The policy states that health information provided by users in the context of services such as Google Health Studies, Fitbit, and Pixel devices is processed under consent as required by the Washington My Health My Data Act and Nevada SB 370, and that users may withdraw this consent.
This analysis describes what Google's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that Google relies on user consent as the processing basis for health information under specific state health privacy statutes, and that consent withdrawal is available, creating a specific operational mechanism for health data opt-out distinct from general advertising controls.
The updated policy establishes a new opt-in mechanism that allows Google services like Search and Gemini to access data from other Google services you use, including Gmail, Google Photos, and Drive, to personalize your experience and show you targeted ads. Previously, Google's policy stated it did not show personalized ads based on content from these services. Under the revised terms, if you choose to enable this feature, Google may use data from Gmail, Photos, and Drive to personalize ads and content, including through a feature called Personal Intelligence. You can manage this through your Google account settings to control which services can access data from other services.
View change record →Google's Privacy Policy now gives an effective date of October 1, 2026, replacing May 26, 2026. One passage changed. It covers information Google collects when you are not signed in, which it stores with identifiers tied to your browser, app or device. The policy previously said this lets Google show more relevant search results or ads “based on your activity”; it now says “based on your activity across devices.”
View change record →The updated policy explicitly discloses that Google collects data when you are signed out and stores it with unique identifiers tied to your browser, application, or device. The policy also expands the types of activity it collects to include 'media (like images, files, audio and video) from your interactions,' in addition to previously listed categories. The revised language reorganizes privacy controls into 'Search Services History' and 'Web & App Activity,' and clarifies that depending on your settings, activity from services like Search, Maps, and Shopping is saved as history to your Google Account. You can manage these settings through your Google Account privacy controls, including the ability to turn off Web & App Activity or adjust Personalized Recommendations in Search services.
View change record →⚠ Health information will continue to be processed under the stated consent basis as described in the policy unless consent is withdrawn.
Cross-platform context
See how other platforms handle Health Data Processing and Consent Under State Health Privacy Laws and similar clauses.
Compare across platforms →"The Washington My Health My Data Act and Nevada Senate Bill 370 provide specific rights in addition to those rights above, that apply to health information. When you provide health information subject to these laws, Google processes it with your consent, which you may withdraw, or as otherwise permitted by these laws.Excerpt from Google's Privacy Policy
1) REGULATORY LANDSCAPE: This provision directly engages the Washington My Health My Data Act, which applies broadly to consumer health data collected by non-HIPAA entities, and Nevada SB 370, which imposes similar consent-based requirements.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
This provision establishes that Google relies on user consent as the processing basis for health information under specific state health privacy statutes, and that consent withdrawal is available, creating a specific operational mechanism for health data opt-out distinct from general advertising controls.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Google.