Google Privacy Policy: Can Gmail Data Be Used for Ads?
Google’s updated privacy policy adds an exception for Gmail, Drive and Photos data shared with other Google services. Here’s what changed and what the numbers suggest.
👁 115 reads
The change is just one sentence, and it is easy to miss. In Google’s privacy policy, effective 16 October 2026, the statement that Gmail, Drive and Photos content is not used to personalise ads now comes with a condition: that remains true unless you choose to share data from those services with other Google services that serve personalised ads. A subordinate clause turns an unconditional promise into a default with an exception. Android Authority spotted the change first, and Dexerto reported on it.
One sentence changes the shape of Google’s promise
It helps to look at the wording that came before. For years, Google repeated an unconditional version: content from Gmail, Drive and Photos is not used to target ads. Full stop. The company stopped scanning Gmail for advertising purposes in 2017 and made that part of its marketing to businesses. The new wording does not explicitly withdraw that promise. Instead, it moves it from a company-wide principle to an account setting that you can effectively override by enabling Personal Intelligence features in Search and Gemini.
“We don’t use content from Drive, Gmail and Photos to personalise ads, unless you choose to share data from those services with other Google services that serve personalised ads.” - excerpt from Google’s privacy policy, effective 16 October 2026.
The practical difference is this: to use an assistant that suggests a restaurant near your hotel based on a booking confirmation in your inbox, you need to give Gemini access to your inbox. Data brought into that process is no longer covered by the old wording. Google stresses that advertisers do not receive your emails or photos directly, and that the exception applies only to data you knowingly share. That is an important qualification. The concern is that “knowingly” may now mean accepting a new feature’s welcome screen, rather than giving separate consent for advertising.
How much revenue does Google make per user in EMEA?
The most revealing figure is not in the privacy policy but in Alphabet’s financial reports. Alphabet reports revenue by region, and its EMEA segment - Europe, the Middle East and Africa - brought in around $118 billion in 2025. Google also says Gmail has more than 2 billion active accounts worldwide. Industry estimates suggest Europe accounts for roughly one-fifth of that base, or about 400 million users. Divide the regional revenue by that estimated number of accounts and you get roughly $295 per user per year in EMEA, or about $24.60 a month.
That figure is regional revenue divided by the estimated number of accounts, not the value of Gmail data alone. But it gives a sense of the stakes. If access to inbox context improved ad targeting by even 2% - a cautious assumption given industry claims of double-digit conversion gains for contextual advertising - then across 400 million European accounts, the potential difference would be $2.36 billion a year. That is the order of magnitude that could make rewriting one sentence in a legal document worthwhile.
How much data might a Google account generate?
The other side of the calculation can also be estimated. The average email user receives around 120 messages a day, according to Radicati reports, or about 44,000 emails a year. Then there are photos: a typical smartphone owner takes around 1,000 a year, and Google Photos stores them with full EXIF metadata, including GPS coordinates, date, time and camera model. A geotagged photo is effectively a point on a map with a timestamp. A thousand photos create a thousand points that can help reconstruct a commute, a holiday and a home address.
That adds up to about 45,000 records a year, each containing content, a sender or location, and a timestamp. At $295 in annual revenue per user, that works out to roughly 0.7 cents per record. In a simplified statistical sense, that is the implied value of an individual email or phone photo. This is my calculation, not a figure Google publishes, and Google is under no obligation to publish it.
Does GDPR require separate consent for advertising?
The key legal question is whether GDPR allows email data to be processed for advertising. It does not prohibit it outright, but it sets conditions for consent. Article 7(2) of the regulation says that when consent is part of a wider document, it must be presented in a way that clearly distinguishes it from other matters. Recital 32 adds that silence, pre-ticked boxes and inactivity do not constitute consent. And when data may reveal health, political opinions or sexual orientation - as inbox content can do - Article 9 and its requirement for explicit consent may apply.
So the question is whether accepting a Gemini assistant feature meets the test for separate, explicit consent to advertising-related processing. In my view, it does not: you click on something presented as an inbox enhancement, while an expanded advertising profile is a side effect. In January 2022, France’s CNIL fined Google €150 million because refusing cookies required more clicks than accepting them. Earlier, in 2019, the same authority fined Google €50 million for a lack of valid consent to ad personalisation and for scattering information across multiple documents. Together, those fines total €200 million. Against a potential $2.36 billion a year from even a modest improvement in targeting, that may look like an operating cost to Alphabet rather than a deterrent.
What to check in your Google account
Google’s lead EU data protection regulator is Ireland’s Data Protection Commission, under the EU’s one-stop-shop mechanism. Any potential investigation would therefore involve the Irish regulator, alongside other authorities concerned. There is no need to wait for a decision that could take years. In your Google Account settings, look under Data & privacy for Personal Intelligence and personalised recommendations, and check whether Gmail, Photos and Drive are connected. You can also review the Ads personalisation setting and turn it off. Availability and settings may vary, so check what is available in your account.
One caveat Google does not emphasise: disconnecting apps does not delete information already stored in your Search history. Data collected between 16 October and the date you turn the feature off may remain on Google’s servers and may need to be deleted manually through My Activity, by selecting the relevant date range. That means every day of delay could add another 120 emails and several geotagged photos to the pool you may later need to clear. At roughly 45,000 records a year, a week’s delay would mean about 860 records to review and remove.
Google · Your sourcesQuantslant higher in your Google - one clickAdd to preferred sources →Google’s privacy policy: before and after
| Item | Policy through 15 October 2026 | Policy from 16 October 2026 |
| Gmail, Drive and Photos content used for ads | Unconditionally excluded | Excluded unless you share data with other services |
| Basis for exclusion | A principle in the policy | An account setting |
| Where consent is given | Nowhere - there was no such option | When you enable Personal Intelligence |
| Data deletion after opting out | Not applicable | Does not happen automatically |
The biggest change is not that Google has started reading your email - in the advertising context, it says it has not, unless you open the door yourself. The change is that the decision has moved from a company-wide principle to a settings checkbox that many people may never hear about. That checkbox may increasingly be selected as part of enabling something else.
Facts checked on 25 October 2026. The revenue-per-user and per-record calculations are mine, based on Alphabet’s public financial data and Google’s stated number of Gmail accounts. Google does not publish ARPU by service.
Sources:
