Effective October 16, but only reported on October 23
On October 16, 2026, a new exception clause in Google’s privacy policy took effect: after users connect Gmail, Google Drive, and Google Photos to Personal Intelligence in Search and AI Mode, related data can be used for personalized advertising. Android Authority was the first to spot the change in the policy text, with The Verge following up with coverage on October 23, bringing the modification to public attention.
There was a week between when the policy took effect and when it was reported. The policy page doesn’t push notifications, nor does it show users pop-ups—the changes simply remained buried in the text. The effective date is written in the policy, but when users find out depends on whether media outlets investigate it.
Figure: Google app folder screenshot used in Android Authority’s report, which was the first to identify the policy changes. Source: Android Authority
One connection, two purposes
The mechanism behind Personal Intelligence is straightforward: for AI search to answer questions about personal life, it needs to access content from emails, files, and photos. Over the past year, Google has been encouraging users to connect these services to search, with the connection requiring users to actively click to authorize. A year of guidance aimed at making this click a habitual action.
After the connection is complete, Search and AI Mode can reference this private data when answering questions, providing results with personal context. This recent policy change adds “personalized advertising” to the list of permitted uses for this data. It’s the same authorization, but now the data flow has an additional destination.
It’s like giving a housekeeper the key to your desk drawer to help find something, with the policy adding a clause—that the housekeeper can also tell visiting salespeople what they found in the drawer. The functionality is something users actively requested, while the expansion is a unilateral addition to the terms. The issue lies in the granularity of authorization: users agreed to “helping you find things” but received “also helping advertisers find you.” Helping you find things and helping advertisers find you use the same data and the same authorization, with no separate toggle in between.
Figure: Google app icons from The Verge’s report, including Gmail, Drive, and Photos which are covered in this policy change. Source: The Verge
Google says no identity data, policy says ads possible
Google’s official position has two layers: advertisers won’t receive users’ personally identifiable information (PII), and ads for sensitive categories won’t be served. These commitments are written into the policy text and form the main pillars of its defense. The weight of these promises depends on execution and auditing, which the policy text itself doesn’t provide means to verify.
Critics are focusing on the wording. The policy text states that data “may be used for” personalized advertising, and in discussion threads, one person replied with just one word: “might.” The specific promises are written in detail, but the step of whether ads will actually be served is glossed over with “possible,” leaving the interpretation with Google.
Another comment went further: “Right now Google is saying it has no values, no respect, and no fear.” While this comment is more emotional than argumentative, it highlights a real point of divergence: Google is talking about data granularity, while critics are talking about who decides how uses are expanded. Both sides have valid points, but they’re arguing on different levels.
European users can opt out, others can’t
Article 5, paragraph 2 of the EU’s Digital Markets Act (DMA) requires Google to let European users choose whether to connect Search, YouTube, advertising services, Google Play, Chrome, Google Shopping, and Google Maps. In relation to this issue: European users can agree to “using data for personalized search” while simultaneously refusing “using data for advertising,” as these are legally separate decisions under this framework. Ad personalization is a service that requires separate consent in this system—agreeing to search personalization doesn’t cover it.
Users in other regions receive bundled terms. The moment they connect the services, the list of permitted uses includes advertising, with no separate toggle to disable it in the policy text. Europe’s right to separate these choices is enshrined in law; in other regions, it’s written in policy—changing law requires legislative process, while changing policy only requires a page update.
The personal details in emails and photos are high-value signals for ad targeting. This policy change brings these signals into the permitted scope for personalized advertising, adding private context as a new input to the ad system. More input means more accurate targeting—a fundamental principle of ad engineering—and this policy change provides new fuel for that principle.
Self-hosted albums are a solution, but exports often fail
The self-rescue solution repeatedly recommended in discussion threads is self-hosted albums: use Immich (a popular open-source self-hosted photo project) to store photos on your own machine, then use Google Takeout to export data entirely. For those who don’t want private photos flowing into the ad pipeline, this is the mainstream solution currently offered by the community.
Counterarguments quickly follow: some point out that Takeout exports frequently fail midway, with large albums stopping partway through being common. Google controls the export tools, so the practical effectiveness of data portability depends on the reliability of these exports. The path to leaving exists, but whether you can complete the journey depends on the exit point.
Returning to the policy itself: there is currently no public evidence that Google has begun using this data for advertising, with both sides arguing between commitments and possibilities. The only verifiable fact is this: private data connected to Personal Intelligence now has “personalized advertising” listed as a permitted use, with no toggle to opt out of it in the policy text. The next person who clicks “connect Gmail” is agreeing to this version of the contract.
References:
- The Verge coverage
- Android Authority coverage
- HN discussion
- Google privacy policy
