Google has updated its privacy wording to clarify that if users enable certain personalised AI features in Search or Gemini, activity involving connected Google services such as Gmail or Photos could be used for ad personalisation. The reported change does not by itself create a new law or regulatory requirement, but it is relevant for companies that rely on Google tools and need to manage data exposure, privacy expectations and internal AI use.

What happened

According to the reported policy update, Google now states more explicitly that users may allow services including Search or Gemini Apps to access data from other Google services they use. If that access is enabled, information from those interactions may also be used for targeted advertising.

The key point is not simply that Google offers AI features, but that cross-service data sharing tied to personalisation can have advertising implications. In practice, this means organisations should pay close attention to which AI and account-linking options are enabled for employees and business accounts, and how those settings interact with existing privacy policies and acceptable-use rules.

Why it matters for European businesses

For European companies, this development matters because AI adoption often happens through tools employees already use every day. If staff connect email, documents, photos or other account data to AI assistants and search features, that can change how information is processed within a vendor ecosystem.

From a business perspective, there are several implications:

• Privacy governance: Companies may need to review whether employee use of personalised AI features aligns with internal policies on business data, customer information and confidential communications.
• Advertising and profiling concerns: If service interactions can influence ad personalisation, businesses may want to assess whether this is acceptable for staff using work-linked accounts or mixed personal-business environments.
• Data separation: SMEs in particular often operate with blurred lines between personal and business accounts. This can create unnecessary exposure when AI features draw on multiple connected services.
• Vendor due diligence: Businesses adopting AI assistants should look beyond productivity claims and examine account settings, data-sharing choices and contractual terms.

For regulated organisations or companies handling sensitive client information, even optional AI features can require closer review before broad rollout.

Who may be affected

• SMEs and founders using Google services informally across personal and business accounts.
• Marketing teams relying on Google Search, Gemini and advertising platforms, where data-use expectations are especially important.
• IT and security teams responsible for account configuration, access controls and approved AI tooling.
• E-commerce businesses managing customer communications, support inboxes and operational workflows inside Google services.
• Regulated businesses that must document how third-party tools process business or personal data.

What companies should consider

• Review account settings: Check whether personalised AI features are enabled and whether users can link data from Gmail, Photos or other services into Search or Gemini.
• Separate work and personal use: Encourage staff to avoid mixing personal Google accounts with business activities where possible.
• Update internal guidance: Make sure employees understand what data they should not expose to consumer AI features without approval.
• Assess data-processing implications: Privacy, legal and IT teams should review whether existing vendor and data-governance assessments still reflect actual use of Google AI features.
• Verify admin controls: Organisations using managed Google environments should confirm what administrators can restrict, log or disable.

At this stage, the main issue for businesses is governance rather than panic. The reported wording appears to clarify how data may be used when users opt into personalised AI experiences. For European companies, that makes it a practical reminder to review AI settings, data boundaries and staff usage policies before convenience features become a compliance or confidentiality problem.