Executive Summary
Google disclosed that using personalized AI features in Search or Gemini may allow data from connected services to be used for targeted advertising. Privacy, compliance, security, and AI governance teams should review comparable data-sharing and consent practices.
What Happened
Google has updated its privacy policy to spell out that using personalized artificial intelligence (AI) features in Search or Gemini could allow the company to serve targeted ads to users based on their activity on other connected Google services. "You may choose to allow certain Google services, including services like Search or Gemini Apps, to access data from other Google services you use,
Affected Products
- Gmail
- Google Photos
- Google Search
- Gemini Apps
Vulnerability / Attack Technique
Cross-service AI data access and disclosure
Technical Mechanism
Google's policy describes allowing certain services, including Search or Gemini Apps, to access data from other Google services that a user uses. The summary states that activity associated with personalized AI features could be used to serve targeted ads on other connected Google services.
AI Security Category
LLM02:2025 Sensitive Information Disclosure
Relevant Frameworks
RealGround Analysis
Teams operating AI agents or LLM applications should define strict boundaries for access to connected enterprise data and document whether retrieved information may be reused for advertising or other secondary purposes. Consent, purpose limitation, audit logging, and policy enforcement are necessary to reduce the risk of sensitive information being used beyond the user's expected context.
Recommended Controls
- Apply least-privilege access controls to connected data sources used by AI features.
- Require explicit, granular consent before AI services access data from other connected services.
- Enforce purpose limitation that prevents retrieved data from being reused for advertising or unrelated secondary purposes without authorization.
- Maintain audit logs for cross-service data access, processing, and downstream use.
- Conduct periodic privacy and AI governance assessments covering data flows, retention, consent, and third-party processing.
Related RealGround Service
AI Policy Generator & Support · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/10/google-says-gmail-and-photos-data.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-25.