DentroChat

Google LLC (policies.google.com) Privacy policy — 65/100 (Medium privacy risk)

Last analyzed

Run a new analysis on another policy

Google LLC · google.com

Report details

Medium privacy risk

Google’s privacy policy is transparent about its vast data collection and sharing practices but raises significant concerns for EU users due to extensive cross-service data use, third-party sharing, and international transfers.

Google’s Privacy Policy details extensive data collection across its ecosystem (e.g., Search, YouTube, Android, Gmail), including personal information, activity logs, location data, and device identifiers. While it offers granular user controls (e.g., My Activity, Ad Settings) and clear descriptions of GDPR rights (access, deletion, portability), it also engages in broad data sharing with affiliates, third-party partners, and for legal/abuse prevention purposes. International data transfers are acknowledged, with reliance on frameworks like SCCs, but the policy lacks explicit guarantees of EU-only processing. AI/model training is implied (e.g., for Google Translate, Gemini) but lacks opt-out clarity. The policy is comprehensive but complex, with gaps in minimizing data collection and limiting transfers outside the EEA.

Last analyzed
SourceURL

Category Assessment

Breakdown of the policy across key compliance areas. Good = strong, fair = mixed, poor = concerning.

Data MinimizationPoor

Collects vast amounts of data (e.g., search terms, location, device IDs, activity across third-party sites) far beyond what is strictly necessary for core services, with limited evidence of proportionality.

TransparencyGood

The policy is highly detailed, with clear sections on data types, purposes, sharing, and user rights, though its length and complexity may overwhelm average users.

Third-party SharingPoor

Shares data extensively with affiliates, service providers, advertisers, and partners (e.g., for ads, analytics, and content moderation), often without explicit user consent for each transfer.

International TransfersPoor

Data is processed globally, including in the US, with reliance on SCCs and other frameworks, but no guarantee of EU-only storage or processing for all data types.

AI/Model TrainingFair

Uses public/partner data (e.g., from Search, YouTube) for AI training (e.g., Translate, Gemini) but lacks clear opt-out mechanisms or explicit consent for this purpose.

User RightsGood

Clearly describes GDPR rights (access, deletion, portability, objection) and provides tools (e.g., My Activity, Takeout) to exercise them, though some rights (e.g., objection to legitimate interest) may be limited in practice.

Key Findings

Notable clauses, issues, or positive practices discovered (critical first)

Critical

Excessive data collection and cross-service integration

The policy states Google collects data from 'apps, browsers, and devices' (e.g., IP addresses, crash reports, unique identifiers) and links it across services (e.g., Search, YouTube, Gmail) for personalization and ads. Section 'Information we collect as you use our services' and 'use the information we collect across our services' confirm this broad scope, which conflicts with GDPR’s data minimization principle (Article 5(1)(c)).

Critical

Ambiguous AI/model training opt-outs

Under 'publicly accessible sources', Google admits using public data to 'train Google’s AI models' (e.g., for Translate, Gemini). However, there is no explicit opt-out for users whose data is included in training datasets, nor clarity on whether user-generated content (e.g., emails, photos) is used. This raises concerns under GDPR Article 22 (automated decision-making) and lack of consent for secondary processing.

Critical

International transfers without EU-only guarantees

The 'Data transfers' section acknowledges data may be processed on servers worldwide, including outside the EEA, and relies on 'legal frameworks' (e.g., SCCs). However, it does not guarantee EU-only processing or binding corporate rules (BCRs) for all data types, leaving transfers to the US (a non-adequate jurisdiction) as a high-risk practice under Schrems II and GDPR Chapter V.

Warning

Third-party sharing for ads and analytics

The policy explicitly states Google shares non-personal data with 'publishers, advertisers, developers, or rights holders' and allows partners to collect data via cookies for ads/measurement (e.g., 'specific partners' like YouTube measurement companies). Section 'For external processing' and 'With specific partners' confirm this, which may not align with GDPR’s purpose limitation or user consent requirements for tracking.

Warning

Retention periods lack specificity

While the 'Retaining your information' section outlines general retention practices (e.g., user-deletable data, automatic anonymization), it does not provide specific timeframes for all data types. For example, 'some data we retain for longer periods' for 'legitimate business or legal purposes' is vague, potentially violating GDPR’s storage limitation principle (Article 5(1)(e)).

Consumer Takeaway

Google collects and processes a vast amount of your data across its services, often linking it to your account or device, and shares it widely with partners and for ads. While you have strong controls to manage, export, or delete data, the sheer scale of collection and cross-service integration means your data is likely used in ways you may not expect—especially if you use multiple Google products. For EU users, data may be transferred outside the EEA, and AI training uses public/partner data without clear opt-outs.

Compliance Posture

Google demonstrates strong compliance efforts with GDPR, including detailed disclosures, user rights, and data retention policies. However, its reliance on legitimate interest for many processing purposes, extensive third-party sharing, and international transfers (despite frameworks like SCCs) create compliance risks under EU law, particularly for sensitive data or large-scale profiling. The policy meets transparency requirements but may not fully satisfy data minimization or purpose limitation principles.

EU Transfers

High risk. Google explicitly states data may be processed on servers worldwide, including outside the EEA, and relies on legal frameworks (e.g., SCCs) for transfers. While it applies the same protections globally, the lack of explicit guarantees for EU-only processing or binding corporate rules (BCRs) for all data types raises concerns under Schrems II and GDPR Chapter V. Publicly accessible data and partner-sourced data are used for AI training, which may involve transfers to the US or other jurisdictions with weaker protections.

Detected Signals

Specific data points and practices identified in the text

Data Collected
NameEmail addressPasswordPhone numberPayment informationContent created or uploaded (e.g., emails, photos, videos, docs)IP addressUnique identifiers (e.g., browser, device, cookie IDs)Browser type and settingsDevice type and settingsOperating systemMobile network information (carrier name, phone number)Application version numberCrash reportsSystem activityReferrer URLSearch termsVideos watchedViews and interactions with content and adsMedia (images, files, audio, video) from interactionsPurchase activityPeople communicated with or shared content withActivity on third-party sites and apps using Google servicesChrome browsing history (if synced)Call and message log information (phone numbers, timestamps, duration)GPS and sensor dataLocation derived from IP addressActivity on Google services (e.g., searches, labeled places like home/work)Information about nearby devices (Wi-Fi access points, cell towers, Bluetooth devices)Publicly accessible information (e.g., from newspapers, directories)Information from trusted partners (e.g., marketing, security, directory services)
Processing Purposes
Provide and deliver services (e.g., search results, content sharing)Maintain and improve services (e.g., troubleshooting, spell-check)Develop new servicesProvide personalized services, content, and adsMeasure performance (e.g., analytics for ads and services)Communicate with users (e.g., notifications, updates)Protect Google, users, and the public (e.g., fraud detection, abuse prevention)Train AI models (e.g., for Google Translate, Gemini Apps)Comply with legal obligations or enforceable requestsLink information across services and devices for personalization and ads
Third-party Sharing
With user consent (e.g., sharing data with third-party apps or services)With domain administrators (for Google Workspace/education accounts)With affiliates and trusted service providers for processingWith advertisers and publishers (non-personal, aggregated data)With partners for ads and measurement (e.g., YouTube measurement companies)With rights holders (e.g., for content usage statistics)For legal reasons (e.g., government requests, fraud prevention)Publicly (e.g., trends, non-personal data)With security partners to protect against abuse
International Transfers
Data processed on servers worldwide, including outside the EEAReliance on legal frameworks (e.g., Standard Contractual Clauses) for international transfersNo explicit guarantee of EU-only processing or storagePublicly accessible data and partner-sourced data may be transferred for AI training
AI / Model Training
Publicly accessible sources used to train AI models (e.g., Google Translate, Gemini Apps)Partner-sourced data may be used for AI trainingNo explicit opt-out for AI training using user dataVoice/audio data (e.g., 'Hey Google' recordings) may be used to improve audio recognition technologies

Evidence Snippets

Direct quotes from the policy supporting these findings

We collect information about the apps, browsers, and devices you use to access Google services, which helps us provide features like automatic product updates and dimming your screen if your battery runs low.

We may also collect information about you from publicly accessible sources. For example, if your name appears in your local newspaper, Google’s Search engine may index that article and display it to other people if they search for your name. We may also collect information about you from trusted partners, such as directory services who provide us with business information to be displayed on Google’s services, marketing partners who provide us with information about potential customers of our business services, and security partners who provide us with information to protect against abuse. We also receive information from partners to provide advertising and research services on their behalf.

We maintain servers around the world and your information may be processed on servers located outside of the country where you live. Data protection laws vary among countries, with some providing more protection than others. Regardless of where your information is processed, we apply the same protections described in this policy.

We use the information we collect across our services and across your devices for the purposes described above. For example, depending on your available settings, if you watch videos of guitar players on YouTube, you might see an ad for guitar lessons on a site that uses our ad products.

We may also collect information about you from publicly accessible sources to help train Google’s AI models and build products and features like Google Translate, Gemini Apps, and Cloud AI capabilities.

Missing or Unclear

  • No explicit opt-out for AI/model training using user-generated content
  • No guarantee of EU-only data processing or storage
  • Lack of specific retention periods for all data types
  • No clear mechanism to object to legitimate interest processing for profiling/ads
  • No binding corporate rules (BCRs) mentioned for all data transfers
  • No explicit consent required for cross-service data linking (beyond settings)
  • No detail on how sensitive personal data (e.g., health, biometrics) is isolated from AI training

Questions to Ask

  • Does Google provide a mechanism to opt out of AI/model training using my data, including publicly accessible or partner-sourced data?
  • Can Google guarantee that my data will only be processed and stored within the EU/EEA, and if not, what specific safeguards (e.g., BCRs, encryption) are in place for transfers to the US?
  • What are the exact retention periods for each type of data Google collects, and how does Google ensure compliance with GDPR’s storage limitation principle?
  • How does Google obtain explicit consent for cross-service data linking (e.g., using Gmail data to personalize Search results) under GDPR’s purpose limitation and consent requirements?
  • What specific measures does Google take to ensure that third-party partners (e.g., advertisers, measurement companies) do not re-identify or misuse non-personal data shared with them?
  • Does Google treat all data collected from EU users as 'personal data' under GDPR, even when not linked to a Google Account (e.g., unique identifiers tied to a device)?
  • How does Google reconcile its use of legitimate interest for profiling and ads with the GDPR’s requirement for a balancing test and user rights to object?
This analysis is generated by AI and is not legal advice. Always consult a qualified legal professional for compliance decisions.

Share this analysis

Anyone with this link can view the result above.

Built by DentroChat

100% European AI chat for everyone

Chat with AI, work with files, generate images, and search the web. Data stays in Europe.

EU-hosted infrastructureText, files, images & web searchFast, Thinking & Creative modesPrivacy-first by defaultNo data leaves Europe
Try free →

Other analysed privacy policies

View all