Does Google Docs scan your documents for AI?

What Google Actually Does With Your Docs (and What It Says It Doesn't)

Over a billion people type sensitive things into Google Docs every month — contracts, manuscripts, half-formed business ideas. So the question of what Google actually does with those words matters.

The direct answer, per Google's own documentation, is that Workspace "does not scan the content of your Google Docs, Sheets, Slides, Vids, or Drive files to train foundational AI models, including Gemini." Google also commits to never using content in Docs, Sheets, and Slides for advertising purposes. The company's AI privacy page reiterates that Workspace data isn't used to train the generative models behind Gemini, Search, and other external systems without permission.

That "without permission" phrase is doing real work, though. Google does process your document content — automatically and continuously — for functional purposes:

• Spam filtering across Workspace apps
• Virus detection and malware protection
• In-account search, so you can find files by keyword
• Gemini's real-time retrieval, which searches indexed content you have permission to access

That last point matters most. As ZDNET's hands-on reporting found, Google indexes all Workspace sources and Gemini uses Retrieval-Augmented Generation to pull from that index when answering prompts — and this access is on by default until an admin manually disables it. Google doesn't use that data for training, but your documents are still being read by an AI system in real time.

Here's the nuance most explanations miss: this protection is a policy promise, not a technical guarantee. Google Docs is not end-to-end encrypted — your documents always live on Google's servers, encrypted with AES-256 in transit, at rest, and in backups, but Google itself retains the ability to read them. As Fileverse's comparison puts it, Google can technically read and scan your content, and the terms governing what it does with that access can change at any time.

Privacy advocates press harder still. Proton argues there's nothing in Google's privacy policy that outright prevents the company from using Docs content to train its AI models — a policy gap rather than confirmed behavior, but a gap worth noting. Google's "no training" commitment is also framed around Workspace, and whether it applies identically to free personal accounts isn't clearly specified in Google's own support pages.

There's one genuine technical control: client-side encryption, which blocks Gemini entirely — no Google system or employee can access CSE content, per Google's admin documentation. The catch is availability: it's limited to work and school accounts, so free-account users can't use it at all.

The practical takeaway: for everyday documents, Google's stated policies are reasonably strong. For genuinely confidential material, treat cloud docs accordingly — and if you're automating document workflows with AI agents, remember that published research found roughly 26% of agent skills carry at least one vulnerability. SkillzBench is building a free directory where every skill gets security-scanned and benchmarked before you connect it via its free MCP tool — verification, not promises.

Where AI Really Touches Your Documents: Gemini Access and Smart Features

So far we've established that Google doesn't scan your Docs to train its models. But "not training on your files" is not the same as "no AI touches your documents" — and there are two distinct pathways where AI genuinely does read your content.

The first is Gemini itself. Google indexes Workspace sources — Docs, Gmail, Drive and more — and Gemini uses real-time Retrieval-Augmented Generation (RAG) to search that indexed data whenever you prompt it, pulling in anything you have permission to access. According to ZDNET's hands-on reporting, this access is on by default, and administrators must manually disable it at admin.google.com under Workspace Intelligence Sources. Google doesn't use that retrieved data for training or share it outside your domain, but internal AI access still raises compliance and privacy risks — including the possibility of confidential information surfacing across departments through AI queries.

The second pathway is smart features. Here, Google's AI scans what you write and store — including emails and documents — to provide tailored help, and leaving the smart-features checkbox ticked counts as granting permission to use that content for personalization and broader service improvement, research and development included, as DeleteMe's privacy guidance explains. Consent here is implied by inaction: if you never untick the box, you've opted in. EU, UK, Swiss, and Japanese users are opted out by default due to regulatory requirements — everyone else has to act.

Even after you opt out, the data trail doesn't vanish immediately:

• Gemini conversations are stored for 72 hours even after you opt out of AI training.
• Gemini in Workspace prompts and responses are retained for 90 days to indefinitely, depending on admin settings.
• The standalone Gemini app keeps conversations for up to 36 months, with an 18-month default.

There's also a meaningful gap between consumer and business policies. Google's "no AI training" commitments are framed around Workspace, and whether the same protection applies identically to free personal accounts isn't clearly specified in Google's own documentation. Free users also can't use client-side encryption — the one technical control that blocks Gemini entirely, with no Google system or employee able to access the content — because it's limited to work and school accounts. Proton's analysis goes further, arguing that nothing in Google's privacy policy prevents the company from using Docs content to train AI models, and that without end-to-end encryption, privacy is a policy promise, not a technical guarantee.

The integration is deepening, too. Since March 2026, Gemini can draft entire documents using your existing files and emails, and since July 2026 it reads Docs comments by default — including comments left by people outside your organization who never consented to AI processing. Disabling Gemini requires combining multiple settings, and even then it only removes Gemini's features from your interface; it doesn't delete already-processed data or change Google's underlying access.

For teams connecting AI agents to document workflows, this is exactly why vetting matters — SkillzBench is building a free directory where every agent skill is security-scanned and benchmarked before you connect it through its free MCP tool, so you know what your agents can actually see.

The Real Privacy Risks: Public Links, Third-Party Extensions, and the Encryption Gap

Google's "we don't train on your Docs" promise comes with asterisks — and the three biggest ones aren't in the AI settings at all. They involve how you share, what you install, and who can technically read your files.

The most direct exposure is public sharing. According to Proton's analysis, documents set to "Anyone with the link" become publicly available and could potentially be used by Google and other AI services for training. Google's own documentation notes its foundational models are trained primarily on publicly available, crawlable internet data. That said, Google clarifies that link sharing alone doesn't make a document discoverable — the link has to be posted on a public, crawlable page. In practice: a shared link is fine until it ends up somewhere the web can find it.

Third-party extensions are a quieter risk. Add-ons you install into Google Docs operate under their own privacy policies and may scrape or share your data — Google's commitments don't cover them. If you use AI-powered add-ons for grammar, summarizing, or translation, you're trusting those vendors directly. This is the same trust problem SkillzBench is being built to solve: every agent skill in its free directory is security-scanned, license-checked, and benchmarked before you connect it through the free MCP tool, so you can see what a skill actually does before granting it access.

Then there's the encryption gap. Google Docs is not end-to-end encrypted — files live on Google's servers, encrypted with AES-256 in transit and at rest, but Google itself retains access. As Fileverse puts it, the privacy you get is "a policy promise, not a technical guarantee: Google can read and scan your content, and the terms covering what it does with it can change anytime." Client-side encryption — which blocks Gemini entirely, with no Google system or employee able to access the content — exists, but only for work and school accounts. Free personal accounts can't use it.

So how do Google's assurances stack up against the critics? Google states that Workspace data isn't used to train models outside Workspace without permission, and ZDNET's hands-on testing confirms Gemini retrieves your data through search rather than training scans. But Proton counters that nothing in Google's privacy policy technically prevents using Docs content for AI training — and the FTC has flagged public concern about companies scraping personal files without consent.

For businesses, ZDNET flags a real compliance issue: Gemini's access to Workspace data is on by default, and even without training use, AI retrieval can leak confidential information across departments or create insider-threat vectors. If your contracts or regulations prohibit AI processing of documents, default-on access is a problem regardless of Google's training promises. Admins can disable per-source access at admin.google.com under Generative AI → Gemini in Workspace → Workspace Intelligence Sources.

The takeaway: Google's no-training commitment is real but conditional. Your exposure grows through sharing settings, extensions, and the absence of end-to-end encryption — controls you manage, not Google.

How to Lock Down Your Docs: A Practical Settings Audit

Google gives you more privacy controls than most people realize — but there is no single switch that turns everything off, so a proper lockdown means working through three layers: your personal settings, your admin console, and your encryption posture. Here is the audit, step by step.

Start with your own account. Privacy guidance from DeleteMe recommends turning off three settings in sequence: Gemini Apps activity (which governs AI training consent), smart features in Gmail settings, and smart features under Drive's privacy settings. Leaving that smart-features box ticked counts as permission for Google to use your content to improve its services, research and development included.

Know the limits. Even after opting out, Gemini conversations are stored for 72 hours, and per Proton's analysis, disabling Gemini only removes the features from your interface — it does not delete already-processed data or change Google's underlying access. There is no universal off-switch.

For organizations, the bigger issue is that Gemini's access to Workspace data is on by default. As ZDNET's hands-on reporting confirms, Gemini uses real-time retrieval to search indexed Docs, Gmail, and Drive content — and admins must manually disable it.

The fix lives at admin.google.com → Generative AI → Gemini in Workspace → Workspace Intelligence Sources, where you can disable access per data source. Even if Google does not use this data for training, internal AI retrieval can create compliance risks when contracts or regulations prohibit it.

For genuinely sensitive material, settings toggles are not enough. Workspace admins can deploy:

• Client-side encryption (CSE), which blocks Gemini entirely — no Google system or employee can access CSE-protected content
• Data loss prevention (DLP) rules to flag or restrict sensitive documents
• Information Rights Management to control sharing and copying

One hard limit: CSE is available only on work and school accounts — free personal accounts cannot use it, per Proton. For consumer users with confidential files, the practical answer is keeping that material out of Docs entirely.

If your team is automating document workflows with AI agents, apply the same audit discipline to what you connect: SkillzBench (skillzbench.com) security-scans and benchmarks agent skills before you equip them via its free MCP tool, so you are not trading one privacy gap for another.

Match Your Tools to Your Sensitivity Level - and Automate the Rest Safely

Not every document deserves the same level of paranoia — or the same level of trust. The practical answer to Google Docs privacy is risk-tiering: match the tool to the sensitivity of the content, and automate the routine work only through tools you've actually vetted.

Low sensitivity: everyday Docs are fine. Google states plainly that Workspace does not scan Docs, Sheets, Slides, or Drive content to train foundational AI models, including Gemini. Meeting notes, shared checklists, and internal drafts are reasonable here — provided you've turned off smart features, which otherwise count as permission to use your content for service improvement, per DeleteMe's opt-out guide.

Medium sensitivity: use encryption and admin controls. Confidential business material needs more than a policy promise. Docs is not end-to-end encrypted, so Google can technically read your content and the terms can change anytime. Workspace admins can enable client-side encryption, which blocks Gemini entirely, along with DLP rules and Information Rights Management — but free personal accounts get none of this, per Proton's security analysis.

High sensitivity: never paste into Gemini. Google itself recommends never entering information into Gemini that you wouldn't want reviewed or used. And since July 2026, Gemini reads Docs comments by default — including words from outside collaborators who never consented to AI processing. Contracts, unreleased financials, legal strategy, and manuscripts in progress belong on encrypted, local, or purpose-built tools.

A quick tiering guide:

• Fine in Docs: routine internal docs, once smart features are off and sharing is restricted to named people.
• Needs controls: client-side encryption, DLP, and admin-disabled Gemini retrieval for confidential business files.
• Never in Gemini: trade secrets, legal strategy, unreleased financials, and anything covered by NDAs or regulatory restrictions.
• Watch sharing settings: "Anyone with the link" documents could potentially be used for AI training.

If you're automating document workflows with AI agents, apply the same discipline to your tools. Published research found roughly 26% of agent skills carry at least one vulnerability — a third party plugging into your documents is a bigger risk than Google's indexing. SkillzBench is building a free directory where every skill is security-scanned, version-pinned, and benchmarked before you connect it via a free MCP tool, so your automations only see what you've chosen for them. Vet the agent the way you'd vet the storage: by sensitivity, not by convenience.