The privacy policy page got a new paragraph this week, and it did not arrive like an incident. No banner. No admin alert. A Workspace admin at a 400-person shop opened Google’s update, sat with the line about Search and Gemini Apps reaching other Google services, and watched Gmail and Photos slide into the targeting pile. That is a cybersecurity problem wearing a product manager’s smile. Your users thought they turned on smarter search.

The Toggle Lived Next to Helpful Mode

Google now says you may choose to let certain services, including Search or Gemini Apps, access data from other Google services you use. Once that grant is on, activity from Gmail and Photos can shape the ads you see. The company calls it a choice. In a tenant, a choice that promises better answers becomes the unofficial standard by lunch.

A personal account can take a privacy haircut and argue about it on a weekend. A company inbox is a different object. Gmail holds vendor contracts, password-reset mail, legal holds, and the thread where someone pasted a customer export. Work Photos capture whiteboards, badges, dock receipts, and the all-hands slides. Your cyber security program spent years tagging that data. The ad systems on the other side of the grant do not read your labels.

People enable Gemini because a VP asked for faster research. They connect services because the prompt offered personalization. Your threat-protection tools see a clean, authenticated session to a vendor you already allow. The grant never looks like malware. It looks like a checkbox beside a smarter search box. This is a bad look for a company that already sits in the middle of most corporate mail.

Mail Met the Auction Without a Ticket

You already treat Google as a processor. The policy note stretches that relationship toward advertising inference on content that may sit under a customer DPA, a union rule, or a retention schedule. Defense in depth in most shops still concentrates on inbound mail and the login edge. The new path is an in-product data grant that rides the same identity you use to read mail.

Think about what an ad graph can infer without ever stealing a mailbox. A burst of messages with a law firm, then a week of calendar holds, is a merger tell. Field techs uploading shelf photos can sketch a customer’s floor plan. Recruiters’ threads sketch who you are trying to hire before the job post goes live. Targeted ads built from that residue do not need a phish kit. They need a connected feature you blessed in the name of productivity.

Incident response runbooks cover token theft and mailbox takeover. Few of them open a case for the vendor expanding processing, then ask which OUs enabled Gemini last quarter. Threat detection stays quiet. There is no hash to hunt. There is a changelog and a pile of users who thought they were improving Search. The SOC is staffed to chase payloads. Policy diffs arrive as blog posts and buried help-center notes.

Workspace gives you more admin surface than consumer Gmail. Use it. The ugly case is mixed-use: work mail on a personal Android profile, Gemini signed in with the account that also holds family Photos, a contractor who forwarded a shared drive into a consumer login. Those collapses make your DLP policy a story you tell auditors. Security hardening that stops at the firewall change ticket leaves the grant path without an owner. The bytes never leave Google’s fabric. A brute-force dashboard can stay green the entire time.

Put Cybersecurity Controls on Connected AI

Do the inventory this afternoon. Export who has Gemini Apps, personalized Search features, and cross-service access turned on. If the admin plane cannot give you that list in an hour, write that down as finding one. Disable org-wide flow from Gmail and Photos into Search and Gemini until legal and security sign the processing change. Keep consumer Google logins off managed devices; that belongs in MDM, not in a wiki page. Review connected apps and OAuth grants with the same suspicion you apply to SSO exceptions. Send staff one plain mail that smarter Search can pull work content into ad targeting, and point them at the setting you want left off.

Map the data classes before you argue with the vendor. Mail that carries customer PII, health details, payment disputes, or privileged legal advice should be treated as prohibited fuel for any consumer-facing AI feature, full stop. If a group needs Gemini, give it to a dedicated OU with a documented purpose, a named owner, and a kill switch. Record the decision in the risk register as a vendor processing change, not as a collaboration experiment.

Then put privacy-policy diffs on the same calendar as certificate renewals. Recertify allowed AI features by OU every quarter, including which data classes may move. Train incident response to open a vendor-processing incident when a platform expands inference over mail or photos, even when no password was stolen. Pair that review with your firewall tickets so the identity grant gets an owner next to the network change. Defense in depth for a cloud suite is identity, DLP, and contractual purpose limits moving as one control. Keep the brute-force lockouts. Add a human whose job is to read the policy feed before the next helpful paragraph ships.

Boards will ask whether this is a breach. Answer them with the processing question: who can infer what, from which mailbox, for which commercial purpose, under which contract. If you cannot answer that in a paragraph, the grant is already ahead of your program. Pull the feature back until the paragraph exists. Productivity features that mine the inbox are now part of the control surface. Treat them that way before the next update rewrites the deal in quieter language.

Sources

• Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted Ads