Google connects Gmail and Photos with AI: watch out for advertising

Google has made a move in its privacy policy, and the move deserves attention in any IT department. The company has specified that, if the user decides to allow services such as Search or Gemini Apps to access data from other Google tools they use, that information may be used to show targeted advertising. In other words: the boundary between the assistant that helps you search and the advertising engine that monetizes your data is becoming more porous than many believed.

The detail matters because it affects services that in practice function as a personal and professional archive: email, photos, documents. Until now, many people assumed that this data remained in a compartment sealed off from advertising. The update makes it clear that the choice to connect services has consequences, and that this choice is made by the user, not by the company that administers the workstation.

What actually changes and what doesn't

It is best not to fall into easy alarmism. The news does not say that Google will automatically read all users' emails to sell ads. What it says is that, when the user enables access between services to take advantage of personalized AI features, that data may feed advertising segmentation. The difference between "may" and "does" is enormous, but it is also true that in everyday life nobody reads those permission screens with the attention they deserve.

For an SME, the risk is not so much advertising itself as the loss of control over where the information ends up. An email with a commercial proposal, a photo of a client visit, or a document with a supplier's data are business assets. If the assistant that summarizes inboxes or searches the photo archive has permission to cross-reference that data with other services, the company should know about it and decide consciously.

The underlying problem: permissions nobody reviews

At ForgeNEX we see a recurring pattern among the SMEs that consult us: new features are enabled because "they come with the tool" and permissions are accepted without anyone on the technical team validating the impact. It is not a Google failure; it is an information governance failure. And in an environment where generative AI is being integrated into email, office software, and search, that governance becomes critical.

The update also invites reflection on dependence on a single provider. When email, photos, documentation, and the AI assistant live in the same house, convenience is high and so is data concentration. It is not about demonizing Google, but about each organization evaluating what level of integration is worth it and what level is not.

What we recommend doing in your company

The first thing is to review the configuration of corporate accounts. In the admin panel, many of these connections between services can be controlled, and it is advisable to decide with judgment what is allowed and what is not, especially in accounts that handle customer information or personal data.

• Audit active permissions in the company's email and storage accounts, and document which AI services have access to what data.
• Separate personal from professional: avoid using the same account for AI experiments and for sensitive documentation.
• Train the team in handling consent screens. One wrong click can open a door that nobody closes again.
• Define an internal policy on which AI tools can be used with company data and which cannot.

This issue connects with a broader discussion we have already covered on the blog: the advisability of not tying the entire operation to a single AI provider. You can read our analysis on Open Responses and the reduction of ties between AI providers to understand why portability matters. And if you are considering which assistant best fits your SME, the comparison of Claude, GPT, and Gemini can serve as a starting point.

ForgeNEX's analysis

The news is not a scandal, but it is a signal. Google is putting in writing something that was already technically possible: that personalized AI and advertising share data if the user authorizes it. For an SME, the lesson is that privacy is no longer managed only with antivirus software and strong passwords; it is managed with decisions about permissions, providers, and training.

The convenience of an assistant that knows everything about your company has a price: someone has to decide what it can know and for what purpose.

Our recommendation is to treat privacy configuration as part of routine workstation maintenance, just like updates or backups. Reviewing permissions once a quarter, putting in writing which AI services are authorized, and training the team in the responsible use of these features costs little and prevents bigger scares. AI in the company is not only a matter of productivity; it is also a matter of control over information.

Source: The Hacker News. Analysis and adaptation: ForgeNEX.