Google asserts legitimate interests as the legal basis under GDPR and UK GDPR for processing user Gemini Apps data, including prompts, uploaded content, audio, video, and Connected Apps data, to train generative AI models and develop new machine learning technologies. This basis is applied to data from both publicly accessible sources and user-provided Gemini Apps information.
This analysis describes what Google Gemini's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision asserts legitimate interests as the legal basis for AI model training using a broad range of user data categories under EU and UK data protection law, which requires Google to demonstrate that this processing meets the GDPR balancing test. Compliance teams in the EU and UK should note that the breadth of data categories and the commercial nature of AI model development may be subject to regulatory scrutiny regarding whether legitimate interests genuinely outweigh data subject interests in this context.
Interpretive note: The adequacy of legitimate interests as a legal basis for commercial AI model training under GDPR is subject to ongoing regulatory interpretation and may vary by EU member state jurisdiction and supervisory authority.
The updated privacy notice establishes that Google collects data from third-party services you connect to Gemini, including Model Context Protocol server tools, and that such connections are not monitored or secured by Google. The notice explicitly states that choosing to connect third-party apps may expose your data, passwords, devices, and accounts to unauthorized access. The revised terms also clarify that you can use temporary chats, which are not retained for AI improvement purposes with human reviewer assistance. You can manage connected app permissions through Gemini Spark settings.
View change record →The updated notice adds new disclosure sections explaining how data flows when using Gemini Spark (remote browser and computer access), how avatar creation collects and processes information, and clarifies that Google collects information about AI reasoning steps during task execution. The notice also refines language around subscription information to specify 'Google AI plan' rather than just generic 'paid subscription.' These changes do not establish new obligations but rather expand the transparency disclosures provided to users about existing and new features.
View change record →The updated notice now explicitly identifies Memory as a feature that operates on the basis of user consent, alongside Voice Match. The revised language removes prior geographic restrictions on personalization, meaning Gemini can now reference chat history to generate personalized insights for all users globally, not just those outside the EEA, Switzerland, and the UK. The removal of the statement 'Keep Activity must be on to use this feature' simplifies the operational requirement but does not establish a new obligation. You can learn how to turn the Memory feature on or off through the updated privacy notice.
View change record →This new provision establishes legal framework for processing under GDPR's legitimate interests basis for AI training, potentially limiting user control by characterizing data processing as legitimately justified.
View full change record →Under this clause, EU and UK users' Gemini Apps data, including chat content, uploads, and audio recordings, may be used for AI model training under the legitimate interests legal basis, which does not require user consent but does grant users the right to object to this processing. The agreement states that users may exercise their right to object to processing by submitting a request through the Google Help Center or directly in Gemini Apps.
Cross-platform context
See how other platforms handle GDPR Legal Bases for AI Model Training Under Legitimate Interests and similar clauses.
Compare across platforms →"Google and third parties' legitimate interests with appropriate safeguards to protect your privacy. We process information from publicly accessible sources and your Gemini Apps information so that we can provide, maintain, improve, and develop Google products, services, and machine learning technologies. Processing this information for this purpose is necessary for the legitimate interests of Google and our users in: Providing, maintaining, and improving our services to meet the needs of our users (such as using chats to improve models and Gemini Apps' responses for safety and accuracy). Developing new products and features that are useful for our users (such as learning how to route requests to new models best suited to answer a particular question or training new models to handle these requests).Excerpt from Google Gemini's Gemini Apps Privacy Notice
1.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision asserts legitimate interests as the legal basis for AI model training using a broad range of user data categories under EU and UK data protection law, which requires Google to demonstrate that this processing meets the GDPR balancing test. Compliance teams in the EU and UK should note that the breadth of data categories and the commercial nature …
Under this clause, EU and UK users' Gemini Apps data, including chat content, uploads, and audio recordings, may be used for AI model training under the legitimate interests legal basis, which does not require user consent but does grant users the right to object to this processing. The agreement states that users may exercise their right to object to processing …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Google Gemini.