Google reverses pledge: Gemini can route personal Gmail and Drive content to human reviewers

Google has quietly withdrawn a 2023 commitment that personal content from Gmail, Docs and Drive pulled into its Gemini Workspace extensions would never be exposed to human reviewers. According to documentation published in a GitHub repository that reached the Hacker News front page, Google now confirms that connected email and Drive files can go to human reviewers, and the author's testing suggests whole documents can enter that pipeline automatically during ordinary conversation.

What changed

When Google launched the Gemini Workspace extensions in 2023, it coupled them with an explicit guarantee: personal content would stay out of human review. That guarantee is gone. The repository, maintained under the handle thisisme6598, points to two changes: an updated Google Help answer (numbered 16836988) and an edit dated October 16 to the original 2023 announcement. Both now acknowledge that content from connected apps can reach human reviewers, and Google warns that a reviewer may see nothing beyond the email or file itself, stripped of context. Its updated advice is blunt: do not connect apps holding confidential material you would not want a reviewer to read.

It is worth separating two claims. The human-review routing is confirmed by Google's own help pages; the findings about how content gets pulled in rest on the repository author's reproduction work.

Four outcomes, drawn at random

The more striking part of the documentation concerns ingestion. Testing described there indicates that casual references to personal topics such as trips, bills, names or reservations can trigger background searches of a user's Gmail and Drive on their own, with no @Drive or @Gmail tag and no request to search files. Because tool-calling in large language models is probabilistic, the same query can land in any of four states:

• No retrieval: the connected-apps tool never fires, and no personal data leaves the account.
• Metadata or summary: Gemini reads emails or files but reports only a high-level result, such as the number of flight-related messages.
• Partial extraction: a short verbatim quotation, two to four sentences in the documented schema and up to six in the logged examples, is injected into the session, often carrying personal details, account data or specific figures.
• Full ingestion: the complete, unredacted text of a document or email, headers included, is loaded into the conversation's context.

The author stresses that landing in one of the first two states proves nothing. Each run is a single draw from a nondeterministic system, so tests must be repeated with the prior conversation deleted, or earlier history supplies the answer.

The reproduction test

The worked example used a real internet-provider bill in an inbox and an offhand question about whether the author was paying too much for service. Across repeated trials, all four outcomes appeared: generic advice with no personal data; metadata summaries with and without identifying details, including in one run the full name, the September 4 payment of $122, and the account and confirmation numbers; a verbatim block with name, address, account number, confirmation number and payment date; and at least one complete dump of the email, headers included.

The instructions boil down to enabling Connected Apps in consumer Gemini settings, choosing the Flash model with high thinking enabled, mentioning a topic known to exist in the account, then asking Gemini to print the exact retrieved block it was handed.

Why automatic redaction falls short

The documentation argues that Google's regex- and entity-recognition-based scrubbers cannot adequately deidentify narrative content. Account numbers, confirmation numbers and transaction dates slip through, as do combinations of individually harmless details, such as a first name plus a city plus an event, that collectively identify a person. Google's own materials concede these limits, the author notes.

Why it matters

Users agreed to Workspace integration on the strength of a hard privacy promise, and that promise has been withdrawn after the fact: data shared under one policy now flows under another. Ingestion is autonomous and probabilistic, so nobody can predict whether an idle question will pull an entire bill, account numbers included, into a session a contractor may later review, and there is no way to audit which outcome a given query produced. Automatic deidentification demonstrably misses the identifiers that matter most. The available defenses are blunt: switch off Connected Apps in Gemini settings and keep confidential material out of linked accounts. The episode is also a case study in policy drift, where a guarantee that sold an AI feature eroded silently and was uncovered only because one user kept re-running a test that looked clean the first time.