Google's new privacy policy allows ads based on Gmail, Drive and Photos content that users share with Search
Until October 16, 2026, Google's privacy policy promised without exception that content from Drive, Gmail and Photos would not be used for personalized ads. The new version adds an exception for data that users choose to make available to Google services that support personalized ads. It also says Search may use the data a user lets it access to personalize ads.
Source
Google Privacy Policy: comparison of October 1 and October 16, 2026 versionsGoogle Privacy & Terms · Original published October 16, 2026
Google changed one of the firmest promises in its privacy policy with the version that took effect on October 16, 2026. The previous text said Google does not show personalized ads based on content from Drive, Gmail or Photos. The new text keeps that sentence but adds an exception: unless the user chooses to make data from these services available to other Google services that support personalized ads.
What the new text adds
A new paragraph explains how that data reaches other services. A user may allow services such as Search or Gemini Apps to access data from Photos, Gmail and Drive for a more personalized experience. The policy then gives an example: Search may process some of the data the user lets it access to personalize content, including ads.
The same section now says Google may show personalized ads based on personalized content from its services, alongside interests and activity. The version in force from October 1, 2026, mentioned only interests and activity.
What stays the same
Two limits are unchanged. Google still says it does not show personalized ads based on sensitive categories such as race, religion, sexual orientation or health. It also still says it does not share information that identifies a user, such as a name or email address, with advertisers unless the user asks.
The policy points to the ad settings in My Ad Center for controlling which information is used for ads. A separate Google help page describes the Personalized Recommendations setting, which controls whether Search services personalize results, feeds and AI responses.
„We don't show you personalized ads based on sensitive categories“
Sources
Related
Railway asks all users to rotate their secrets after attackers read some decrypted environment variables
The app hosting platform says an unauthorized party may have reached the systems that store customer environment variables, and decrypted some of them. Railway believes the impact is limited to a subset of users but wants everyone to replace their keys. Its recovery guides add that sessions, tokens and GitHub connections were revoked, and that commits pushed during the outage were never deployed.
Railwayverified
PHP fixes two critical flaws that let attackers run code on web servers without logging in
Releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 close two vulnerabilities that, under the right conditions, give an attacker code execution with no credentials at all. Every PHP installation that serves web requests is affected. Amazon says it saw the first exploitation attempt on October 17, four days before the fix was public.
The PHP Foundationverified
Node.js fixes 10 vulnerabilities in versions 26, 24, and 22, four of them rated high
The Node.js project shipped security releases 26.12.1, 24.22.1, and 22.23.4 on October 21, 2026. The most serious fixes cover a Brotli decoder flaw that the project says permits remote code execution and several ways around TLS hostname checks. The releases also update the root certificates after the eMudhra key compromise.
Node.jsverified