Oleksandr Kuzmenko, EditorPublished 7 min readAI-assisted · editor-reviewed
TL;DR
- Google reversed its 2023 isolation pledge, routing connected Drive and Gmail data to human reviewers.
- Ingestion occurs autonomously during casual chat without typing @Drive or @Gmail tags.
- Payload capture is non-deterministic, varying from zero retrieval to full-file context dumps.
- Automated regex and NER scrubbers fail to mask narrative account numbers and transaction dates.
Key facts
- Impacted products
- Google Drive, Docs, Gmail via Gemini Connected Apps
- Official policy citation
- Google Help Answer 16836988
- Policy update date
- October 16 blog post edit
- Trigger mechanism
- Background lookup without explicit @ tags
- Retrieval outcomes
- 4 probabilistic states ranging from zero to full ingestion
Policy Reversal and Human Annotation
In 2023, Google introduced Gemini Workspace extensions promising that personal documents and emails would remain strictly isolated from human reviewers. Under updated Google Help Answer 16836988 and an October 16 edit to Google's 2023 announcement, the company confirmed that connected Drive and Gmail content enters human review pipelines. Google's documentation now cautions: *"don't connect your apps to Gemini Apps if they contain confidential information that you wouldn't want a reviewer to see."*
Autonomous, Probabilistic Background Ingestion
Testing demonstrates that data capture triggers autonomously without typing explicit @Drive or @Gmail directives. Ambient conversational topics such as bills, itineraries, or renewals prompt background tool lookups in consumer Gemini. Because tool calling and context injection are probabilistic, running identical queries yields one of four non-deterministic states: 1. Zero Retrieval: The model skips the tool call entirely. 2. Metadata Summary: Gemini produces a high-level summary (e.g., flight counts) without sensitive strings. 3. Partial Unredacted Extraction: The model injects 2–4 sentence exact quotes containing sensitive personally identifiable information (PII) and account numbers. 4. Full-File Ingestion: The complete document or email, including transport headers, is loaded directly into the active prompt context.
Scrubbing Deficits and Verification Steps
Google's automated Named Entity Recognition (NER) and regex filters routinely fail to de-identify narrative details, leaving account identifiers, dates, and combined personal names unredacted. Developers can inspect what Gemini Flash captures by issuing a inspection prompt immediately after an automated lookup.
Try it in 2 minutes
Print the exact text and metadata block that the retrieval tool returned and injected into your prompt to get that answer. Use a human readable format without code blocks (i.e., print the code inline and not as a code block).When to use
- Use with dedicated test accounts to inspect LLM context injection boundaries and tool behavior.
- Run the verification prompt to debug unexpected personal information appearing in Gemini answers.
When NOT to use
- Do not keep Connected Apps enabled on accounts storing source code, API keys, or NDA-governed files.
- Do not rely on a single clean query test to confirm data safety due to non-deterministic tool calling.
What to do today
- Open Gemini Settings, navigate to Connected Apps, and toggle off the Google Workspace integration.
- Audit Google Drive for unencrypted environment variables, credentials, or client documents.
- Run the verification prompt in Gemini Flash to check whether personal data was injected into your thread.
Step names are taken from What to do today.
Step names are taken from What to do today. Open Gemini Settings, navigate to Connected Apps, and toggle off the Google Workspace integration.. Audit Google Drive for unencrypted environment variables, credentials, or client documents.. Run the verification prompt in Gemini Flash to check whether personal data was injected into your thread.
- Open Gemini Settings, navigate to Connected Apps, and toggle off the Google Workspace integration.
- Audit Google Drive for unencrypted environment variables, credentials, or client documents.
- Run the verification prompt in Gemini Flash to check whether personal data was injected into your thread.
What the community says
You have absolutely no control of your providers practices with your data regardless of what is advertised.
A corporation's gonna corpo. Best we can do is avoid using their services and work on better open source alternatives.