When you use Gemini extensions connected to third-party services, your conversation content may be passed to those third parties, who handle it under their own separate privacy policies.
This analysis describes what Google Gemini's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The terms authorize sharing of conversation content with third-party extension providers, whose data practices are governed by their own policies rather than Google's, meaning users interacting with extensions should review each third party's privacy terms.
The updated privacy notice establishes that Google collects data from third-party services you connect to Gemini, including Model Context Protocol server tools, and that such connections are not monitored or secured by Google. The notice explicitly states that choosing to connect third-party apps may expose your data, passwords, devices, and accounts to unauthorized access. The revised terms also clarify that you can use temporary chats, which are not retained for AI improvement purposes with human reviewer assistance. You can manage connected app permissions through Gemini Spark settings.
View change record →The updated notice adds new disclosure sections explaining how data flows when using Gemini Spark (remote browser and computer access), how avatar creation collects and processes information, and clarifies that Google collects information about AI reasoning steps during task execution. The notice also refines language around subscription information to specify 'Google AI plan' rather than just generic 'paid subscription.' These changes do not establish new obligations but rather expand the transparency disclosures provided to users about existing and new features.
View change record →The updated notice now explicitly identifies Memory as a feature that operates on the basis of user consent, alongside Voice Match. The revised language removes prior geographic restrictions on personalization, meaning Gemini can now reference chat history to generate personalized insights for all users globally, not just those outside the EEA, Switzerland, and the UK. The removal of the statement 'Keep Activity must be on to use this feature' simplifies the operational requirement but does not establish a new obligation. You can learn how to turn the Memory feature on or off through the updated privacy notice.
View change record →Renamed from 'Third-Party Extension Data Sharing' and severity downgraded from high to medium; now clarifies that third parties have their own privacy policies governing data handling.
View full change record →If you enable Gemini extensions, conversation data may be shared with those third-party services, and Google's privacy protections do not extend to how those parties handle your data. Users should review the privacy policies of any third-party extensions they enable.
How other platforms handle this
We will also provide an individual opt-out choice, or opt-in for sensitive data, before we share your data with third parties other than our agents, or before we use it for a purpose other than which it was originally collected.
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
"If you use extensions in Gemini apps, your conversations may be shared with the third-party services you interact with through those extensions. Those third-party services have their own privacy policies that govern how they handle your data.Excerpt from Google Gemini's Gemini Apps Privacy Notice
REGULATORY LANDSCAPE: Third-party data sharing through extensions implicates GDPR Article 26 (joint controllers) or Article 28 (processor obligations) depending on the role of the third party, as well as CCPA provisions regarding disclosure of data …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The terms authorize sharing of conversation content with third-party extension providers, whose data practices are governed by their own policies rather than Google's, meaning users interacting with extensions should review each third party's privacy terms.
If you enable Gemini extensions, conversation data may be shared with those third-party services, and Google's privacy protections do not extend to how those parties handle your data. Users should review the privacy policies of any third-party extensions they enable.
ConductAtlas has identified this type of provision across 289 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Google Gemini.