On October 16, 2026, Google removed one sentence from its privacy policy — the one that promised it would never use the contents of Gmail, Drive or Photos to personalize the ads you see. Spotted by Android Authority on October 23 and confirmed by Google to Ars Technica and other outlets, the change quietly dismantles a firewall that has stood for years between the company's most sensitive user data and its advertising machine. The bridge across that firewall is Personal Intelligence, the opt-in feature Google released in early 2026 that lets its AI products read context from your connected apps.
This article explains exactly what changed, what Google says it is and is not doing, why the "not based directly on" distinction matters less than it sounds, and how to turn the whole thing off in about two minutes. If you run a business, there is also a trust angle here that deserves your attention: the same policy shift that worries your customers is reshaping how advertising on the AI web will work.
What the policy said before — and what it says now
The change is small and surgical, which is precisely why it deserves attention. The ad personalization section of Google's privacy policy previously contained a clear, categorical limit:
"We don't show you personalized ads based on your content from Drive, Gmail, or Photos."
That sentence is gone. In its place, Google introduced updated language describing when your sensitive data might inform ads — language that opens the door to Gmail, Drive and Photos content influencing advertising whenever that data has been shared with other Google services. And as of early 2026, Google has a ready-made mechanism for exactly that kind of sharing: Personal Intelligence.
| What | Before October 16 | After October 16 |
|---|---|---|
| Drive, Gmail, Photos content | Explicitly excluded from ad personalization | No longer explicitly excluded |
| Data shared via Personal Intelligence | Not addressed as an ads path | Can inform summaries and insights — the same data shaping AI search |
| Google's framing | A hard no | Ads "not based directly" on inbox or library |
| Sensitive categories | Protected | Still excluded from ad tailoring |
The distinction Google is drawing is real but narrow: ads will not be targeted "directly" on your inbox contents, but the same data flows that power your AI search experience can now overlap with the signals that decide which ads you see.
How Personal Intelligence connects your inbox to the ad auction
Personal Intelligence, released in early 2026, lets users connect apps like Gmail, Drive and Photos to Google's AI products — the Gemini app and AI Mode in Search. The pitch is better answers: an AI that can see your flight confirmations, your receipts and your photos can respond to "did my order arrive?" without you digging through email.
The consequence, as Ars Technica's Ryan Whitwam laid out on October 23, is that when you interact with AI Mode while Personal Intelligence is enabled, summaries and insights drawn from your personal data inform the answers you receive — and the ads shown in that session draw on the same underlying signals. Google's experiment with ads inside AI Mode, which we covered when it began testing, is the commercial layer this data now feeds.
Google's full statement to Ars Technica reads:
"Connecting your apps is entirely opt-in. Ads will continue to be relevant to things like your query, the context of the response and your interests. Ads will not be based directly on your Gmail inbox or Photos library, and as always, sensitive information will not be used to tailor ads."
Read that carefully. "Entirely opt-in" is accurate on paper. "Not based directly on" is the load-bearing phrase: it confirms that your personal data can be an element of ad targeting without being the explicit trigger. For a company whose entire business is finding indirect signal in data, indirect is not a small caveat.
What Google says it is not doing
To be fair to Google, the company pushed back on the scariest readings of the change, and the pushback contains useful specifics:
- No inbox scanning to build an ad profile. A spokesperson told Ars Technica the update does not indicate a change in how data is handled with advertising partners — Google is not systematically scanning your entire inbox to enrich your advertising profile.
- No data to third parties. Google says none of this personal data is passed to outside advertisers.
- Sensitive categories still excluded. Health, finance and other sensitive classes remain walled off from ad tailoring, as before.
That is meaningful. The realistic picture is narrower than "Google reads your email for ads": it is "if you connect your apps, inferences drawn from your email and photos can sit beside you in an AI search session that also contains ads." Not the same thing — but a genuine reversal of a long-standing promise, executed in an edit few users would ever see.
The opt-in that behaves like an opt-out you forgot about
Google is technically correct that Personal Intelligence is optional. In practice, the feature is promoted through repeated prompts and pop-ups that emphasize the benefits — better, more personal AI answers — without walking users through the downstream advertising implications. Millions of people likely enabled it without realizing what it enabled.
If you want to ensure ads never draw on your personal data this way, the reliable path is to disconnect the apps at the source:
- Open Gemini settings and find the Personal Intelligence section, or go to your main Google account settings.
- Navigate to Data & privacy > Personalization settings > Manage Personalized Recommendations in Search Services > Connected Content Apps.
- Disable the connections to Workspace apps and Google Photos.
- Do the same check on every Google account you use, including work accounts where you are the administrator.
Why this matters for businesses, not just for privacy buffs
If you advertise, this change is quietly a capability expansion: ads in AI experiences gain access to richer personal context, which should over time improve relevance and conversion for well-targeted campaigns. Nothing about your campaign settings changes today. But the long-run direction is clear — advertising inside AI search becomes more personal because the underlying data became more personal. The performance gains will be real, and so will the trust cost.
If you run a business that handles customer data, your angle is different. Your customers are reading these headlines, and the practical questions land on you: "Where does my data go? Who sees it? Can I opt out?" A business that can answer those questions crisply — in plain language, before being asked — earns a trust advantage the big platforms are currently spending down. Our piece on the familiar source effect showed how much trust transfers to the brand that shows up with a recognizable, credible name; being transparently careful with customer data is part of earning that recognition.
There is also a historical pattern worth naming. Google already runs a similar carve-out with AI training data: interactions you have with Gemini can shape model improvements as long as personal content is successfully filtered out — and Google has said it tries to filter, without promising it always succeeds. The privacy policy now carries the same architecture for advertising: a filter-based promise instead of a structural guarantee. Filters drift; structure holds.
Conclusion
Google's October 16 privacy policy edit removed a categorical promise and replaced it with a conditional one: your Gmail, Drive and Photos content still won't target ads "directly," but when you opt into Personal Intelligence, the inferences drawn from that data now sit inside the same AI search sessions where ads appear. The practical takeaways are simple. If you don't want it, disconnect the apps in your Personalization settings — and know that the prompts pushing you to connect will keep coming. If you advertise, watch this space, because AI search ads get more personal from here. And if you run a business that handles other people's data, treat this as a reminder: the trust customers stop granting to platforms increasingly flows to businesses that are plainly careful with it. If you want help building that trust into your own site, content and processes, our team at Vivid can help — contact us.
