For years, Google has maintained that personal content from Gmail, Google Drive and Google Photos wouldn’t be used to personalise advertising. That commitment now comes with an exception.
Following an update to its privacy policy on October 16, 2026, information from these services may contribute to advertising personalisation when users choose to connect them to certain Google experiences. The change is linked to Google’s AI-powered personalisation features, currently available to eligible users in markets including the US, but not yet available in the European Economic Area (EEA), the UK, Switzerland and Nigeria.
Google has made clear that these connections are optional. Still, the update raises a general question: What happens when the way a company uses our data changes over time?Ā
Companies evolve, products change, and new technologies create opportunities that didn’t exist before. That’s to be expected. But there’s a difference between changing how you do things and changing the principles behind them.
Data privacy, in particular, shouldn’t be subject to changing priorities.
A privacy commitment thatās evolving
The change means that information from Gmail, Google Drive and Google Photos may now be used to personalise advertising, provided users choose to connect these services to eligible Google experiences, including features such as Personal Intelligence.
Google says advertisers can’t directly access people’s emails, files or photos. But when users connect these services to eligible AI features, information from them may still influence the ads they see.
The change also reflects a broader development: AI is bringing personalisation and advertising closer together, creating new ways for companies to use the personal information people share with them.
As more services become interconnected, information shared for one purpose may, with the user’s permission, contribute to another. That makes transparency and meaningful control over personal data increasingly important.
Privacy settings matter, but so do the principles behind them
When people connect services to use an AI feature, it should be clear if information from those services may also be used to personalise advertising. Companies need to explain this upfront, rather than leaving people to work it out from privacy policies and settings.
Privacy settings give users some control over which services are connected and how their information is used. But finding the right settings, understanding what they cover and keeping up with changes can be difficult, especially as new features are introduced.
For organisations choosing technology providers, similar questions arise:
- How does the provider use customer data?Ā
- How much control do customers retain over their data?Ā
- And what happens if the provider changes its approach to privacy?Ā
When we trust a company with our data, we’re also trusting it to make responsible decisions about that data in the future.Ā
How a company approaches privacy today can tell us something about what to expect. That includes whether it considers privacy when developing new products, whether its business model depends on monetising personal data, and how much control people have over their information.
Privacy by design is an important part of this. It means building data protection into how technology is designed and operated from the start, rather than relying on people to manage their privacy through settings and permissions alone.
What does this mean for web analytics?
Google’s recent policy update isn’t a change to Google Analytics, but it raises questions that are relevant to any organisation choosing an analytics platform.
Web analytics helps organisations understand their audiences, improve digital experiences and make informed decisions. Yet the way an analytics provider handles data matters just as much as the insights it delivers.
It’s important for organisations to understand who owns their analytics data, where it’s stored, who can access it and whether it can be used for purposes beyond their own analytics. These considerations affect privacy, compliance and how much independence an organisation has from its technology providers.
Large, interconnected technology ecosystems offer clear advantages, particularly when services work seamlessly together. But when analytics, advertising and other services operate within the same ecosystem, it’s worth understanding how information is handled and what boundaries exist between them.
The business model behind a technology provider matters too. Understanding whether a provider generates revenue from software and services or from advertising can help organisations assess whether its commercial interests align with their expectations of how their data will be used.
Alongside features and reporting capabilities, it’s worth looking at how openly the provider communicates its data practices and how much control you’ll retain over your data as the platform evolves.
How Matomo approaches privacy and data ownership
Matomo’s products and technology have evolved over the years, but its approach to customer data has stayed consistent. Organisations own their analytics data and can choose to host it on their own infrastructure or use Matomo Cloud. Matomo doesn’t sell that data or use it to build advertising profiles.
As Matomo’s core software is open source, organisations can inspect how it works and adapt it to their needs when self-hosting. At the same time, teams have the analytics capabilities they need to track conversions, understand visitor behaviour and identify where people drop off along the customer journey.
Take control of your analytics dataĀ
With Matomo, you get powerful web analytics, 100% data ownership and the flexibility to decide how your data is hosted and managed.
