Key Takeaways
- Google’s revised privacy policy, effective October 16, 2026, introduces an “AI exception” that lets connected Gmail and Google Photos data shape advertising when the Gemini-powered Personal Intelligence feature is active, undoing a 2019 commitment.
- Several data pathways remain enabled by default, including Web & App Activity, Gemini in Chrome reading open tabs, Chrome autofill drawing on Gmail, and retention of Gemini API requests for new paid projects.
- Users can break the Gmail/Photos-to-ads link by disabling Personal Intelligence and switching off or auto-deleting Web & App Activity, but AI Overviews cannot be turned off.
- Regulators are moving at different speeds: the UK Information Commissioner’s Office (ICO) secured commitments from 10 AI developers in early October, while the EU Council affirmed that AI training on personal data can be lawful under GDPR with safeguards.
- Competitors such as OpenAI and Anthropic are marketing opt-in or locked-chat designs as privacy differentiators against Google’s default-on model.
Google Ties Gmail and Photos to Ad Targeting Under New AI Exception
Google’s updated privacy policy, effective October 16, 2026, permits connected Gmail and Google Photos data to inform ad targeting whenever its Gemini-powered “Personal Intelligence” feature is enabled, reversing a 2019 pledge and renewing scrutiny of how much personal information flows into the company’s AI systems by default.
The change is not a single switch but a set of interlocking defaults. Personal Intelligence draws on linked apps, Gmail, Photos, Calendar and Drive, to personalize responses in Search’s “AI Mode” and in Gemini. Google began testing ads inside AI Mode for Personal Intelligence users in mid-October 2026, and from October 20, 2026 extended the feature to Android Auto and vehicles with Google built-in.
The Default-On Architecture Behind “Training Its AI”
The most consequential pathway is Web & App Activity, which Google keeps on by default for most accounts. With it active, searches, app usage and location signals are stored and can be used to refine both AI outputs and advertising. Turning it off, or setting it to auto-delete after a defined window, is the single most effective lever a consumer holds.
Personal Intelligence is the connective tissue. When enabled, it lets Gemini and AI Mode pull context from linked apps, which is precisely the mechanism that lets Gmail and Photos content influence ad targeting. Disabling the feature severs that linkage, at the cost of the personalization Google promotes as the feature’s core value.
Other defaults compound the picture. Gemini in Chrome can read open tabs to answer queries, and Chrome autofill pulls address and contact details from Gmail. For developers, Gemini API requests tied to new paid projects are retained by default. Each pathway is individually documented; together they form a broad collection surface that most users never audit.
The practical opt-out path runs through Google Account → Data & privacy. There, users can switch Web & App Activity off or apply an auto-delete limit, and separately disable Personal Intelligence. One limit is non-negotiable: Google has confirmed that AI Overviews cannot be disabled, a point reported by PCMag on October 28, 2026.
Consumer settings also differ from enterprise controls. Workspace administrators manage Gmail’s AI Inbox and Gemini features through separate admin consoles, meaning an organization’s protections do not automatically extend to the same person’s personal account, and vice versa.
The Business Model and Regulatory Patchwork
The policy shift reflects a broader monetization logic: ad-supported AI is becoming the funding model for free assistants. As Search growth slows, personal context becomes the targeting signal that keeps advertising revenue growing. Google is, in effect, converting the inbox into an inventory source.
Regulators are responding unevenly. On October 8, 2026, the UK ICO announced commitments from 10 AI developers on how they handle personal data, and signaled that scrutiny would extend to AI agents. On October 27, 2026, the EU Council affirmed that training AI on personal data can be permissible under GDPR provided safeguards are met, with the bloc’s Digital Omnibus expected to reshape consent rules further. The United States, by contrast, relies largely on disclosure and default settings rather than affirmative consent.
That divergence is creating an opt-out versus opt-in split that increasingly looks like market segmentation. OpenAI has promoted locked and private chats, highlighted in reporting between October 21 and 23, 2026. Anthropic has emphasized an opt-in approach to voice-recording data. Meta delayed its revised AI terms to November 20, 2026 amid pushback, and Discord introduced an opt-out for searchable messages. Each rival is positioning consent architecture as a competitive feature, not merely a compliance obligation.
Industry and Expert Perspectives
The ICO’s October 8 statement framed developer commitments as a baseline, not an endpoint, and explicitly flagged AI agents as the next frontier for review. That signal matters because agentic tools, which act on a user’s behalf across apps, multiply the number of surfaces where personal data can be processed.
Coverage has characterized the change sharply. PPC Land framed the policy as arriving “five years after” Google’s original pledge, while Martin Cid Magazine described it as an “AI exception” carved into the company’s commitments. PPC Land also drew parallels to Meta’s trust problems, arguing that default-on collection erodes user confidence even when it is technically disclosed.
Direct statements from Google’s privacy leadership and from advocacy groups are best drawn from the fuller reporting in Ars Technica (October 23, 2026), The Verge (October 23, 2026) and Forbes (October 26, 2026), where executives and critics set out their positions at length.
The Bottom Line
The “you’re training its AI” framing largely holds. Defaults favor collection across several distinct pathways, and the October 16 policy change formalizes the link between inbox content and advertising. What to watch: regulatory escalation as the ICO extends scrutiny to AI agents and the EU Digital Omnibus rewrites consent rules; whether rivals’ opt-in positioning wins users; and Google’s next earnings for verified user-scale figures. Consumers who want out should act on Web & App Activity and Personal Intelligence now, and accept the loss of personalized AI features that follows.
