Gmail and Photos for advertising: Google changes the rules

A hotel confirmation is what you need to travel. A family album is what you need to remember. Neither starts life as advertising material. And yet the line between an assistant that knows you and a system that chooses what to sell you is getting thinner.

In Google's privacy policy in effect from 16 October 2026 an exception appears: content from Gmail, Drive and Google Photos remains excluded from ad personalization unless you choose to make its data available to other Google services that support personalized ads. The choice to connect services is therefore decisive.

And in Ticino? As of our check on 26 October, Google's guide to connecting apps to Search does not list Switzerland among the countries where it's available. This change in the rules doesn't show that the feature is already active on your Swiss account.

The promise now comes with an exception

In the 1 October version, Google ruled out using content from those three services for personalized ads. The official comparison with the 16 October version shows the added condition about connecting to other services.

This change deserves attention precisely because it arrives through something desirable: a more personal experience. Asking an assistant to dig up a booking is convenient. Understanding that the same connection can also serve a commercial purpose takes a much more careful reading.

For us, the privacy question starts here: how visible is this consequence at the moment you press the button to connect your data? A permission can be formally there and still leave the user with a very partial understanding of the exchange.

What can reach advertising

Google's guide explains that Search can use summaries, excerpts and inferences drawn from connected apps to personalize ads as well. Advertisers don't get access to your Gmail inbox or your Photos library. The policy also keeps sensitive categories such as health, religion and sexual orientation excluded from personalized advertising.

The commercial value of a piece of information, though, can exist without handing the original document to anyone. Picture an assistant that works out from a booking that you're planning a holiday. If that knowledge feeds into the choice of an ad, your private sphere has already taken on a commercial function. It's an example of the mechanism, not proof of what happens to any particular account.

For the people using the service, the distinction that matters is purpose. You wanted to find a piece of information. Are you also willing to let it shape the advertising you'll see? Those are two decisions, and each deserves its own clear explanation.

Even summaries can be very personal

The same guide describes using material derived from connected apps to train models, and human review of part of the processed data. For a short email, the summary can be the email itself. Google lists measures to reduce personal information before these uses and advises against connecting confidential content you wouldn't want put through that kind of processing.

Advertising, training and human review serve different purposes. The fact that all three appear in the documentation makes it even more important to understand what a connection involves. The word "summary", on its own, says little about how intimate the information inside it is.

From the people who design these tools we expect a readable explanation before activation: what data is consulted, for what purposes, and what choices are available. The convenience of AI is real. So is the power to reconstruct habits and preferences. The price of that convenience should be as visible as the benefit.

Three useful checks before you connect everything

1. Look at the apps connected to Search. Where the feature is available, check which connections you've authorized. The guide points out that this applies to personal accounts and that disconnecting an app doesn't delete data already in your search services history: that has to be managed separately. Availability and screens may change.
2. Check ad personalization. In My Ad Center you can turn it off. According to the official guide, you'll still see ads based on general factors, such as the content of the page. This setting is about ads; it isn't the same as revoking every connection between apps.
3. Keep personal and work use apart. The Workspace documentation keeps specific commitments on data, including not using Workspace content for ad targeting. It also warns that data shared from a personal account with Gemini Apps or Search is handled under the rules of the receiving services. What matters is which product you're using and where you're sending the data.

Your company's privacy also runs through integrations

A small business's mailbox can hold quotes, invoices, customer requests and staff documents side by side. Before connecting it to an assistant, it's worth defining which information the assistant actually needs and which must stay out. The same goes for a chatbot on your website, a business management system or an automation that reads documents.

At Webcracy we can help you map out these steps and design AI integrations with targeted access and documented choices. We start from your tools and the tasks you want to simplify, to work out which data is worth sharing and with whom.

Let's talk about your company's data↗

The question to take with you to the next "Connect" button is a simple one: am I authorizing only the service I need, or other uses of my information too? The answer should be clear before the click.

Original Webcracy illustration. Official texts and availability checked on 26 October 2026.