What happened
Google updated its privacy policy on 16 October to state that using personalised AI features in Search or Gemini can allow the company to serve targeted ads based on activity in other connected Google services. Android Authority reported the change first.
The policy says a user may allow certain Google services, including Search or Gemini, to access data from other services such as Google Photos and Workspace apps like Gmail and Drive. It then gives the example that matters: Search may process some of the data it is allowed to access to personalise content, including ads.
The default has not changed. Google states that it does not show personalised ads based on content from Drive, Gmail or Google Photos unless the user makes that data available to services that support personalised ads. What changed is the consequence of switching on Personal Intelligence, the Gemini feature launched in January that connects Gmail, Photos and YouTube to tailor answers. It is rolling out as a beta to users over 18 globally, except in the European Economic Area, Switzerland, the United Kingdom and Nigeria.
Opting out means disconnecting apps from Personal Intelligence or turning off Personalised Recommendations in Search settings. In the same week, OpenAI said it had expanded advertising in ChatGPT to 26 more countries, 89 in total.
Why this is a GRC story
Purpose limitation is the test, not consent language. One toggle was sold as a way to get better answers. It now also feeds advertising. If the toggle text did not change, the notice did, and the notice is what a privacy programme tracks.
The exclusion list is a map. A feature absent from the EEA, the UK, Switzerland and Nigeria is one whose legal analysis had not cleared those markets. That analysis is the most useful document here, and it is not public.
Enterprise exposure sits with the accounts. Workspace terms are not the consumer policy. The realistic risk is a feature enabled on an account governed by consumer terms, or an employee connecting a personal Gmail account to answer work questions. Know which policy covers which account before answering the questionnaire.
Vendor assurance decays. A privacy policy with an effective date is a change event. If the third-party register has no field for that date, last quarter's answers are quietly wrong and nobody gets an alert.
Advertising from email content stays contested. The sentence carrying the most weight is the qualifier about choosing to make data available. Whether a settings screen counts as a choice is the argument regulators have run for a decade.
What to watch
Whether regulators in the excluded markets ask why the feature is not offered there, and whether Google publishes an assessment to support the wording. Watch the toggle labels too, since a clearer label is often the cheapest fix.
For a GRC team the work is unglamorous: inventory the AI features staff have switched on, decide a position on personal accounts used for work, and record the 16 October effective date in the vendor file so the next assurance cycle starts from the current text.
Attribution: Analysis based on The Hacker News and related public reporting. This article is original commentary, not a repost of the source material.