Editorial — October 17, 2026. AI assistants are becoming more useful by learning from the information we already keep in other services. That is also exactly why their privacy controls need to become dramatically simpler.
Google’s latest explanation of its generative-AI safeguards makes the tradeoff unusually concrete. In an October 16 update, the company notes that people can connect Workspace apps and other Google services to Gemini. Depending on account settings, a subset of the resulting interactions may be used to improve Google services and train generative-AI models, and a limited subset may be reviewed by humans.
That does not mean Google is simply pouring a person’s whole inbox or photo library into a training set. Its Personal Intelligence help page says it does not directly train on an entire Gmail inbox, Drive collection, Wallet history or Photos library. But summaries, excerpts, generated media and inferences can be used; for a short email or file, a summary may effectively include the whole item. That distinction matters, but it does not eliminate the underlying consent problem.
The problem is not one switch
Someone turning on a personalized assistant can potentially connect email, documents, calendar events, photos, videos, contacts, search history, location-related insights and payment information. Those sources do not all follow one master privacy control. Connected Apps settings, Gemini Apps Activity, Workspace smart features, Memory and the histories maintained by individual services can each affect what the assistant sees, remembers or uses.
That fragmentation creates a familiar kind of consent theatre. Each screen may be technically accurate, yet the person is left to assemble the real data flow from several menus and help pages. A setting called “Keep Activity” can influence model improvement. Disconnecting a source app stops future access, but it does not automatically remove related information already stored in Gemini Apps Activity. Deleting an email or photo at its source likewise does not necessarily delete the assistant-side activity record.
Google says it uses privacy protections, including efforts to remove or obscure personal information and, in some cases, differential privacy. Those safeguards are valuable. Still, technical protections and understandable consent solve different problems. A privacy-preserving training pipeline is not a substitute for a person being able to see—at a glance—what is connected, what is retained, what may be reviewed and what may improve a model.
Personalization needs a control centre
The right design is not another warning dialog. AI platforms need a unified privacy dashboard built around plain questions:
- Which services can this assistant read right now?
- Which conversations or derived summaries are stored?
- Can any of this material be reviewed by a person?
- Can it be used to improve products or train models?
- What will be deleted if I turn a connection off?
Each answer should sit beside its control, with one action to disconnect a service and remove the corresponding assistant activity where deletion is legally and technically possible. If some reviewed material must be retained in a de-identified form for safety or quality, the interface should say so before the user commits.
Platforms should also show a short, human-readable access log. “Gemini used your Calendar and Gmail to answer this question” is more useful than an abstract permission label. The same page should let a person narrow access by service, time period or task rather than making the only choices “everything” and “nothing.”
Useful does not have to mean opaque
Personal Intelligence is optional, availability varies by account and region, and people can keep it switched off. Those are important facts. But opt-in is only meaningful when the scope of the decision is easy to understand—and when changing one’s mind is just as easy.
This is bigger than one company. Every assistant that promises to understand a user’s life will face the same temptation: place data controls where engineers and lawyers expect them, then call the result informed consent. The better standard is a product a normal person can audit in under a minute.
AI personalization can be genuinely helpful. It should not require a privacy-settings audit to find out what the assistant learned along the way.
