Google Gemini Now Routes Connected Workspace Data to Human Reviewers

Google has updated its privacy disclosures to confirm that personal content from Gmail, Docs, and Drive—when connected to the Gemini AI—is no longer shielded from human reviewers. This shift contradicts a 2023 promise that such data would remain isolated, creating a scenario where personal files and emails can be ingested into human review pipelines during standard AI interactions.

Policy Reversal on Data Isolation

In 2023, Google launched Gemini Workspace extensions with an explicit guarantee that personal content from Gmail, Docs, and Drive would not be seen by human reviewers. However, a recent update to Google's Help documentation and a subsequent edit to their 2023 blog post confirm that this commitment has been reversed.

The updated documentation now includes clear warnings that reviewers may see the specific emails or files connected to the service. Google advises users not to connect apps to Gemini if they contain confidential information that they would not want a human reviewer to see.

“Google has quietly reversed this commitment.”

— GitHub - thisisme6598/gemini_files: Documentation of Gemini File Leaking Behavior

Autonomous Ingestion Mechanism

Testing reveals that the ingestion of personal data happens autonomously in the background. When a user chats with consumer Gemini and has 'Connected Apps' enabled, ambient mentions of personal topics—such as reservations, names, or bills—can trigger a Workspace lookup without the user explicitly using @Drive or @Gmail tags.

Because LLM tool-calling and context injection are probabilistic, the system's behavior is non-deterministic. A user's query may result in one of four scenarios: zero retrieval, a high-level metadata summary, a partial unredacted extraction of 2–4 sentences, or a full-file ingestion where the complete, unredacted text of a document or email is pulled into the session context.

Limitations of Automated Scrubbing

A significant technical hurdle identified in the documentation is the inability of automated systems to fully protect user privacy. Google's regex and Named Entity Recognition (NER) scrubbers are often unable to sufficiently deidentify narrative data.

This means that even when data is processed, sensitive details like account numbers, confirmation numbers, and transaction dates may remain visible. These elements, combined with other identifying information like specific cities or events, can still be linked back to an individual user during the human review process.