Google's Privacy Policy is one of the most consequential legal documents most people will never read. It governs data collection across Search, Gmail, YouTube, Maps, Google Drive, Android, and every website running Google Analytics or Google Ads. ConductAtlas has archived and analyzed every provision. Here is what it says.
Google combines data across every service you use
The most significant provision in Google's Privacy Policy is the cross-service data combination clause. Google takes data from everything you do across all its products and combines it into a single profile. Your search queries, email content, YouTube watch history, location timeline, calendar events, and browsing behavior on third-party sites are all connected.
That combined profile is used primarily for advertising. When you see a targeted ad on a website that has nothing to do with Google, that targeting is often powered by data Google collected across its entire ecosystem. This applies even when you are not actively using a Google product.
For compliance teams: this provision has significant implications under GDPR Article 6 lawful basis requirements. Cross-service data combination for advertising purposes requires either explicit consent or a legitimate interests assessment. EU and UK users have stronger rights to object to this processing than US users.
Google stores a precise record of everywhere you have been
When location settings are enabled on Android or in Google apps, Google collects your precise GPS coordinates and stores them as a Location History timeline. This is a detailed log of every place you have visited, how long you stayed, and how you traveled between locations.
Location History is used to personalize search results, improve Maps, and target location-based advertising. It is also accessible to law enforcement through legal process. Google has received hundreds of thousands of government data requests and complies with the majority.
You can review and delete your Location History through Google's My Activity dashboard at myactivity.google.com. Deletion is not instantaneous and some derived data may persist in Google's systems after the raw location data is removed.
Google records your voice
When you use voice features in Google products, including Hey Google on Android, Google Home devices, and voice search, Google collects and stores recordings of your voice. These recordings are used to improve speech recognition and can be reviewed through My Activity.
Voice data is among the most sensitive personal information Google collects. Unlike location data, voice recordings can capture conversations, background audio, and information about people who are not Google users. The Privacy Policy authorizes this collection for anyone in range of a Google-enabled device with voice features active.
Google tracks you across the internet, not just on Google properties
Google operates the largest advertising network on the internet. Through Google Ads, AdSense, and Google Analytics, Google has tracking infrastructure on the majority of websites. When you visit a site running these tools, Google records your visit even if you never interact with a Google product directly.
This cross-site tracking is separate from your Google account activity. It builds a behavioral profile based on your browsing habits across thousands of websites. Combined with your signed-in Google account data, this gives Google a comprehensive view of your online behavior.
What GDPR and CCPA give you
If you are in the EU or UK, GDPR gives you the right to access your data, request deletion, object to processing for advertising purposes, and request data portability. Google provides tools for all of these through its account settings and the My Activity dashboard.
If you are in California, CCPA gives you the right to know what data is collected, request deletion, and opt out of the sale of your personal information. Google's Privacy Policy includes a Do Not Sell My Personal Information option for California residents.
For users outside these jurisdictions, rights are more limited. Google's default data practices apply unless you actively adjust your account settings.
What to actually do
The most effective steps to limit Google's data collection: turn off Location History in your Google Account settings, review and delete your My Activity data regularly, and opt out of ad personalization at adssettings.google.com. None of these steps stop data collection entirely, but they significantly reduce what Google retains and uses for advertising.
ConductAtlas tracks every version of Google's Privacy Policy with full change history, provision-level analysis, and regulatory exposure mapping. If Google updates its Privacy Policy, we flag it the same day.