Skip to content
Toolsstrong signalverified

Google's new privacy policy allows ads based on Gmail, Drive and Photos content that users share with Search

Until October 16, 2026, Google's privacy policy promised without exception that content from Drive, Gmail and Photos would not be used for personalized ads. The new version adds an exception for data that users choose to make available to Google services that support personalized ads. It also says Search may use the data a user lets it access to personalize ads.

By Redakcija WebAiRadarPublished 1 min readwritten by a model

Google changed one of the firmest promises in its privacy policy with the version that took effect on October 16, 2026. The previous text said Google does not show personalized ads based on content from Drive, Gmail or Photos. The new text keeps that sentence but adds an exception: unless the user chooses to make data from these services available to other Google services that support personalized ads.

What the new text adds

A new paragraph explains how that data reaches other services. A user may allow services such as Search or Gemini Apps to access data from Photos, Gmail and Drive for a more personalized experience. The policy then gives an example: Search may process some of the data the user lets it access to personalize content, including ads.

The same section now says Google may show personalized ads based on personalized content from its services, alongside interests and activity. The version in force from October 1, 2026, mentioned only interests and activity.

What stays the same

Two limits are unchanged. Google still says it does not show personalized ads based on sensitive categories such as race, religion, sexual orientation or health. It also still says it does not share information that identifies a user, such as a name or email address, with advertisers unless the user asks.

The policy points to the ad settings in My Ad Center for controlling which information is used for ads. A separate Google help page describes the Personalized Recommendations setting, which controls whether Search services personalize results, feeds and AI responses.

„We don't show you personalized ads based on sensitive categories“
Google Privacy Policy

Sources

BrandsGemini

Related

RAILWAYAll keysto be replaced after the October 21 breach
Toolsstrong signal

Railway asks all users to rotate their secrets after attackers read some decrypted environment variables

The app hosting platform says an unauthorized party may have reached the systems that store customer environment variables, and decrypted some of them. Railway believes the impact is limited to a subset of users but wants everyone to replace their keys. Its recovery guides add that sessions, tokens and GitHub connections were revoked, and that commits pushed during the outage were never deployed.

Railwayverified

PHP2critical flaws fixed in 8.5.12, 8.4.27, 8.3.36
Toolsstrong signal

PHP fixes two critical flaws that let attackers run code on web servers without logging in

Releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 close two vulnerabilities that, under the right conditions, give an attacker code execution with no credentials at all. Every PHP installation that serves web requests is affected. Amazon says it saw the first exploitation attempt on October 17, four days before the fix was public.

The PHP Foundationverified

NODE.JS10vulnerabilities fixed across 26, 24, and 22
Toolsstrong signal

Node.js fixes 10 vulnerabilities in versions 26, 24, and 22, four of them rated high

The Node.js project shipped security releases 26.12.1, 24.22.1, and 22.23.4 on October 21, 2026. The most serious fixes cover a Brotli decoder flaw that the project says permits remote code execution and several ways around TLS hostname checks. The releases also update the root certificates after the eMudhra key compromise.

Node.jsverified