Google

Google tracks nearly everything you do across its services.

What this means: Google collects an extremely broad range of behavioral data: every search you type, every video you watch, every ad you interact with, your purchase history, who you communicate with, and your browsing history across millions of third-party websites and apps that use Google services. This data is tied to your account and used to build a detailed profile of you. Even when you use Chrome's Incognito mode, third-party sites that embed Google services still send your activity to Google.

What you can do: Turn off Web & App Activity, YouTube History, and Search Services History in your Google Account settings. Regularly review and delete stored activity at myactivity.google.com.

Google collects your precise GPS location and uses it for ads.

What this means: Google can collect your precise GPS location, infer your location from Wi-Fi access points and cell towers, and combine this with your labeled home and work addresses. This precise location data is used to serve you location-targeted ads, not just to provide navigation features. The data can be stored in your account history depending on your settings.

What you can do: Turn off Location History and Timeline in your Google Account. Disable location permissions for Google apps in your device settings, and review saved home/work addresses in your Google Account.

Your data builds an ad profile used to target you everywhere.

What this means: Google builds an advertising profile from your searches, browsing history, location, and interactions with ads across its services and the millions of third-party sites that use Google's ad products. This profile is used to target you with personalized ads. While you can adjust some ad settings, the underlying data collection continues regardless.

What you can do: Visit My Ad Center (myadcenter.google.com) to turn off ad personalization. Note that this limits targeting but does not stop data collection.

Google tracks you on millions of non-Google sites, even in Incognito.

What this means: Even when you are not using a Google product directly, Google receives data about your browsing from the over 2 million websites and apps that embed Google Ads, Analytics, or other Google services. This tracking happens even in Chrome's Incognito mode, meaning the privacy protection many users assume they have does not apply to Google's own data collection.

What you can do: Use a browser extension like uBlock Origin to block Google trackers on third-party sites. Consider using a non-Google browser and search engine for sensitive browsing.

Google records audio before activation and humans may listen to it.

What this means: Google records audio starting a few seconds before you say "Hey Google," and human reviewers (including third-party service providers) may listen to samples of your saved audio to improve speech recognition. This means audio captured in your home or private spaces can be heard by Google employees or contractors.

What you can do: Disable the "Hey Google" / Voice Match feature in your Google Assistant settings. Review and delete your voice activity at myactivity.google.com under Voice & Audio Activity.

Some of your data is kept indefinitely, with vague exceptions.

What this means: Google retains some categories of data indefinitely — until you delete your account — and retains other data for unspecified "longer periods" for business or legal reasons even after you delete your account. The policy does not specify maximum retention periods for most data categories, making it impossible to know how long your information is actually kept.

What you can do: Enable auto-delete for activity data in your Google Account (you can set it to delete after 3 or 18 months). Periodically use Google Takeout to export your data and then delete it manually.

Using any Google service means you've agreed to all terms.

What this means: Simply visiting a Google service — even without signing in — constitutes legal agreement to Google's Terms of Service. You are bound by these terms without any affirmative click or acknowledgment. This means the terms can change and your continued use of any Google service binds you to the new version.

What you can do: Check Google's Terms of Service archive periodically for changes. If you disagree with updated terms, you must stop using all Google services to avoid being bound by them.

Google can change terms anytime; continued use means you agree.

What this means: Google can change its terms at any time for a wide range of reasons, including simply adding new features or services. While they promise advance notice for material changes, continued use of the service after changes are posted binds you to the new terms. Your only real option to reject new terms is to delete your account and stop using all Google services — a significant ask given how embedded Google is in daily life.

What you can do: Watch for emails or notifications about terms changes. If you disagree with a change, you must stop using all Google services and close your account before the effective date.

Google tracks your searches, purchases, contacts, and browsing across services.

What this means: Google tracks an enormous range of your activity across its own services and third-party websites and apps that use Google tools (like Google Analytics or Google Ads). This includes your searches, videos watched, purchases, who you communicate with, and your full Chrome browsing history if synced. This data is combined across services and devices to build a detailed profile of you.

What you can do: Visit your Google Account's 'Data & Privacy' section to review and pause activity controls, including Web & App Activity, YouTube History, and Location History. You can also use Chrome without syncing to limit browsing history collection.

Google's maximum payout to you for any harm is just $200.

What this means: No matter how badly Google's services fail you — including data loss, privacy breaches, or service outages — the maximum you can recover from Google is $200 or what you paid in the past year, whichever is higher. For free services, this means your maximum recovery is just $200, even if the harm you suffered is worth far more.

What you can do: Be aware that for high-stakes uses (e.g., storing critical business data), Google's liability cap means you should maintain independent backups and consider whether Google's services are appropriate for your needs.

Google uses publicly available content to train its AI models.

What this means: Google uses publicly available information — which can include content you've posted publicly online — to train its AI models including Gemini. If you've ever posted publicly on a platform indexed by Google, that content may have been used to train Google's AI systems. There is no opt-out mechanism described for this use.

What you can do: Limit what you post publicly online if you are concerned about AI training use. Review Google's AI principles page for any available controls, though the policy does not describe a specific opt-out.

Google can share your data with governments based on its own judgment.

What this means: Google can share your personal data with law enforcement or governments based on its own "good-faith belief" that it is necessary — not just when legally compelled by a court order. The standard of "reasonably necessary" gives Google broad discretion to disclose your data. Google does publish a Transparency Report showing aggregate request numbers, which provides some accountability.

What you can do: Review Google's Transparency Report to understand the volume of government data requests. For sensitive activities, consider services with stronger warrant-requirement policies.

Google lets ad partners track you directly using their own cookies.

What this means: Google allows its advertising partners — not just Google itself — to place their own tracking cookies and technologies on your browser when you use Google services. These third-party trackers operate under the partners' own privacy policies, not Google's, meaning Google's privacy commitments do not cover what those partners do with the data they collect.

What you can do: Use your browser's cookie controls or an ad blocker to limit third-party tracking. Review and manage third-party app access in your Google Account settings.

Your employer or school admin can read your emails and restrict your privacy.

What this means: If you use Google through a school or employer, your administrator has sweeping access to your account — including your emails — and can change your password, suspend your account, and block you from deleting your own data. This means your employer or school can read your Google Workspace emails and restrict your privacy controls.

What you can do: Use a personal Google account (not a work or school account) for private communications. Be aware that anything in a work or school Google account is accessible to your administrator.

Your activity across Google services is used to target you with ads.

What this means: Google uses your activity data collected across all its services — searches, YouTube views, app usage, and more — to serve you personalized ads. This is the core of Google's business model. While you can adjust ad personalization settings, the underlying data collection continues regardless.

What you can do: Visit My Ad Center (myadcenter.google.com) to turn off ad personalization. Note that you will still see ads; they just won't be personalized based on your tracked activity.

All disputes must be resolved in California courts, regardless of where you live.

What this means: All legal disputes with Google must be resolved in courts in Santa Clara County, California, under California law. If you live outside California — or outside the US — this means you would need to travel to California or hire California-based lawyers to pursue any legal claim against Google, which is a significant practical barrier for most users.

What you can do: Be aware that suing Google requires going to California courts. For small disputes, consider whether the cost is worth it; for larger issues, consult a lawyer familiar with cross-jurisdictional claims.

Google gets a broad, lasting license to use and modify your uploaded content.

What this means: When you upload content to Google services, you grant Google a worldwide, royalty-free license to host, reproduce, modify, distribute, and sublicense your content. Google can also use your publicly shared content (like reviews) in its own advertising and promotional materials. The license lasts as long as your content is protected by copyright, which can be decades.

What you can do: If you don't want Google using your public reviews or posts in promotions, avoid posting publicly on Google services. For private content, review your sharing settings carefully.

Google reads and stores the content of your emails and documents.

What this means: Google collects the actual content of your emails, documents, photos, and videos — not just metadata about them. This means the substance of your private communications and files is accessible to Google's automated systems. This content is analyzed to provide personalized services and ads.

What you can do: For sensitive communications, consider using end-to-end encrypted services that Google cannot read. Google does not offer end-to-end encryption for Gmail by default.

Google links your data across all devices and services into one profile.

What this means: Google links your activity across all its services (Search, YouTube, Gmail, Maps, etc.) and across all your devices to build a unified profile. This cross-device, cross-service tracking means Google can connect your phone searches to your laptop browsing and your YouTube habits to your Gmail account.

What you can do: In your Google Account settings, you can turn off 'Web & App Activity' and 'YouTube History' to limit cross-service data linking. Using Google services while signed out also reduces (but does not eliminate) cross-service tracking.

Google guarantees nothing about its services working correctly or accurately.

What this means: Google makes no guarantees that its services will work correctly, be available, or be accurate. If Google Search gives you wrong information, or Google Maps sends you the wrong way, Google bears no legal responsibility. This is especially important given how many people rely on Google for health, legal, and financial information.

What you can do: Do not rely solely on Google services for important decisions. Always verify critical information from authoritative sources, especially for medical, legal, or financial matters.

Google promises notice before reducing your rights in policy changes.

What this means: Google commits to not reducing your rights without explicit consent and to notifying you of significant changes. The policy archive (showing versions back to 1999) and comparison tools are genuinely useful transparency features. However, "significant" is not defined, and non-significant changes can take effect without direct notification.

What you can do: Subscribe to Google's policy update notifications and periodically check the policy archive at policies.google.com/privacy/archive to review what has changed.

Google offers self-service tools to export or delete all your data.

What this means: Google provides self-service tools to export all your data (Google Takeout) and to delete your account or specific data at any time. These are genuine, functional tools that give users meaningful control over their data, going beyond what many services offer.

What you can do: Use Google Takeout (takeout.google.com) to download a copy of all your data. Use My Activity to review and delete specific items without deleting your whole account.

Google won't target ads based on health, religion, or sexual orientation.

What this means: Google explicitly commits to not targeting ads based on sensitive categories like health, religion, or sexual orientation, and to not scanning the content of your Gmail, Drive, or Photos for ad targeting. Google also does not give advertisers your name or email address. These are meaningful protections that go beyond what many ad-supported services offer.

What you can do: These are protections Google provides by default — no action needed. However, remain aware that broad behavioral profiling still occurs outside these specific exclusions.

Google explicitly states it does not sell your personal data.

What this means: Google explicitly states it does not sell personal data and does not engage in the type of cross-context behavioral advertising that the CCPA defines as "sharing." This is a meaningful commitment, though Google's advertising business still involves extensive data use for targeting within its own ecosystem.

What you can do: No action needed for this specific protection. Be aware that while Google doesn't sell your data, it does use it extensively within its own advertising network.

Google can use your feedback and ideas without paying or crediting you.

What this means: Any feedback, suggestions, or ideas you submit to Google become Google's to use freely, with no compensation or credit owed to you. If Google builds a feature based on your suggestion, you have no claim to any benefit from that.

What you can do: Be aware that submitting feedback or feature suggestions to Google gives them free use of those ideas. If you have a commercially valuable idea, do not share it through Google's feedback channels.

Google provides a data export tool and advance notice before shutting down services.

What this means: Google commits to giving you advance notice before shutting down a service and provides Google Takeout as a tool to export your data. This is a meaningful user protection, as many services offer no such export mechanism when they discontinue products.

What you can do: Periodically use Google Takeout (takeout.google.com) to download a copy of your data from all Google services as a backup, regardless of any planned service changes.

Google won't use your health, religion, or Gmail content to target ads.

What this means: Google explicitly commits to not using sensitive personal categories (race, religion, sexual orientation, health) for ad targeting, and not using the content of your private files (Drive, Gmail, Photos) for ads. They also commit to not sharing your name or email with advertisers without your permission. These are meaningful protections compared to many other ad-supported platforms.

What you can do: These protections are built in and require no action. However, note that Google still uses a wide range of other behavioral data for ad targeting.