Google Reversed Its Gemini Privacy Commitment. Enterprise Data Is Now in Human Review.
What happened
A GitHub repository published in November 2026 documents that Google reversed a 2023 privacy commitment without notifying enterprise customers. Updated Google Help documentation now explicitly states that Gmail, Docs, and Drive content connected to Gemini Workspace extensions may be reviewed by human annotators. Google added a warning advising users not to connect apps containing confidential information. Testing described in the repository found that routine conversation can trigger background lookups of connected Workspace files. Full file access and partial exposure of personal information were observed as possible outcomes. Enterprises that enabled Gemini Workspace extensions based on the original commitment may now be sharing employee communications, business documents, and personal data with Google reviewers. Many have not reassessed that risk.
Why it matters
- ·Organizations operating under the General Data Protection Regulation (GDPR) must have a lawful basis for sharing personal data with third-party processors. Google's 2023 no-human-review commitment may have underpinned the original consent or legitimate-interest assessment. If so, that legal basis may no longer hold. Organizations may need to reassess and potentially notify affected individuals.
- ·This incident exposes a structural gap in vendor monitoring programs: enterprises relied on a vendor's stated commitment as a substitute for a contractual control. When Google changed that commitment through a documentation update rather than a formal notice, most programs had no mechanism to detect it. Any organization with confidential business data, privileged legal communications, or regulated personal data in Workspace is affected.
- ·Regulated sectors face compounded risk. Legal teams connecting matters files, healthcare organizations storing patient-adjacent records, and financial services firms handling client information through Workspace now face potential violations. These include breaches of professional privilege, sector-specific confidentiality rules, and data minimization obligations. Their original vendor assessments did not account for these risks.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- State-linked attackers and criminal operators are actively weaponizing AI tools as entry points into enterprise systems, turning internal platforms and open-source frameworks into live attack vectors.5 Nov
- Three separate incidents this week each created a new compliance action item: verify your AI vendors' data sourcing, demand agent monitoring coverage guarantees, and audit trusted app identities in your cloud environment.29 Oct
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Determine immediately whether Gemini Workspace extensions are enabled for Gmail, Drive, or Docs in your organization, and which employee accounts or departments have connected those apps.
- ☐Review the data classification of content in connected Workspace accounts: flag any accounts holding privileged legal communications, personal data covered by privacy regulations, or confidential business information, and suspend Gemini extension access for those accounts pending a full reassessment.
- ☐Reassess your GDPR or equivalent privacy law analysis for Gemini Workspace: if your original lawful-basis assessment relied on Google's no-human-review commitment, that analysis must be redone and may require updating privacy notices or obtaining fresh consent.
- ☐Ask your legal and compliance team whether any professional privilege, healthcare confidentiality, or financial services secrecy obligations apply to data held in affected Workspace accounts, and document the outcome.
- ☐Update your vendor monitoring process for Google Workspace and other AI-integrated platforms to include periodic review of vendor help documentation and terms, not just formal contract change notices, so future policy reversals are detected without relying on external researchers.
What to watch next
Supervisory authorities under the General Data Protection Regulation (GDPR) have acted quickly on similar undisclosed data-routing changes at other AI platforms. Compliance teams should monitor whether a data protection authority opens a formal inquiry into this change, particularly in the EU or UK where Google's practices already attract regulatory scrutiny. The broader pattern — vendors reversing privacy commitments through documentation updates rather than customer notifications — is likely to draw attention from regulators reviewing AI vendor transparency obligations. Teams should also watch for Google issuing a formal clarification or rollback, which would require a fresh assessment of whether the risk has actually been remediated.