Google lets connected Gmail and Photos data shape ads, 5 years after pledge – PPC Land

Policy dated October 16 adds an exception to a July 2021 promise for users linking apps to Search or Gemini. Advertisers get no inbox access. What else changed?
Google’s privacy policy now says it may personalize ads using data from Gmail, Drive and Google Photos for people who allow Search or Gemini Apps to read those services – an exception written into a promise the company had kept in identical wording since July 1, 2021. The revised policy carries an effective date of October 16, 2026, fifteen days after the previous version, and The Verge today reported that the change ties the company’s ad systems to Personal Intelligence, the opt-in feature that lets AI Mode and other Google tools draw on a user’s own emails, photos and files.
A line-by-line comparison of the October 16 text against the 54 earlier versions in Google’s privacy policy archive, which runs back to June 9, 1999, shows that the new wording rewrites three sentences in the policy’s advertising section and adds a new explanatory note. None of the earlier versions contained an equivalent carve-out.
Google used to promise, in its privacy policy, that it would never pick ads for people based on what was inside their Gmail, Drive or Google Photos. Since October 16, that promise has a condition attached: if a person lets Google Search or Gemini read those services to give more personal answers, the information Search draws from them can also be used to choose ads. Advertisers still do not get to see anyone’s emails or photos, but the ads people see can now be shaped by summaries and guesses drawn from that private content.
The advertising language sits in the section of the policy titled “Provide personalized services, including content and ads.” According to the redline comparison Google publishes between the October 1 and October 16 versions, four passages in that section changed.
The first is an entirely new sentence. “You may choose to allow certain Google services, including services like Search or Gemini Apps, to access data from other Google services you use, such as Google Photos and Workspace apps like Gmail and Drive, in order to provide you with a more personalized experience, subject to the policies and settings of the accessing service,” the policy now reads. It is followed directly by a second addition: “For example, Search may process some of the data that you allow Search to access to personalize content, including ads.”
The second change concerns the general description of personalized advertising. The October 1 text said: “Depending on your settings, we may also show you personalized ads based on your interests and activity across Google services.” On October 16 the end of that sentence became “interests, activity, or personalized content from Google services.” The word “or” matters here. Personalized content – the output of features that read a user’s own data – now stands as a third, separate basis on which ads can be personalized, alongside interests and activity.
The third edit is small but telling. The policy’s long-standing example, in which a search for “mountain bikes” leads to ads for sports equipment on YouTube, now specifies that the search happens “in Search.” The phrase narrows the example to one product at the moment the policy begins describing data flows between products.
The fourth change is the one that carries the most weight. Since July 2021, a bullet in the same section had read: “We don’t show you personalized ads based on your content from Drive, Gmail, or Photos.” The October 16 version keeps that sentence but replaces its final word and full stop. The bullet now reads: “We don’t show you personalized ads based on your content from Drive, Gmail, or Google Photos, unless you choose to make data from these services available to other Google services that support personalized ads.”
Google also added an entry titled “personalize content” to the policy’s Additional Context section, which holds explanatory notes linked from the main text. The new entry is linked from the words “personalize content” in the sentence about Search processing data “to personalize content, including ads.”
“If you choose to allow certain services to process data from other services, including for features such as Personal Intelligence, the same data may be used to personalize your experience,” the note reads. “For example, if you ask Search a question about a recent hotel booking, Search may use information about booking details from an email to help suggest things to do near your hotel.”
The note does not mention ads. The hotel example describes a search result, not an advertisement. Read together with the body text, however, the structure is clear: the note names Personal Intelligence, and the sentence it is attached to says the data Search accesses may be used for content “including ads.”
Two of the advertising section’s protections are untouched. “We don’t show you personalized ads based on sensitive categories, such as race, religion, sexual orientation, or health,” the policy still says, a sentence that was already present in the September 30, 2020 version. The bullet stating “We don’t share information that personally identifies you with advertisers,” with its example of a “tap to call” ad for a flower shop, is also unchanged.
The remaining edits in the October 16 redline are housekeeping. “Photos and Drive” became “Google Photos and Drive” in the section on managing information, and two “Learn more” links were deleted from the Additional Context entries “deliver our services” and “show trends.”
The archive shows that the ad language Google modified on October 16 was assembled over eight years, in identifiable steps.
The December 18, 2017 version described a broader practice. “Our automated systems analyze your content (including emails),” it said, to provide features that included “tailored advertising.” The May 25, 2018 rewrite, which took effect on the day the GDPR began to apply, dropped that phrasing. The new policy said: “Depending on your settings, we may also show you personalized ads based on your interests.” It did not mention Gmail, Drive or Photos in the advertising discussion at all. The same was true of the September 30, 2020 version, which already contained the sensitive categories bullet but nothing on content from those three services.
The explicit pledge arrived with the July 1, 2021 version. Google’s redline comparison between February 4 and July 1, 2021 marks “We don’t show you personalized ads based on your content from Drive, Gmail, or Photos” as an addition, and it is the only ad-related insertion in that revision. The February 10, 2022 and December 15, 2022 versions carried the sentence unchanged, as did every version afterward through October 1, 2026 – 17 versions in all, counting July 2021.
The general description of ad personalization changed once in that period. The March 4, 2024 version added “and activity across Google services” to the sentence that previously ended at “your interests,” part of a revision that also replaced “combine” with “use” in describing how information is used across services. That sentence held until October 16, when “activity across Google services” gave way to “activity, or personalized content from Google services.”
October 16 was the fourth revision of the policy in 2026, and the earlier three set the stage. The April 2, 2026 version replaced references to “Google Analytics” with the broader “ad and analytics services” in the measurement section and changed how health information subject to US state laws is handled.
The May 26, 2026 version reorganized the policy’s privacy controls under a new heading, “Personalization and Activity Controls.” It introduced references to Search Services History and to a setting called Personalized Recommendations in Search services, and added language about the ability to “resume an AI Mode interaction where you left off” and to receive “AI responses that are personalized to you based on info in your Google Account.” The redline for that version, according to its markup, did not touch the ad disclosures.
The October 1, 2026 version made a single substantive edit: the phrase “activity across devices” replaced “activity” in a passage explaining whether to show users “more relevant search results or ads.” Fifteen days later, the ad exception followed.
According to The Verge, Google may use data from Gmail, Drive and Google Photos to personalize ads for users who have connected those services to AI Mode or other search tools through Personal Intelligence. The policy text supports that reading: the October 16 bullet makes the Drive, Gmail and Photos exclusion conditional on the user not making that data “available to other Google services that support personalized ads,” and the new sentence names Search as one service that may process accessed data “to personalize content, including ads.”
The policy is broader than Search in one respect. Its new permission sentence names “Search or Gemini Apps” as services that may be allowed to access data from other Google services. Only Search, however, is described as processing that data for ads. In January 2026, Google VP Dan Taylor said that there are no ads in the Gemini app and no current plans to change that. The October 16 policy text contains no statement about ads in Gemini Apps.
Google’s Search help page on connecting content apps, which explains Personal Intelligence in Search, goes further than the policy on how the data reaches ads. “Ads will not be based directly on your Gmail inbox or your Google Photos library,” the page says. It describes Search as working from derived material instead: Search services use “summaries, excerpts, generated media, and inferences from your relevant media, emails, and files,” and, according to the page, “That same info may be used to show you ads, so they are even more helpful for you.”
The distinction between “directly” and “summaries, excerpts and inferences” has limits that the page itself acknowledges. “In some cases, for example, where the email or file is brief or particularly relevant to respond to the inquiry, the summary may just be the email or file,” the help page states, in a passage about model training.
On advertisers, the help page says that if a user connects content apps to Search services, “advertisers will not have access to your Gmail inbox or Google Photos.” It repeats the policy’s sensitive categories commitment: “As always, Google doesn’t show you personalized ads based on sensitive categories, such as race, religion, sexual orientation, or health.”
The help page sets several technical limits that the policy does not spell out. Connecting content apps is available to users 18 and above signed into a personal Google Account. The apps that can currently be connected are “Google Workspace (currently Gmail and Google Calendar)” and Google Photos, with the note that connecting to Google Photos “isn’t available in all regions.” That list differs from the policy, which names Drive alongside Gmail and Google Photos.
Connecting is not limited to one product. “Connecting your Google content apps means that all Search services will be permitted to access Workspace” data, according to the page, which defines Search services as “Google Search (incl. AI Mode, Discover), Maps (incl. Ask Maps), Shopping.” A single opt-in therefore covers AI Mode, Discover, Maps and Shopping.
On training, the page says “Search services do not train generative AI models directly on your Gmail inbox,” but that “we train our generative AI models off of these summaries, excerpts, generated media, and inferences.” On review, it says that “a subset of that data processed by AI Mode in Search and Ask Maps in Google Maps is reviewed by human reviewers,” and it asks users not to connect content apps “if they contain personal or confidential information.”
Disconnecting does not erase what has already been collected. “Disconnecting a connected Google content app or deleting any data in that app doesn’t delete any data” already held by Search services, according to the page, and “That data can still be used for product improvement, including training generative AI models.”
The policy change did not arrive in isolation. Google confirmed around October 16 that it had started testing ads in AI Mode for users who connect apps through Personal Intelligence, a shift PPC Land covered in its October 20 report on Safari 27 and search traffic. In March 2026, Google had said that AI Mode with Personal Intelligence switched on carried no ads, while indicating that ads would eventually work similarly for those users.
Personal Intelligence itself is less than a year old. Google launched it in beta on January 14, 2026 for AI Pro and AI Ultra subscribers in the US, connecting Gmail, Google Photos, YouTube and Search history to Gemini. At I/O on May 19, 2026, Google announced an expansion of Personal Intelligence to nearly 200 countries. In an April interview, Google’s Nick Fox described Personal Intelligence as opt-in and said not all users enable it – a position he considered correct. That interview did not settle whether the feature would feed ad targeting, which PPC Land at the time treated as an open question.
Ads in AI Mode have been expanding on a separate track. Google announced Shopping ads in AI Mode on February 11, 2026, when the surface had more than 75 million daily active users, and in June it began a small US test allowing healthcare advertisers into AI Mode and AI Overviews.
For advertisers, the change opens a signal that Google’s ad systems had formally excluded for five years. A user who asks AI Mode about a hotel booking found in a confirmation email generates intent that no keyword auction would have captured from the query text alone. Under the October 16 policy, the same inference that produces the organic answer can, for users who opted in, inform which ads appear. Nothing in the policy or the help page describes new targeting controls, audience segments or reporting for advertisers tied to this data, and the help page states that advertisers receive no access to the underlying inbox or photo library. The value, if any, would arrive through Google’s own ad selection, not through a buyable segment.
That makes measurement difficult. Advertisers cannot see whether an ad shown in AI Mode was selected partly on the basis of a connected-app inference, and Google has published no figures on how many users have connected apps. The policy gives no breakdown either.
For privacy, the wording raises questions that the policy text alone does not answer. The 2021 bullet was categorical; the 2026 version makes it depend on a user’s settings in another product – the policy says access is “subject to the policies and settings of the accessing service.” The help page’s line that ads will not be based “directly” on Gmail or Photos rests on the difference between raw content and summaries or inferences of it, and the same page says a summary can be the whole email. For opted-in users, the October 16 change moves inferences from private communications into ad personalization.
The policy also leaves the existing opt-out structure intact but separate. Personalized ads remain governed by My Ad Center, a tool Google said in January 2024 had grown to more than 60 million daily active users. Connecting apps to Search is a different setting. A user who connects apps for better answers and leaves ad personalization on falls inside the new exception; the policy does not describe any separate consent for the ad use.
Trust in how Google handles inbox data has been contested before. In November 2025, Gmail publicly denied changing anyone’s AI data settings after a viral claim that users had been opted in to AI access of their messages. The October 16 change differs from that episode in one central respect: it is written into the policy, and it is opt-in by the policy’s own description.
The sensitive categories protection remains the outer limit. Inferences drawn from a hotel booking can inform travel ads; the policy says inferences about health, religion, race or sexual orientation cannot be used for personalized ads, connected apps or not. How Google separates a connected email about a medical appointment from one about a flight – both of which AI Mode may summarize – is not described in the policy or the help page.
Who: Google, which revised its privacy policy, and users who connect Gmail, Drive, Google Photos or Calendar to Search or Gemini Apps through Personal Intelligence. Advertisers on Google’s network are affected indirectly. The Verge reported on the change.
What: The October 16, 2026 policy makes Google’s July 2021 statement that it does not personalize ads based on Drive, Gmail or Photos content conditional, adding “unless you choose to make data from these services available to other Google services that support personalized ads.” It also says Search may process accessed data “to personalize content, including ads,” and adds personalized content as a basis for ad personalization. Google’s help page says ads will not be based “directly” on inboxes or photo libraries but may use summaries, excerpts and inferences from them.
When: The policy took effect October 16, 2026, fifteen days after the October 1 version. The pledge it modifies was added on July 1, 2021. The Verge reported on the change today, October 23, 2026.
Where: Google’s global privacy policy, with the ad use described for Search services, which Google defines as Search including AI Mode and Discover, Maps including Ask Maps, and Shopping.
Why: The change aligns the policy with Google’s test of ads in AI Mode for users with Personal Intelligence switched on, which Google confirmed around October 16 after saying in March that those users saw no ads. It matters because it brings inferences from private emails and photos into ad selection for opted-in users, while advertisers get no direct access and no new controls to see when that signal was used.
Every morning, get a curated digest of the last 24 hours in programmatic advertising

source