Can Google Use Your Gmail to Show You Ads Now? What Changed on October 16 and Who It Affects

Google's privacy policy now allows ads shaped by Gmail data if you connect it to Search. Who is affected, why your company email matters, and 3 steps today.

Origami TeamEditorial Team
6 min read
Can Google Use Your Gmail to Show You Ads Now? What Changed on October 16 and Who It Affects

Yes, since October 16, 2026 it can, with one condition: you have to connect Gmail or Google Photos to another Google service that shows personalized ads, such as Personal Intelligence in Google Search. The new privacy policy says Google does not show ads based on your content from Drive, Gmail and Photos "unless you choose to make data from these services available" to a service that supports personalized ads. The feature is open to personal accounts only, and paid Google Workspace accounts are excluded. If your company's correspondence runs through free gmail.com accounts, check the three settings below today, and seriously consider moving work email to an account on your company's own domain.

What exactly changed in Google's privacy policy?

Since July 1, 2021 the privacy policy said, with no exception: "We don't show you personalized ads based on your content from Drive, Gmail, or Photos." The version in force from October 16, 2026 adds an exception to that same sentence: unless you choose to make data from these services available to other Google services that support personalized ads. The policy also adds an explicit example: Search may process some of the data you allow it to access to personalize content, "including ads."

Put simply: your inbox stays out of advertising as long as it stands alone. Once you connect it to Google Search, what Search infers from your email becomes material that can shape the ads you see. The change went in quietly, and few people noticed until tech sites reported it about a week later.

What is Personal Intelligence, and who can turn it on?

Google launched the feature in AI Mode in Search on January 22, 2026 for Google AI Pro and Ultra subscribers in the US, in English. Today the official help page says it is available in more than 190 countries and territories and in more than 80 languages, and it requires:

  • That you are 18 or older.
  • That the account is personal; work, enterprise and education accounts are excluded.
  • That you turn on "Personalized Recommendations" in your Google Account, then choose to connect the apps yourself.

The apps that can be connected today are Gmail, Google Calendar (US and English only) and Google Photos (not available in every region). Connecting is opt-in, and Google says it does not train its models directly on your inbox.

Can advertisers see my emails?

No. The help page says advertisers have no access to connected content, and that ads "will not be based directly" on your inbox or your photo library. An older rule still holds: no personalized ads based on sensitive categories such as race, religion or health. But the important word is "directly." Search draws summaries and inferences from your email, and those inferences are what may shape the ads. If your inbox holds quotations, contracts and supplier correspondence, you are letting Google draw meaning from them even though nobody reads the message itself.

Why does this matter to a business owner in particular?

Many small businesses in Saudi Arabia start with a free gmail.com account for the owner or for sales, and the account grows until it carries customer invoices, contact details and price quotes. In Google's eyes that account is "personal," so the new exception applies to it if someone on your team turns the connection on. For paid Google Workspace accounts, Google states in its privacy commitments for Workspace and Google Cloud: "We never use your data for ads targeting," and it does not process customer data to build ads profiles. The difference, then, is not the service itself but the type of account you run your business from.

There is your customers' side too: work email holds their names, numbers and the details of their dealings with you, and connecting it to an advertising service is a decision the business should make deliberately, not one an employee makes while trying a new feature on their phone. If you want to review your business's obligations toward customer data, start with our practical guide to the Personal Data Protection Law.

3 steps to take today

  1. Check the connection: in your Google Account open Search Services Personalization, then Additional Personal Intelligence, then Connected Content Apps, and disconnect Gmail and Google Photos if they are connected on an account that holds work data. In Gmail settings, review "Smart features in other Google products."
  2. Delete the old history: disconnecting an app does not delete what was already saved in Search Services History. Go to myactivity.google.com and delete the activity if you want it gone, and review your ad settings in My Ad Center.
  3. Separate work from personal: move company email to accounts on your own domain in Google Workspace or Microsoft 365, and write a short policy that bars connecting work accounts to any AI feature without the administrator's approval.

So should I leave Gmail?

No need to panic. The change does not switch itself on, and it does not touch your account unless someone turns the connection on. But it is a reminder of a simple rule: free services are funded by advertising, and every new AI feature needs your data to work, so read what you are agreeing to before you tap "Connect." We covered the same idea for connected apps in Who Can Get Into Your Company's Microsoft 365 Without a Password?

The Origami view

We see a lesson in this change that is bigger than Gmail: the line between business data and personal use has to be drawn in the settings and in company policy, not left to each employee's taste. When we build systems for clients that connect to email or to AI models, we decide from the start which data leaves, where it goes and with what permission. If you want your company's accounts and connected tools reviewed, or your work email moved into a properly controlled business environment, get in touch.

Sources

#Gmail privacy#Google privacy policy#Google ads#Business email

Frequently asked questions

Is Google now reading my Gmail to show me ads?

Not automatically. Since October 16, 2026, Google's privacy policy allows ads influenced by Gmail data only if you connect Gmail to a service that supports ads, such as Personal Intelligence in Google Search. Without that connection the old rule stands: no ads based on your email content.

Does the change cover my company's Google Workspace accounts?

No. Personal Intelligence is available to personal accounts only, and Google's Workspace privacy commitments say it never uses customer data for ads targeting. What is exposed is work email run from a free gmail.com account.

How do I know if Gmail is connected to Search, and how do I disconnect it?

Open your Google Account, then Search Services Personalization, then Additional Personal Intelligence, then Connected Content Apps, and disconnect Gmail and Google Photos. Disconnecting does not delete earlier history, so delete it at myactivity.google.com.

Can advertisers see the content of my email?

No. Google says advertisers have no access to connected content and that ads are not based directly on your inbox, but on summaries and inferences Search draws from it, with sensitive categories such as religion and health excluded.

Follow Origami in Google

Pin Origami as a preferred source and our articles will surface first for you in Google Search and Top Stories.

Add as a preferred source on Google

Rate this article

Related articles

Cloudflare AI Data Leak: 155 Responses Carried Other Customers' Data, and 5 Questions for Your AI Provider
Cybersecurity

Cloudflare AI Data Leak: 155 Responses Carried Other Customers' Data, and 5 Questions for Your AI Provider

Cloudflare data leak: 155 AI responses carried other customers' data between August 27 and September 9, 2026. What happened, 5 questions for your AI provider, and steps.

6 min read
Who Can Get Into Your Company's Microsoft 365 Without a Password? A Hacked Backup App Targeted 2,250+ Organizations
Cybersecurity

Who Can Get Into Your Company's Microsoft 365 Without a Password? A Hacked Backup App Targeted 2,250+ Organizations

Outside apps connected to Microsoft 365 can read company mail with no password. The ConnectWise breach targeted 2,250+ organizations: 5 steps to audit yours today.

7 min read
PHP Vulnerabilities: Patched After PHP2Shell? A New Warning the October 21 Update Does Not Fix, and the One Setting That Stops It
Cybersecurity

PHP Vulnerabilities: Patched After PHP2Shell? A New Warning the October 21 Update Does Not Fix, and the One Setting That Stops It

Patched PHP after PHP2Shell? On October 23 the PHP project warned of a third flaw the October 21 update does not fix. Here is the setting to change today, and 5 questions to send your host.

6 min read
Update Your FortiGate Firewall Before November 10: AI-Found Critical Flaws Go Public That Day
Cybersecurity

Update Your FortiGate Firewall Before November 10: AI-Found Critical Flaws Go Public That Day

Update FortiOS on your FortiGate firewall to 7.4.13, 7.6.8 or later before 10 November, when Fortinet publishes details of critical flaws found with AI.

6 min read
A Hacked LiteLLM Release Stole Cloud and AI Keys in Two Hours: Check Your Company's Systems Today
Cybersecurity

A Hacked LiteLLM Release Stole Cloud and AI Keys in Two Hours: Check Your Company's Systems Today

LiteLLM 1.107.0 was a hacked release that stole cloud and AI keys from 49,000 downloads in two hours. How to check your systems, rebuild and rotate keys today.

6 min read
Is Your Site on WordPress or PHP? PHP2Shell Opens Your Server Without a Password, and Attacks Have Started
Cybersecurity

Is Your Site on WordPress or PHP? PHP2Shell Opens Your Server Without a Password, and Attacks Have Started

PHP2Shell, two 9.2-rated flaws, opens WordPress, Magento and any PHP server without a password. The patched PHP versions and five steps to protect your site today.

6 min read

Have a project in mind?

We build custom systems, apps and websites for your business. Tell us your idea and we will give you a straight answer on it.

One session. Twenty minutes. No commitments.