Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
Google asserts legitimate interests as the legal basis under GDPR and UK GDPR for processing user Gemini Apps data, including prompts, uploaded content, audio, video, and Connected Apps data, to train generative AI models and develop new machine learning technologies. This basis is applied to data from both publicly accessible sources and user-provided Gemini Apps information.
This analysis describes what Google Gemini's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision asserts legitimate interests as the legal basis for AI model training using a broad range of user data categories under EU and UK data protection law, which requires Google to demonstrate that this processing meets the GDPR balancing test. Compliance teams in the EU and UK should note that the breadth of data categories and the commercial nature of AI model development may be subject to regulatory scrutiny regarding whether legitimate interests genuinely outweigh data subject interests in this context.
Interpretive note: The adequacy of legitimate interests as a legal basis for commercial AI model training under GDPR is subject to ongoing regulatory interpretation and may vary by EU member state jurisdiction and supervisory authority.
The updated privacy notice establishes that Google collects data from third-party services you connect to Gemini, including Model Context Protocol server tools, and that such connections are not monitored or secured by Google. The notice explicitly states that choosing to connect third-party apps may expose your data, passwords, devices, and accounts to unauthorized access. The revised terms also clarify that you can use temporary chats, which are not retained for AI improvement purposes with human reviewer assistance. You can manage connected app permissions through Gemini Spark settings.
View change record →The updated notice adds new disclosure sections explaining how data flows when using Gemini Spark (remote browser and computer access), how avatar creation collects and processes information, and clarifies that Google collects information about AI reasoning steps during task execution. The notice also refines language around subscription information to specify 'Google AI plan' rather than just generic 'paid subscription.' These changes do not establish new obligations but rather expand the transparency disclosures provided to users about existing and new features.
View change record →The updated notice now explicitly identifies Memory as a feature that operates on the basis of user consent, alongside Voice Match. The revised language removes prior geographic restrictions on personalization, meaning Gemini can now reference chat history to generate personalized insights for all users globally, not just those outside the EEA, Switzerland, and the UK. The removal of the statement 'Keep Activity must be on to use this feature' simplifies the operational requirement but does not establish a new obligation. You can learn how to turn the Memory feature on or off through the updated privacy notice.
View change record →Under this clause, EU and UK users' Gemini Apps data, including chat content, uploads, and audio recordings, may be used for AI model training under the legitimate interests legal basis, which does not require user consent but does grant users the right to object to this processing. The agreement states that users may exercise their right to object to processing by submitting a request through the Google Help Center or directly in Gemini Apps.
Cross-platform context
See how other platforms handle GDPR Legal Bases for AI Model Training Under Legitimate Interests and similar clauses.
Compare across platforms →Monitoring
Google Gemini has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Google and third parties' legitimate interests with appropriate safeguards to protect your privacy. We process information from publicly accessible sources and your Gemini Apps information so that we can provide, maintain, improve, and develop Google products, services, and machine learning technologies. Processing this information for this purpose is necessary for the legitimate interests of Google and our users in: Providing, maintaining, and improving our services to meet the needs of our users (such as using chats to improve models and Gemini Apps' responses for safety and accuracy). Developing new products and features that are useful for our users (such as learning how to route requests to new models best suited to answer a particular question or training new models to handle these requests).Excerpt from Google Gemini's Gemini Apps Privacy Notice
1. REGULATORY LANDSCAPE: This provision directly implicates GDPR and UK GDPR legitimate interests provisions, enforced by EU national data protection authorities and the UK Information Commissioner's Office. The use of legitimate interests as a basis for commercial AI model training using user-generated content is an area of active regulatory attention across EU member states. Where legitimate interests are asserted, data subjects have a right to object under GDPR, and Google must demonstrate that its interests override data subject interests through a balancing test. 2. GOVERNANCE EXPOSURE: High. The assertion of legitimate interests for AI model training using a broad range of personal data categories, including sensitive content such as audio recordings, medical or financial information users may share in chats, and biometric voice data, creates significant regulatory exposure in the EU and UK. Several EU data protection authorities have scrutinized or are actively investigating legitimate interests claims for AI training purposes. 3. JURISDICTION FLAGS: EU member states and the UK create the highest exposure. Ireland (as the lead supervisory authority for Google Ireland Limited) is the primary competent authority under GDPR's one-stop-shop mechanism. Users in jurisdictions with stricter interpretations of legitimate interests, such as Germany or France, may face different outcomes in regulatory proceedings. 4. CONTRACT AND VENDOR IMPLICATIONS: Organizations operating under GDPR who use Gemini Apps and whose employees or customers interact with the service should assess whether Google's legitimate interests basis for AI training is consistent with their own data processing agreements and whether it requires disclosure in organizational privacy notices. 5. COMPLIANCE CONSIDERATIONS: Legal teams should assess whether the legitimate interests balancing test as applied by Google to AI model training satisfies regulatory expectations in each relevant jurisdiction. The right to object to processing under this basis should be implemented in user-facing procedures and documented in internal compliance records. Organizations should monitor regulatory developments regarding legitimate interests as a basis for AI training in the EU and UK.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision asserts legitimate interests as the legal basis for AI model training using a broad range of user data categories under EU and UK data protection law, which requires Google to demonstrate that this processing meets the GDPR balancing test. Compliance teams in the EU and UK should note that the breadth of data categories and the commercial nature …
Under this clause, EU and UK users' Gemini Apps data, including chat content, uploads, and audio recordings, may be used for AI model training under the legitimate interests legal basis, which does not require user consent but does grant users the right to object to this processing. The agreement states that users may exercise their right to object to processing …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Google Gemini.