists only for that job.
2. Grant the narrowest OAuth scopes the workflow needs, and no more.
3. Keep a simple register of every connected app and AI feature, who enabled it and why.
4. Review it every quarter, the same way you would review user access.

The policy change itself is small. The lesson is the habit of knowing where your data goes.