Now Google says it might use your Gmail and Google Photos data to target ads
theverge.com240 points by JustSkyfall 5 hours ago
240 points by JustSkyfall 5 hours ago
> About DMA & your linked services
> The Digital Markets Act (DMA) is a European Union (EU) law that took effect on March 6, 2024. As a result of Article 5(2) of the DMA, in the EU, Google offers you the choice to link certain Google services.
> Those Google services include:
Search
YouTube
Ad services
Google Play
Chrome
Google Shopping
Google Maps
https://support.google.com/accounts/answer/14202510?hl=en
So at least European users will be able to get personalized search and photos results without also having to share that data for personalized ads.
I was told that regulation does not work and that I should vote with my wallet.
/s
PSA: Getting out of Google Photos is both easy and super rewarding if you can run Immich and use Google Takeout. It’s also better than Google Photos.
https://jaisenmathai.com/articles/my-ridiculously-robust-pho...
takeout rarely works. Usually fails partway through the export.
Export to google drive, use rclone to copy it out of google drive. Much, much more robust.
The multi-day wait while they prepare the takeout for download, though... I have forgotten about more takeout exports than I have actually downloaded.
Not my experience at all. As part of my job, I’ve used takeout to export the data from hundreds of accounts, with total sizes ranging from <1GB to >500GB, without any issues. I genuinely can’t remember a time that it has failed.
I can relate. I often have to try multiple times with ~800GB of data. I still want to get out though, if only to not reward bad Takeout experience.
I use Immmich plus Tailscale.
Chefs kiss
That's on my someday-list. Immich through its rootless-docker configuration impressed me, but I've still gotta get around to figuring how I can provide access to family members. (I mean, I could buy some suitable hardware that isn't my desktop, but prices these days, amirite?)
Immich is not heavy. I bought an old mini pc from a second hand government office supplies website and it runs all my self hosted apps perfect with tons of room to spare.
I think the main thing is storage speed matters which is why a mini pc with an ssd runs circles around a raspberry pi running off a microsd card.
I hosted Immich on an 8-year-old Intel NUC. It worked faster than Google Photos locally.
"might" === "absolutely will", just for the record.
No. You mean "we are already using, but before you notice..."
Oh absolutely. By the time it becomes "do you accept <terms>?" It's actually "we already did this, can you confirm your consent?"
If you say no, the secret is "we already did it".
They didn't allow unlimited cloud photo storage for all those years out of the goodness of their hearts.
That was all used as training data.
That was also the reason why Google Voice was created and still exists today. An unlimited supply of voice data.
If anything I am surprised they haven’t done this till now. When they gave no option to opt out of having our Gemini chats to not be used for training it was clear Google took a turn to be bold and aggressive about using user data. It was the sign to move away
I pulled all of my data out of google at the start of the AI boom because I just new google is so hungry for training data they will take anything they can get their hands on.
So far Immich + Tailscale has been a dream.
Since the comments are going to be flooded with people reactively assuming it is straight up directly accessing them, here is the actual qualification:
> [they will not use for ads] ... unless you choose to make data from these services available to other Google services that support personalized ads
So it is more reasonable than I think most people are assuming.
> unless you choose to make data from these services available to other Google services that support personalized ads
I don't know if android has changed in the last 10 years, but my last android phone had constant popups in official google apps begging me to enable all sorts of information sharing right across google's ecosystem. The popups were constant. And it was full of dark patterns making it difficult to say no.
Google probably assumes you only see this stuff once. But if you say no, some features didn't work properly and it keeps bugging you.
I don't know how or why, but I wouldn't be at all surprised if 90% of gmail users unintentionally opted themselves in to this "choice" before the end of the year.
The Google idea of consent is “Yes”, “Ask me again every day until it’s yes”
Even that is a lie, from the formerly Don't Be Evil company. "choose to" != "have to opt out in multiple places not to".
I believe the "other services" here includes Personal Intelligence, which Google is pushing very hard anytime you use their AI products directly. I would bet we'll see nudges in more and places. Basically, they want to make it happen.
To be fair, I see where they're coming from: if they're providing you (what they consider) valuable AI services, they would want to monetize it somehow, because that inference ain't free. And people won't pay for it with their money, because they've trained this generation of Internet users to pay with their attention.
I also suspect they have little choice, because they foresee that the old search modality (and with it, their prized cash cow) withering away pretty soon. Personal Intelligence may well be their next big consumer cash cow, and competitors are already swooping in to try to capture that market (especially Apple with its privacy pitch.)
You literally can't do anything useful with Gemini (as a Google Assistant replacement) without granting it access to everything. And I mean that in the most literal sense possible. It doesn't know the weather, the time, it can't play music, nothing.
Taken in the most literal sense possible, if you're using Gemini in any capacity today, it's authorized to use your photos to serve you personalized ads.
The most charitable interpretation is that gemini might get your pictures as context by connecting google photos, then comment on the content of said pictures in its output, and then the output is used to personalize ads (like what chatgpt is doing rn). This indirectly uses google photos data to personalize ads so they have to add this rule to their privacy policy.
> unless you choose to make data from these services available to other Google services that support personalized ads
Yeah.. And how do you not do that? What are the steps to not make the data from these services available? Is it now? How can we tell? What are the services that support personalized ads anyway? All of them?
I don’t see how it’s more reasonable. Google constantly nags you to accept terms and conditions to get things to work.
Most likely you will agree to share it with “other Google services” just by setting up an Android phone.
which is /opt out/ - Several opt outs in fact. Which would also disable most of gmail features, in particular spam filtering and categorization.
i know because i went through this.
I think that's a much lower bar than you are assuming. It's part of their playbook to tie very basic features and integrations with these more controversial measures -- I believe that "make calendar entries from flight confirmations" is on by default and is part of their "share my data with other services" toggle. "Declining to opt out" could also count to them as choosing to make the data available. etc.
Why the attempt to whitewash Google here?
Also, I do not see how it is "reasonable". I find it evil and malicious. They benefit from user's data, get money and don't give anything to those who gave them their data here. That is also selfish from Google.
As jon said, it is a frew service. Someone, somehow needs to pay for the service, bwing through something as bad as ads from your photos. We as consumers just need to be more comfortable paying a little to have these services. Immich on a vps is not that much
Not defending Google in any way, but… they did give free email, search, and other things.
The slight is that they said they wouldn’t and people trusted that would remain true. Then some moral-less, scum sucking, soulless PM convinced enough people they could make money to justify snooping on hundreds of millions of people’s private conversations and enough of those people agreed to make it happen.
Google PMs catching strays lol.
Is it that easy at these companies to change policies like these?
All I can add is that I'm very glad that I've no Google accounts nor use its services even though I've an Android phone.
You are also very lucky. There are countries where all mainstream banks (i.e. the ones that can give you the whole range of everyday banking services) require an app from Play Store, with Play Services as a hard dependency to even launch, for online banking.
e/OS uses mircoG to make 98% of those bank apps work, GrapheneOS uses a sandbox for them.
MicroG downloads code from Google and runs it unsandboxed (which is why GrapheneOS devs criticize MicroG so). That counts as using Google services. And even if GrapheneOS sandboxes Play Services, getting and running one's apps that way still counts as using Google services.
Yeah, one of my main points of contact was a gmail address for a number of years. I've switched over to giving out an address on a domain I own but it's a huge pain migrating contacts over.
I hope the younger folks learn better the lesson to own your nameplate - even if you just end up forwarding message to gmail or what-not for consumption, keeping control of the nameplate gives you the flexibility to shift later on.
> I've switched over to giving out an address on a domain I own
Recently some Discord channel started using some other weird "verifier" bot plugin thing and they refuse, claiming my long-time personal domain is "high risk" for no discernible reason.
I'm scared of a future where you have to be in the positively good graces of 4-6 email/SSO monopolies to avoid becoming a digital nonperson.
> Google won’t show you ads based on sensitive categories like race, sexual orientation, religion, or health.
Conspicuously absent from the "sensitive categories" is political leanings...
In the future political leanings won't be used for ads. They will be used for something far worse.
They weren't already?!
when gmail launched in 2004, they did indeed target ads based on email content. People did not like it. Apparently in 2017 they ended "the practice." But now, about 10 years later, it's back?
https://privacyrights.org/resources-tools/archives/googles-n...
https://www.securityweek.com/google-stops-scanning-gmail-con...
Ente Photos is the best alternative imo. It's super polished, lets you self-host, and is E2EE.
If you self host, why does it matter if it is E2E? What's your threat model?
What you need is encryption at rest yes?
I just assume that everything you put into Google is used for ads.
Jokes on them, I don't see ads anymore. I even have ads stripped out of podcasts I listen to.
Curious - how, if I may ask?
Can't speak for the parent, but they may be using: https://github.com/podly-pure-podcasts/podly_pure_podcasts . I couldn't figure out how to get that working on Windows so I rolled my own: podcast-dl + parakeet + Gemini.
Google privacy policy is an absolute joke so this is hardly surprising. Pretty much everything gets used for model training. It’s hard to find options that respect your privacy without studying 50 support docs pages. Plus they conflate anonymization with privacy, as if ripping off someone’s data becomes OK as long as you … take their name off em
The implication here is that all your emails in GMail will be thoroughly analysed by LLMs.
I've noticed now that google is cf negative, search might as well be called google billboard. they are admaxxing everything for as much rev as possible. its terrible, and i often use perplexity and chat in lieu of google search. as a matter of fact i find perplexity often produces much better results.
I am extremely surprised, because I thought Google was already doing that.
Advertising is the root of all evil.
Driver of overconsumption.
Keeping us hooked on social media feeds.
Targeting children, making them use addictive products.
Making everything more expensive (because we are paying for the ads eventually).
Collecting our data.
Sometimes allowing malware to be installed on our systems.
Frustrating the idea that the best product should win; instread the one with the biggest advertising budget wins.
...
I don’t mind the occasional Burma Shave type ad, or this program brought to by Acme Brand Powdered Soap.
Anything that stalks, snoops, tracks, profiles, personifies, “shares”, coerces, scams, scans, or sells any of the aforementioned should be illegal and considered with broad definitions. Minimally jail time for destroying generations of culture.
Right, there's this implied old bargain, and then there's this new stuff which tries to get consumers to pretend nothing changed while violating the old rules willy-nilly.
100%
That's why I go to a lot of effort to block as much of it as possible for myself and my family, and to some extent, extended family and friends.
Advertising is a gross perversion of 'service' and a symptom of Uber-capitalism. It is psychological manipulation.
Gmail has already been targeted from day 1!
But then they stopped cause the marginal value of the information they got from gmail was not as large as it used to be. The information from email receipts from purchases was particularly valuable but major retailers stopped providing that in email to limit how much info google could observe.
> but major retailers stopped providing that in email to limit how much info google could observe.
What makes you believe that was their motivation?
I think we'd be remiss not to consider general changes in the security landscape: E-mails are not encrypted the same way HTTPS visits are, and from a compliance standpoint it's easier to argue that you did your due-diligence, only showing the information to the authorized person.
In other words, I'd expect the trend to happen regardless of whether Google (or any other company) started spying on customer data for a competitive advantage.
Here's an idea: Targeted ads against workers of companies who buy digital ads. Drown them in content with influencers showing that digital ads have awful returns, and frankly, only people with small genitals decide to buy campaigns.
You do realize all companies, including the most "moral" companies advertise - like Apple?
You've gotta be able to actually show me ads before you can target me with ads.
Another reason to throw on the pile of needing to setup a new domain to self-host email on, properly planned with 'alias per login' etc.
I'm not sure if the pile is big enough yet to make me do it, but it's getting there.
I might have to have two domains, one for critical communications and logins (banking, finances, tax, etc) and another for all those bullshit web sign ups. Ironically, it's the critical one I'd have to setup 9n a centralised SaaS (and therefore prone to such shenanigans as Google is proposing) in order to make sure communications don't get lost. Having said that, my current Google-hosted domain is free, and so it's likely been used for advertising and AI training already.
targeted ads are fine if they are actually relevant
I dumped Google years ago because I saw this, among other enshitification, was inevitable. Never looked back. Life is good.
What do you use for email?
Buy a domain, then you don’t lose your address if you ever decide to jump to a different provider. I use fastmail currently. But I also keep my own backups.
It's basically impossible to not use gmail. Even if you don't have a gmail account or address yourself, the person you're emailing probably has it, so your messages gets sent to a gmail server and gets scanned by them. What I want to know is whether Google uses the contents to profile YOU.
GMail has a 25-30% share of the client market.
Is it impractical to never send a message through Google? Probably, depending on the circles you communicate in. But that's not the same thing as saying it's impractical to avoid Google for most of your messages, and certainly not the same as saying you can't avoid GMail for anything.
My main email is not GMail, but I forward it to a GMail account to get free spam filtering, free backup, and free search. I encourage everyone to do the same.
You don't get spam if you use aliases everywhere. The few that actually get spam can be turned off.
Like I recently had to turn off alias for made4men.no. srsly, signing me up for spam and not removing me from the spam list even after i unsubscribed. You can tell it's a swedish shop that just happens to own a Norwegian domain.
I actually had to do the opposite. I have a filter that catches all messages marked as spam and unmarks them as spam. VERY rarely there's a spam message caught in there. Much more often sth super important that just would have landed in spam if not for my genius spam filter.
This is a self-fulfilling prophecy. If everyone reads "it's impossible to avoid gmail, just use gmail", then yeah, gmail prevails.
But it's plain false. YOU can decide against using gmail. I don't use gmail. I sometimes talk with people who use gmail, but more often than not, I don't. Stop being fatalistic.
I think they are being more factual than fatalistic. You just differ by definition of “use Gmail”.
They are saying you are using Gmail when you communicate with someone on Gmail.
Get your own domain, then you're free to change provider every 2 months and nobody will realise :-).
Then you can try Migadu, Fastmail, Protonmail, Tuta, ... once you own your address (say me@noncoml.com), people won't ever know what provider you are running behind.
ProtonMail, FastMail, self-hosted...
If I could use ProtonMail with my mail client without a weird bridge application, I would have switched a long time ago.
Why not standardize on a single solution instead of maintaining your own stack AND paying for someone else to do the work?
Runbox with my own domain (which I've had since 1999). Support is great, prices are reasonable.
Purelymail. Really cheap, just works and doesn’t get in my way.
I've been on Purelymail since last December and I can't recommend it enough. It does exactly what I want in the way I expect it to.
I'm using Proton. Never had an issue with them.
Do you emails land on the inbox when the recipient is on gmail? Or do they go to spam?
Friendly reminder when you click a link in a Gmail message, Google's servers also make a separate HTTP request for that link.
For your safety I'm sure.
All of this so predictable and so disappointing. But there’s nothing to do but accept it.
As if it did not for all those years.
srsly ppl
So? what's the harm? At least I'll see targeted ads; ads that I would actually care about and not random ads. Yeah, these big tech companies track us. It's old now. When the product is free, you are the product. Same old, same old. Tell me something new.
The enshitification of Google is inevitable. It went from all the space you ever need for your email to "you are at 93% usage. Upgrade to premium" in just a few years.
Well, if we didn't have corrupt regulators, Google would have been fined out of existence ages ago.
That said it will be interesting way of exploitation. If you want to find people who have certain email content, you can serve them ads manipulating them into taking an action. Like buying a scam product / malware.
Anyone surprised?
Evil has a name. It begins with 'G' and ends with 'oogle'.
Hopefully you folks don't share information that is or was critical to your business or family there. Big Brother may be watching. The name is also Google.
There is so much information you shared there, if you used it, that can be used for AI sniffing. This is the new future.
Awesome.
Most of my photos (hundreds and hundreds of them) from the past week are of shitty untidy black spaghetti network racks that are completely beyond all saving and frankly require the building to be flattened and everything rebuilt from scratch.
So if this can help a company find a way to advertise a clean and humane way of solving this problem that doesn't involve me tracking down and deep frying the network engineer that left this unholy mess, then quite frankly I'm all for it any my cash is waiting.
Google's always done this, it's the entire reason Gmail exists. Now they're just saying it.
This isn’t true and this level of cynicism is really unhelpful.
They originally used Gmail in that way. Many years later they stopped. This was a major victory for privacy. The fact they seem to be doing it now again is bad. Saying they’ve “always done this” is the kind of empty conspiratorial cynicism that dampens action and makes people feel it is futile to notice these changes or speak up about them.
The fact that they did it in the beginning and are doing it now makes the whole “well, there was a period of time when they didn’t do this” seem like a minor footnote to the notion that “they’ve always done this”. Even though the statement isn’t strictly true, it sure seems like the cynicism is warranted now and, with the benefit of hindsight, was back then too.
Giving up (aka cynicism) is easy.
On the contrary, it seems like giving up Google is hard for many people.
What's the evidence they stopped?
Information meta has on me - instagram reel viewing data
Information google has on me - my entire life
Yet meta ads are far more eerily relevant. This could imply two things -
a) Meta’s recommendation team is exponentially better (unlikely)
b) Google doesn’t use gmail and workspace data for ads
Meta tracks you on every page that has any Meta script, such as a Facebook like button. They're just better at tracking than Google is, amazingly, because meta plays dirtier.
I don’t think it’s conspiratorial to question how strong the firewall was between your Gmail content and Google’s algorithms. Whether or not they actually leveraged that understanding for targeted ads is somewhat beside the point.
"might"
Now Google says that it has no values, no respect, and no fear.