Picture the scene. You ask Gemini to find the flight details buried somewhere in your inbox, and within seconds it pulls the right email, summarises it, and hands you the answer. It feels like magic. It also feels private.
Now imagine a stranger sitting in a review centre somewhere, reading that same email. Not because you sent it to them. Not because you gave permission in any meaningful sense. Simply because you left a default setting switched on.
That is the reality Google Gemini privacy now lives in, according to reports this week. A promise Google made in 2023, that your Gmail and Drive content would never be seen by human reviewers, has been quietly rewritten. The new wording says the opposite.
What Google promised in 2023
In September 2023, Google first let its chatbot read your inbox. The feature, called Connected Apps, let Gemini pull information from Gmail, Docs and Drive so it could answer questions about your own life.
To win people over, Google made a clear promise. Content from Gmail, Docs and Drive, it said, “is not seen by human reviewers” and is not used to train the model. That sentence is still on Google’s blog today.
But right after it now sits a note dated October 16, 2026. For newer features, the note says, the same data “can be used to train generative AI models” and “can also be subject to human review in limited circumstances.”
There was no press release. There was no email to users. The change arrived as a rewritten paragraph in a help article, and most people only found out because someone else went digging.
How the Google Gemini privacy change was discovered
The discovery came from an anonymous write-up published as a GitHub project, documenting what its author called Gemini’s file-leaking behaviour. Last week it reached the top of Hacker News with 366 upvotes, and the story spread from there.
The author’s evidence was Google’s own wording. The Gemini Apps Privacy Hub now reads: “a subset of Connected Apps data processed by Gemini is reviewed by human reviewers, including service providers.”
Service providers means outside contractors. These are trained reviewers who grade Gemini’s answers and write better ones, working for third-party companies across global review centres.
None of this is entirely brand new. As ByteIota reported, the same human review language has sat on the help page since Personal Intelligence launched in January. The October 16 note mostly brings the old blog post in line with it.
But that is exactly the problem. The promise stayed on the blog for three years while the practice quietly moved in the other direction. Users who connected their email in 2023, trusting the original pledge, were never told it had changed.
What human reviewers can actually see
So what exactly reaches a reviewer’s screen? According to Google’s Connected Apps help page, reviewers see the summaries, excerpts and inferences Gemini draws from your emails and files.
Google says it does not train “directly” on your inbox or Drive. But it does train on those excerpts. And there is a catch in the fine print that changes everything.
When an email or file is short, or especially relevant to the question, “the summary may just be the email or file.” In other words, the reviewer can end up reading the full text, unredacted.
Google says it strips the account link and reduces personal details before contractors see anything, unless it is dealing with abuse or harm.
Send feedback on an answer, though, and reviewers “may also review some of your Gmail inbox or Photos library media.” The help page ends with a blunt warning of its own: do not connect apps that hold confidential information you would not want a reviewer to see.
The background access problem
The access is not limited to moments when you explicitly ask Gemini to look at your Drive. According to reporting from AI Weekly, ingestion happens “autonomously in background conversation without explicit @Drive or @Gmail tags.”
You do not have to @-mention a file for it to be pulled into context. Mention a trip, a bill, a name or a reservation in passing, and Gemini can quietly reach into your connected apps to fill in the gaps.
The capture is also probabilistic. Identical queries can produce different results across sessions, which means there is no reliable way to audit what triggered a file retrieval.
Why deleting your history does not help
Once a conversation has been reviewed, it stays. Gemini’s privacy hub says reviewed data is kept for up to three years, disconnected from your account.
Deleting your Gemini activity will not remove anything that trained reviewers have already seen. The help page says so plainly. The data survives even after you delete your history, with no clear erasure pathway.
That three-year retention is the detail that turns a settings quirk into something bigger. A spreadsheet with financial figures, a medical record, an email with credentials — once sampled, it sits in an annotation repository, detached from your name but not from its contents.
Work accounts are different, personal accounts are not
There is one important exception. Work and school accounts play by different rules. Google’s Workspace privacy hub says business and education content “is not human reviewed or otherwise used for Generative AI model training outside your domain without permission.”
The contractor clause is for everyone else: people using Gemini on the personal Google accounts where their private email actually lives. Enterprise protections are real, but they only cover content accessed through the company Workspace account.
Here is where it gets messy. Verizon’s 2026 Data Breach Investigations Report found that 67% of users access AI on corporate devices through personal, non-corporate accounts. A personal Gmail tab open on a work laptop bypasses every enterprise control entirely.
Google’s admin tools only govern the managed company account. The personal Gmail session next to it is fully exposed to consumer review terms, and IT has no visibility into it.
How to protect your Gemini privacy
The fix is straightforward, even if the tradeoff is not. To opt out, disconnect Connected Apps in Gemini. Open the app, tap your profile picture, go to Personal Intelligence, and disconnect Gmail, Drive and the other apps. On desktop, the same controls sit under Settings.
You can also turn off Gemini Apps Activity entirely. That stops Google from saving future prompts to your account, stops human reviewers from reading your new chats, and keeps your data out of model training.
Neither option is clean. Disconnecting the apps means losing Gemini’s personalised features and contextual memory. Turning off activity logging means the assistant forgets everything between sessions.
Google has, in effect, designed a system where full privacy requires giving up the core functionality. That is a choice users should have been told they were making, back in 2023, before they connected anything.
Why this Google Gemini privacy row matters
This story matters for reasons that go beyond one settings page. It is about whether a privacy promise made in a blog post is worth anything when the company can rewrite it silently three years later.
Google is not the only company walking this line. The same week also saw Anthropic launch Claude Fable 5.2, a reminder of how fast these systems are advancing while the rules around them stay murky.
The industry is already debating how much access AI agents should have to private data, and who watches the watchers.
The Fireworks AI breach showed what happens when that data escapes. The OpenAI Control Room showed companies building kill switches for their own models.
But the Gemini case is different. Nothing was hacked. Nothing leaked. The system worked exactly as designed, and the design changed without telling the people whose data flows through it.
Because the promise from 2023 is gone. What replaced it is a warning: do not connect anything you would not want a reviewer to see. And the only person who can enforce that boundary now is you.
