Google’s Gmail and Photos Data Can Now Feed Ads, and the Old Pledge Is Gone

Google’s privacy policy changed on Oct. 16, and the change matters more than the quiet rollout suggests. According to Decrypt, the update carves out an exception to a long-standing Google pledge, allowing data from connected Gmail, Drive, and Photos accounts to personalize ads through the company’s Personal Intelligence AI features.

What Actually Changed

The substance is straightforward. Google had previously committed not to use content from connected Gmail, Drive, and Photos accounts for advertising purposes. The policy revision effective Oct. 16 removes that barrier for Personal Intelligence, the AI layer that draws on a user’s own connected data to produce personalized output. Ads are now part of that picture.

Decrypt describes the update as quiet, and the timing supports that reading. A policy page edit is not a product launch. There was no keynote, no blog post walking users through what it means for their inbox, and no obvious in-product prompt telling people their email history is now fair game for ad targeting. The change simply took effect.

That is the reported fact, and it is worth stating plainly without dressing it up: Google’s advertising system can now reach into data categories it had publicly promised to keep separate from ads.

Why Marketers Should Care More Than They Think

The immediate temptation is to file this under “Google being Google” and move on. That would be a mistake, because the practical consequence is a new personalization signal that most advertisers have no model for yet.

Personal Intelligence is built on connected first-party data. If ad personalization can draw on that layer, then the targeting inputs Google can offer are no longer limited to search behavior, browsing signals, and the profile inferences advertisers already know how to work with. They potentially include context pulled from a user’s own documents, photos, and mail. For a marketer, that is a different kind of signal entirely, and it is one that no third-party pixel or cookie ever had access to.

What that means in practice is still unclear, and anyone claiming otherwise is guessing. Google has not published targeting parameters built on this. But the direction is obvious enough: the wall between “your private data” and “your ad profile” has a door in it now, and the door is controlled entirely by Google.

The Consent Problem Nobody Has Solved

Here is where I think this gets genuinely uncomfortable. Users who connected Gmail, Drive, or Photos did so under one set of expectations. The policy they agreed to has now been rewritten underneath them, and the mechanism for objecting is buried in settings most people will never open.

That is not a legal technicality. It is the core of why this story has legs. Privacy policy updates are legally routine and practically invisible, which is exactly why companies use them for changes they would rather not announce. A user who wants to keep their email out of ad targeting now has to know the change happened, find the right toggle, and trust that the toggle does what it says. Most will not get past step one.

For developers building on Google’s APIs, the downstream question is whether connected-account data becomes a liability in their own compliance posture. If a product encourages users to link Gmail or Drive, and Google’s ad system can now draw on that data, the consent story a developer tells their users gets harder to write honestly.

What to Watch Next

Three things will determine whether this stays a policy-page footnote or becomes a real fight.

• Whether Google ships visible controls that let users exclude their connected data from ad personalization, and how easy those controls are to find.
• Whether regulators in the EU and UK treat a silent policy edit as valid consent for a materially different use of personal data.
• Whether advertisers get any reporting that shows Personal Intelligence signals actually influencing delivery, or whether the whole thing stays opaque.

My read: the third one is the tell. If Google starts surfacing performance differences tied to connected-data personalization, this stops being a privacy story and becomes a targeting story, and every media buyer will want in. If it stays silent, that silence is itself informative about how much Google wants this examined.

For now, the honest summary is that a promise Google made for years is no longer in force, the replacement terms took effect without ceremony, and the people most affected were not told. Marketers should watch their targeting options. Developers should watch their consent flows. Users, as usual, will find out last.