The change

Google updated its Privacy Policy on October 16, 2026. The new version replaces one that took effect only two weeks earlier, on October 1, and the edits sit in two places: the paragraph on how Google personalizes its services, and the short list of limits on personalized ads.

The second edit changes a limit that used to fit in one plain sentence. “We don’t show you personalized ads based on your content from Drive, Gmail, or Photos” used to end there. It now continues: “unless you choose to make data from these services available to other Google services that support personalized ads.”

What changed

• The exception. The sentence about Drive, Gmail, and Photos now reads in full: “We don’t show you personalized ads based on your content from Drive, Gmail, or Google Photos, unless you choose to make data from these services available to other Google services that support personalized ads.”

• Cross-service access. A new paragraph says: “You may choose to allow certain Google services, including services like Search or Gemini Apps, to access data from other Google services you use, such as Google Photos and Workspace apps like Gmail and Drive.” It adds that Search may process the data you let it access to personalize content, “including ads.”

• What ads can be based on. Personalized ads used to be described as based on your “interests and activity across Google services.” They are now based on your “interests, activity, or personalized content from Google services.”

Two weeks earlier, the sentence had no exception

When we covered Google’s October 1 update, which said personalized ads may continue after you reject cookies, the line about Drive, Gmail, and Photos was on our list of things that had not changed. It had no conditions then. Fifteen days later it has one.

The limits around it stayed the same. Google still says it does not show personalized ads based on sensitive categories, “such as race, religion, sexual orientation, or health,” and that it does not share information that personally identifies you with advertisers, such as your name or email, unless you ask it to.

What making your data available means in practice

The policy does not name a setting. Google’s help page on connecting Google content apps to Search describes one. Through a feature called Personal Intelligence, you can connect “Workspace (currently Gmail and Google Calendar, with other Workspace apps coming soon) and Google Photos,” so that AI Mode and Ask Maps can answer using your own email, calendar, and photos. You have to be signed into a personal Google Account, and you have to connect the apps yourself.

The same page answers the ads question. “Ads will not be based directly on your Gmail inbox or your Google Photos library,” it says. Then it adds: “If you connect your content apps to Search Services, Search may reference summaries, excerpts and inferences from these sources to personalize your experience and do things for you. That same info may be used to show you ads, so they are even more helpful for you.”

Connecting is also wider than one feature. According to the help page, it “means that all Search services will be permitted to access Workspace (currently Gmail and Google Calendar) and Google Photos.” Those services include Search, Maps, Shopping, Flights, Hotels, Translate, and News.

Ads were not part of the feature at first

Google brought Personal Intelligence to AI Mode in January 2026, as TechCrunch reported. In March, Google said there were “currently no ads for people who choose to connect their apps.” In October, it said it was “starting to test ads in AI Mode in Search for users who connect their apps,” according to Search Engine Roundtable, which reported both statements.

The Privacy Policy edit came the same month. The ads test is described in a statement to the press, and the exception is now in the policy that governs your account.

Disconnecting does not undo what was used

At the time of publication, the help page makes two more points about data from connected apps. The first: “If you choose to connect Google content apps to Search services, we may use that data to improve Google services for everyone, including by training generative AI models.” The second: “Disconnecting a connected Google content app or deleting any data in that app doesn’t delete any data from your Search Services History. That data can still be used for product improvement, including training generative AI models.” To remove it, the page points to Search Services History.

Training language has been spreading through vendor documents this year, as when Amazon’s privacy notice began naming generative AI and when Apple’s promise not to train AI on your data gained an exception.

What did not change

• Google still says it does not show personalized ads based on sensitive categories such as race, religion, sexual orientation, or health.

• Google still says it does not share information that personally identifies you with advertisers unless you ask it to.

• My Ad Center is still where the policy says you control what information is used to show you ads.

• Connecting Gmail and Photos is optional, and the help page says you can still use AI Mode and Ask Maps without it.

• Apart from the effective date and two small wording edits, the rest of the policy matches the October 1 version.

Why this matters

Until October 16, the policy gave a short answer to whether Gmail, Drive, and Photos content shapes Google’s ads, and the answer was no. It is now “not unless you connect them,” and the help page adds that inferences from a connected inbox may be used for ads.

For a SaaS company, the reach is through people. Personal Intelligence requires a personal Google Account, and personal accounts often hold work traffic: sign-ups for vendor tools, receipts, calendar invites, and forwarded threads. If someone connects that Gmail to Search, whatever sits in the inbox becomes material Search can summarize, draw inferences from, and, per Google’s help page, use for ads. Ad wording has been moving on other vendor pages too, for example when OpenAI widened what it does with data from advertisers.

Potential impact

For a company whose people use Google, the update raises five practical questions:

• Do people on your team use personal Google Accounts that hold work email, calendar invites, or vendor correspondence?

• Has anyone connected Gmail or Google Photos to Google Search on a device used for work?

• Does your AI or acceptable use policy say anything about connecting personal mail to AI assistants?

• If someone disconnects, do they know that Search Services History has to be deleted separately?

• Who in your company would notice the next one-clause change in a policy this long?

How Venpo detected it

Venpo monitors Google’s privacy pages as part of continuous vendor risk monitoring. It flagged the new paragraph on cross-service access, the exception added to the Drive, Gmail, and Photos sentence, and the new wording on what ads can be based on. Every quote from the policy in this article was checked against the redline and the live page. The redline is on the change page for YouTube, which is covered by the same policy.

Business outcome

Teams that track Google saw the exact sentence that gained an exception, next to the version without it, along with the new paragraph that explains where the exception comes from. That is enough to update internal guidance on AI assistants and personal accounts, and to tell people where the setting is. Without the redline, the visible sign on the page was a date that moved by fifteen days, which is the kind of change continuous monitoring of vendor legal changes exists to catch.

Key takeaway

Google’s Privacy Policy no longer says flatly that Gmail, Drive, and Photos content stays out of personalized ads. It now says so only until you connect those apps to Google services that support ads, and the way to catch a one-clause change like this is to monitor vendor terms and policies as a routine.