Google’s revised privacy policy, effective October 16, 2026, now says the company may use data from Drive, Gmail and Google Photos to inform personalized ads, but only when a user chooses to make that data available to other Google services. Ars Technica ran the story under the headline “Updated Google privacy policy says your Gmail might be used for advertising”, and The Verge and 9to5Google followed within hours. The wording is narrower than the headline suggests. Still, it marks a visible change in how the company describes the link between personal content and its ad business.
This Google privacy policy Gmail ads change matters to more than privacy hawks. Anyone who builds on Google Workspace, ships software that touches Gmail data, or runs internal AI tools next to it now has a policy clause to read closely. Companies across the industry keep rewriting data terms as AI features spread. We tracked a similar pattern when Meta scrapped its “train” clause before an October deadline. Below, we sort what Google confirmed from what remains open, then cover the market impact, the controls users have today and what to expect next.
Don’t miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
Add Now
What Google Changed on October 16, 2026
The policy covers a long list of Google products, and the new language names six of them: Gmail, Google Drive, Google Photos, Google Search, Gemini Apps and Google Workspace. The current policy result shows the October 16, 2026 effective date. Google keeps archived versions of earlier policies on its own site, which lets readers compare the new text against the version that ran through the summer.
The core sentence is a carve-out. Google says it does not show personalized ads based on content from “Drive, Gmail, or Google Photos” unless the user chooses to make data from those services available to other Google services that support personalized ads. That structure creates a default (no ads from that content) and an exception (user-authorized sharing). The exception is the news.
Google gives one concrete example. Search may process data a user allows it to access in order to personalize content, including ads. In other words, if you connect your inbox or photo library to Search so it can answer personal questions, that connected context could shape what sponsored results you see. Google did not publish a number of affected users, a rollout schedule or any pricing tied to the feature in the material we reviewed.
The policy change also arrives at a busy moment for Google’s AI products. Reports from The Verge and 9to5Google tie the new clause to Personal Intelligence, the feature set that lets Google’s AI experiences draw on a user’s own apps. We cover that link in a later section. First, the exact wording deserves a closer read.
The Exact Wording: What the Policy Says and What It Does Not
Headlines compress. The policy does not say Google will read your emails and sell you things based on them. It says Google does not do that by default, and it describes a path where user-approved connections can feed other services that support personalized ads. Our fact sheet for this story flags the headline phrasing as an imperfect summary of that path, so we separate the confirmed from the unconfirmed below.
| Claim | Status | Where it comes from |
|---|---|---|
| Policy took effect October 16, 2026 | Confirmed | Current Google privacy policy result |
| No personalized ads from Drive, Gmail or Photos content unless the user opts to share it with ad-supporting services | Confirmed | Google privacy policy text |
| Search may process user-allowed data to personalize content, including ads | Confirmed | Google privacy policy text |
| Google does not scan or read Gmail messages to show ads | Confirmed | Google blog post on ad privacy |
| Advertisers do not receive names or email addresses unless the user asks | Confirmed | Google policy and blog post |
| “Your Gmail might be used for advertising” as an exact policy statement | Not confirmed | Headline wording only |
| Number of affected users, pricing or usage limits | Not stated | No figure in cited material |
The last two rows matter as much as the first five. No named Google spokesperson appears in the material we used, and no figure for affected accounts exists. Anyone quoting a specific user count for this change is guessing.
How the Google Privacy Policy Gmail Ads Link Works in Practice
Think of three layers. The first layer is the content itself: messages in Gmail, files in Drive, pictures in Photos. Google says it does not use that content to target ads. The second layer is a connection a user turns on, such as letting Search or Gemini Apps access data from Photos and Workspace applications for a more personalized experience. The third layer is the ad system, which Google says can use data a user has allowed a service to access.
The distance between layer one and layer three is where the debate lives. Google’s position, as Ars Technica reported it, is that connecting apps is entirely opt-in, that ads stay tied to the query, the response context and the user’s interests, and that ads will not be built directly from a Gmail inbox or a Photos library. Critics read the same text and see a route by which personal context could still bend ad relevance.
Ars Technica also pointed out that Gemini itself did not carry ads, while sponsored content can appear inside AI-powered Search tools. That detail explains why the policy names Search in its example. The ad surface sits in Search, and the personal data sits in Gmail and Photos. The opt-in connection is the wire between them.
Opt-In Is Doing Heavy Lifting
Every reassurance in Google’s framing rests on the word choice. If a connection is truly a deliberate user decision, the exception is narrow. If setup screens bundle personalization toggles into broader AI feature prompts, the practical result changes. The policy text cannot answer that question. Interface design will, and researchers will test it in the coming weeks.
Where Search and Gemini Apps Enter the Picture
Gemini Apps earn a separate note because Google handles them differently from Search. According to Google’s Gemini Apps privacy documentation, chats in Gemini Apps are not used to show users ads. The same documentation says that if eligible users opt in to personalization with connected apps, data from those apps can personalize Gemini and support features such as Gemini Spark and Gemini in Chrome.
So two statements sit side by side. Gemini chats do not feed ads. Search can use user-allowed data to personalize content, including ads. A reader who treats “Google AI” as one thing will blur those lines. A reader who treats Gemini Apps and Search as separate products with separate rules will read the policy more accurately.
Developers watching Google’s AI tooling will recognize the pattern of fast model updates paired with shifting data terms. Our earlier look at how Gemini 3.6 Flash reached Antigravity with up to 17% fewer tokens shows how quickly Google ships new AI features into coding workflows. Each new connected feature raises the same question: which data does it touch, and under which policy clause?
How Ars Technica, The Verge and 9to5Google Framed It
Three outlets drove the first wave of coverage, and each chose a slightly different emphasis. Ars Technica leaned on the “personalization trap” idea and the headline question about Gmail. The Verge titled its piece “Now Google says it might use your Gmail and Google Photos data to target ads” and focused on users who connect those services to AI Mode and Search. 9to5Google published on October 23 under a headline that ties the ad targeting directly to Personal Intelligence being enabled.
| Outlet | Headline angle | Main framing |
|---|---|---|
| Ars Technica | Gmail might be used for advertising | Policy opens a door, Google says opt-in only |
| The Verge | Google might use Gmail and Photos data to target ads | Exception applies to users who connect services to AI Mode and Search |
| 9to5Google | Ads based on Gmail and Photos data if Personal Intelligence is on | Conditional on enabling Personal Intelligence |
Notice the verbs. Ars says “might,” The Verge says “might,” and 9to5Google says “will, if.” None of the three reports that Google reads inboxes for ads, and none describes the change as automatic. The shared message is conditionality, which matches Google’s own phrasing.
What Google Says It Will Not Do With Gmail
Google’s defensive position is clear and specific. In a post on its ad privacy practices, the company says it will not scan or read Gmail messages to show users ads. It adds that Gmail ads come from a fully automated process and rely on online activity while the user is signed in to Google. It also says it does not share personally identifying information, including a name or email address, with advertisers unless the user asks it to.
Those three promises hold regardless of the October 16 update. The update adds a fourth idea: user-authorized connections can bring Gmail, Drive and Photos data into services that support personalized ads. Google does not describe that as scanning messages. It describes it as data the user chose to make available.
A fair reading holds both statements at once. Google keeps its long-standing line that inbox content is off limits for ad targeting. At the same time, the company wrote a policy clause that anticipates connected AI features pulling from those same apps. Whether those two positions stay comfortable together depends on product details Google has not published yet.
Ads Personalization: The Control You Already Have
Users who want a clean break can act now. Google says people can turn off personalized Gmail ads through Ads Settings by disabling Ads Personalization. That single switch is the confirmed control for ad targeting. It does not remove Gmail from your account, and it does not cancel connected-app features you enabled elsewhere, so the two settings deserve separate checks.
| Control | Where it lives | What it does | Source |
|---|---|---|---|
| Ads Personalization | Ads Settings | Turns off personalized Gmail ads when disabled | Google blog post |
| Connected apps for Gemini | Gemini personalization settings | Lets eligible users opt in to personalization from connected apps | Gemini Apps privacy help page |
| Search personalization with Workspace and Photos data | User-chosen connection | Lets Search process allowed data, including for ads | Google privacy policy |
| Gemini Apps chats and ads | Policy default | Chats are not used to show ads | Gemini Apps privacy help page |
Privacy-minded users often pair account settings with browser choices. We ranked the options in our guide to the best browser for privacy in 2026, which covers five picks from $0 to $59.99. A browser cannot change what Google does inside your account, but it limits the extra tracking layered on top.
Why Developers and Software Teams Should Care
The software angle is practical. Teams that run on Google Workspace store source-adjacent material in Gmail threads, Drive folders and shared documents. Teams that build integrations ask users to grant access to those same services. A policy that describes how connected data can flow into personalized experiences changes the questions a security reviewer asks during procurement.
Workspace Admins and Internal Policy
Admins should read the policy alongside their own Workspace agreements and confirm which rules govern managed accounts versus personal ones. The material we reviewed does not spell out how the October 16 language applies to managed Workspace tenants, so we advise treating that as an open question to raise with Google rather than assuming an answer. Document the settings you verify, and re-check them after major product updates.
Connected Apps and Access Scopes
Anyone shipping an app that requests access to Gmail or Drive data should audit what the app asks for and why. Narrow scopes, short retention and clear consent screens reduce risk no matter how Google words its own policy. Our walkthrough of MCP authentication with OAuth 2.1 and zero-trust in 13 steps shows a practical pattern for limiting what an AI tool can touch.
Employee behavior adds another layer. Our coverage of shadow AI found 45% of workers using unsanctioned tools, and staff who connect personal accounts to AI features at work widen the exposure. Clear rules on which accounts and connections are allowed matter more than any single policy clause.
Historical Context: From Scanned Inboxes to Opt-In Connections
Gmail and advertising have a tangled history, and the October 16 update is the newest chapter. Google’s stated position today is that it does not scan or read Gmail messages to show ads, and the company has repeated that line in its ad privacy materials. The new clause does not reverse that statement. It adds a pathway built for the AI era, where assistants answer questions using your own mail and photos.
The shift in framing is the story. Older ad models targeted people from browsing and search behavior. Newer AI assistants can use personal context directly, which is far richer than a list of visited pages. A policy that once needed to say little about connected personal data now needs to say a lot, and Google’s revision reflects that.
Regulatory and legal pressure on data practices has also grown across the industry. A New Mexico court ordered Meta to pay $567 million in a child-safety case, a development we examined in our analysis of the verdict and its privacy-code reckoning. Every large platform now writes policy text with that backdrop in mind, which partly explains Google’s careful, conditional phrasing.
What Public-Opinion Data Says About Targeted Ads
Pew Research Center has measured American attitudes toward data-driven advertising for years. The figures below are older than this policy, so read them as background on public sentiment rather than reaction to Google’s update. In its 2019 study on public knowledge and experiences with data-driven ads, Pew reported the following.
77% of U.S. adults said they had heard at least a little about how companies use personal data to offer targeted advertisements, special deals, or customer risk assessments.
Pew Research Center, 2019, Public Knowledge and Experiences with Data-Driven Ads
64% of U.S. adults said they had seen advertisements or solicitations that appeared to be based on a profile created from their personal data.
Pew Research Center, 2019, Public Knowledge and Experiences with Data-Driven Ads
Pew’s earlier 2012 search-engine study found a similar tension on the search side.
73% of search users said they were not okay with a search engine tracking their searches and using that information to personalize future search results because they viewed it as an invasion of privacy.
Pew Research Center, 2012, Search Engine Use 2012
The pattern holds across both studies. People know their data fuels ads, and many dislike it. That gap explains why an opt-in framing is the safest posture for Google, and why critics watch the setup flow so closely.
Market Impact: Advertisers, AI Search and the Ad Race
For advertisers, the clause signals where Google sees growth. Ads inside AI-powered Search surfaces need relevance signals, and connected personal context is a strong one. Google says advertisers do not receive Drive, Gmail or Photos information, so brands gain better matching without seeing the underlying data. If that holds, the clause strengthens Google’s pitch that AI Search can carry ads without breaking user trust.
For publishers and SEO teams, the story runs in the other direction. Personalized AI answers with sponsored placements change how people reach websites. Two of our recent pieces track that shift: one on how OpenAI Dots and Meta Muse reshape SEO, and another on what happens when AI agents become website visitors. Personalization makes each answer unique, which makes rank tracking and attribution harder.
For Google’s rivals, the clause sets a reference point. Any competitor building a personal AI assistant with an ad business behind it faces the same design question: how do you separate private content from ad signals without losing relevance? Google’s answer, user-authorized connections plus a default of no ad use of inbox content, will be copied or attacked depending on how users react.
Competitive Comparison: Google’s Surfaces Side by Side
A cross-company comparison would need verified policy text from rivals, and our sources did not cover that. So we compare the surfaces Google itself describes. Treat them as three separate relationships between your data and advertising.
- Gmail ads: Google says selection is fully automated, based on online activity while signed in, and not on scanned messages. Personalization can be switched off in Ads Settings.
- Search with connected data: Google says Search may process data users allow it to access, including to personalize ads. This is the surface the October 16 clause targets.
- Gemini Apps: Google’s documentation says chats are not used to show ads. Connected apps can still personalize Gemini itself when eligible users opt in.
Seen this way, the news is not that Gmail suddenly became an ad engine. Search became the place where user-approved personal context can meet advertising. The Gmail and Gemini positions stayed where Google says they were.
Financial and enterprise buyers already show caution about AI agents touching sensitive accounts. Five large US banks blocked third-party AI agents, which we covered in our report on US banks blocking third-party AI agents. Expect corporate security teams to apply similar scrutiny to connected-app features inside email and storage.
Five Predictions for the Weeks Ahead
These are our analysis, not reported facts, and we have not tied them to specific dates or figures.
- Google will publish a plainer explainer. The gap between headlines and policy text invites a clarification, likely through its blog or help pages.
- Researchers will audit the setup flow. Security and privacy analysts will test whether the connection prompts present personalization as a clear, separate choice.
- Regulators will ask questions. Privacy authorities that track ad personalization and AI features have a new clause to review.
- Enterprise admins will demand tenant-level answers. Workspace customers will press for written confirmation of how the clause applies to managed accounts.
- Rivals will highlight their own rules. Competing assistants will market firm separation between personal content and ads.
The first prediction carries the highest odds because Google already issued clarifications to Ars Technica. The fourth matters most to anyone who manages software teams.
What to Do Now: A Short Checklist
Start with Ads Settings and confirm whether Ads Personalization is on. Then review which apps and services you connected to Search or Gemini. Disable any connection you do not use. Admins should record their findings and ask Google how the policy applies to managed accounts. Developers should trim OAuth scopes, shorten retention and write consent screens that name the data an app reads.
For more on tools and practices in this area, see our software coverage hub. We will update this analysis if Google publishes further detail on the October 16 policy language.
Frequently Asked Questions
Is Google reading my Gmail to show me ads?
No, according to Google. The company says it will not scan or read Gmail messages to show users ads. Gmail ads come from a fully automated process based on online activity while you are signed in to Google.
What exactly changed in Google’s privacy policy?
The policy, effective October 16, 2026, says Google does not show personalized ads based on content from Drive, Gmail or Google Photos unless you choose to make data from those services available to other Google services that support personalized ads.
Does Search use my Gmail or Photos data for ads?
Only if you allow it. Google says Search may process data a user allows it to access in order to personalize content, including ads. Without that connection, the default of no ad use of Drive, Gmail and Photos content applies.
How do I turn off personalized Gmail ads?
Open Ads Settings in your Google account and disable Ads Personalization. Google lists this as the way to turn off personalized Gmail ads.
Do advertisers get my name or email address?
Google says it does not share personally identifying information, including your name or email address, with advertisers unless you ask it to.
Are Gemini Apps chats used for advertising?
Google’s Gemini Apps privacy documentation says chats are not used to show users ads. Opting in to connected apps can personalize Gemini itself, which is a separate matter from ad targeting.
How many users does the change affect?
The material we reviewed gives no figure. Google has not published a number of affected accounts, a rollout schedule or any pricing tied to the feature, so any specific count circulating online is unverified.
