Mail you haven't received

Not seen by human reviewers. That was the promise in Google's 2023 post on generative-AI guardrails: use the Workspace extensions in Bard, and your Gmail, Docs and Drive content would not be seen by human reviewers, used to show you ads, or used to train the model. The sentence is still there. Behind it now sits a parenthetical dated October 16, 2026: data from connected Workspace apps can train generative models, depending on your settings, and "can also be subject to human review in limited circumstances."

A write-up that drew 648 points on Hacker News on Monday documents the change and tests it on a personal Gmail account. Its author, with Connected Apps on and no @Gmail tag, asked Gemini, "I wonder if I'm paying too much for internet service." Across repeated trials the answers ranged from generic advice to the provider's bill with the account holder's name, account number and confirmation number, and, once, the entire email with its headers. Google's help page carries the line that matters:

That sentence is the whole change. A promise about the system has become an instruction to the user, and it is an instruction nobody can follow. Connected Apps is granted per app, not per message, and Gmail is the app. The same help page adds that "if new data is added to these apps in the future, Gemini will have access to that data." Confidential information isn't an exception in an inbox. It's what an inbox is for.

You don't aim the retrieval, either. Google's own example: ask Gemini to plan restaurants for an upcoming trip, and "our models might review your emails" for the hotel reservation and flight itinerary. The internet-bill test is the same mechanism pointed at a bill. You choose the topic of a sentence; the model chooses which mail answers it. And what reaches review, per Google, is "summaries, excerpts and inferences" from relevant emails and files, with a caveat: where the email or file is "brief or particularly relevant," the summary "may just be the email or file." A utility bill is brief. So is a wire confirmation. So is a lab result. To obey the warning, you have to vet an inbox, including mail you haven't received yet, against a reviewer you'll never see.

To obey the warning, you have to vet an inbox, including mail you haven't received yet, against a reviewer you'll never see.

The fair defense is that Google disclosed all of this in plain language, and that having trained reviewers grade a subset of answers is how every lab finds out where its model is wrong. Grant it. Disclosure beats silence, and the controls are real: disconnect an app, turn off Keep Activity, delete your history. But read the clause attached to the last one. Deleting your activity keeps it out of future product improvement "unless it has already been reviewed by trained reviewers." Deletion works on what nobody has seen yet. Review is the step it can't undo, so the only control that protects you is the one you apply before your first casual question. That control is the warning, and it puts you back to vetting the inbox.

One detail in the write-up sharpens the point. All of this applies to consumer accounts. Workspace Business, Enterprise and Education accounts, according to the write-up, run under data-processing terms that exclude human review by default. The 2023 promise didn't disappear. It moved into a contract, and the people still holding it are the ones paying for it.

A promise is something the company keeps. A warning is something you keep. Since October 16, keeping your Gmail out of human review has been your job.