AI and security briefsTools

Does Google Gemini send my Gmail and Drive content to human reviewers, and how do I stop it?

By Brandon Da Costa, founder of Digiton Dynamics

Published 9 November 2026Updated 9 November 2026Editorial policy

Yes, for personal Google accounts that connect Gmail or Drive to Gemini. Google's Connected Apps help page says a subset of that data, including summaries and excerpts of emails and files, is reviewed by people, sometimes the whole email or file. Disconnect Google Workspace and turn off Keep Activity to stop it.

Who should act: Anyone who signs in to Gemini with a personal Google account and has connected Gmail, Drive or other Workspace apps, and admins whose staff use Gemini on personal accounts.

What happened

A Hacker News thread on 9 November links a GitHub repository, created the same day by an account with one repository, titled "Google Gemini routes personal Drive files and emails to human annotators". Its author says Google reversed a 2023 promise and that Gemini pulls whole emails or files into chats unasked. Those tests are one anonymous person's and I could not reproduce them.

Google confirms the review in its own words. Its 2023 post on Bard's Workspace extensions still says Gmail, Docs and Drive content is not seen by human reviewers. A note added on 16 October 2026 says that when users connect Workspace apps to other Google services, that data can train generative AI models and can be subject to human review in limited circumstances.

Google's Connected Apps help page, "About personalization with Connected Apps", says a subset of Connected Apps data is reviewed by human reviewers, including trained service providers. It lists "summaries, excerpts and inferences from your relevant emails and files" and adds that where an email or file is brief or particularly relevant, "the summary may just be the email or file". Google says it does not train directly on your inbox or Drive. Before review it disconnects the data from your account and reduces personal information, except in abuse cases. Reviewed chats are kept up to three years (Gemini Apps Privacy Hub).

Who is affected

• Personal Google accounts, 18 or over, with Personal Intelligence, Keep Activity on and Google Workspace connected. Google's help says Personal Intelligence is not available on work, school or supervised accounts.
• Anyone who sends feedback. Even with Keep Activity off, Google takes the last 24 hours of chats and any connected-app content in them for review.
• Work and school accounts, where Google's Workspace privacy hub says Gemini app chats and uploaded files are not human reviewed or used for training without permission.
• A conflict for Workspace users: Google's Drive help page on the Gemini side panel says reviewers may read and annotate interactions data. It names no account type, so ask your admin.

What to do now

1. Disconnect Gmail and Drive. On gemini.google.com choose Menu > Settings > Personal Intelligence > Connected Apps > Google Workspace > More options > Disconnect. On mobile it is Menu > profile picture > Personal Intelligence > Connected Apps, then switch Google Workspace off.
2. Turn off Keep Activity. On a computer open gemini.google.com, click Activity, then Turn off or Turn off and delete activity. Google says this stops future chats being used to improve its services and makes Google Workspace unavailable.
3. Know what stays. Chats are still held for 72 hours, and Google still uses them to protect its services with human reviewers. Disconnecting an app does not delete Gemini Apps Activity, and chats already reviewed are kept for up to three years.
4. For one chat, open Tools and switch Personal Intelligence off, or use a temporary chat, which Google says is not used for improvement with human reviewers. Skip feedback on chats that touched connected content.
5. Admins should confirm staff use the work account for Gemini. Google reset connections when Personal Intelligence launched, so recheck. Our AI audit maps which assistants read your data.

What should have been in place

• A written rule that work mail and files are never connected to a personal Gemini account.
• Connected Apps off by default, with a dated check after each Google settings change.
• Sensitive mail kept out of any account where Keep Activity is on.

Questions people ask

Digiton's review of AI tool access lists which assistants can read your mail and files, under which account and with which settings, and the checks it runs are on the Claude Code governance page.

How this brief was made: researched from the sources below, drafted with AI assistance and checked against each source on the dates shown. See the editorial policy.

Sources

1. Google Gemini Apps Help, About personalization with Connected Apps, read 9 November 2026. https://support.google.com/gemini/answer/16836988?hl=en
2. Google Gemini Apps Privacy Hub, read 9 November 2026. https://support.google.com/gemini/answer/13594961?hl=en
3. Google blog, 2023 Bard extensions post with the 16 October 2026 update note, 19 September 2023, read 9 November 2026. https://blog.google/products-and-platforms/products/gemini/google-bard-new-features-update-sept-2023/
4. Google Gemini Apps Help, connect your Google apps to personalize Gemini, read 9 November 2026. https://support.google.com/gemini/answer/16598406?hl=en
5. Google Gemini Apps Help, manage and delete your activity, read 9 November 2026. https://support.google.com/gemini/answer/13278892?hl=en
6. Google Workspace Help, Generative AI in Google Workspace Privacy Hub, read 9 November 2026. https://knowledge.workspace.google.com/admin/generative-ai/generative-ai-in-google-workspace-privacy-hub
7. Google Drive Help, disclaimers and data usage for Gemini in Drive, read 9 November 2026. https://support.google.com/drive/answer/16684790?hl=en
8. GitHub repository cited in the Hacker News thread, anonymous author's tests, 9 November 2026, read 9 November 2026. https://github.com/thisisme6598/gemini_files

More briefs

How these briefs are sourced and corrected. All AI and security briefs