Google Expands AI Training on User Media by Default, Opt‑Out Required
What Happened — Google updated its Search Services settings to automatically save users’ uploaded images, videos, and voice queries to its “Search Services History.” That media is now eligible for training Google’s large‑language models unless the user explicitly opts out.
Why It Matters for Compliance & Audit Readiness
- The change introduces a de‑facto data‑processing activity that must be captured in your privacy‑impact assessments and consent registers (SOC 2 CC5, GDPR Art. 6).
- Failure to obtain explicit opt‑in or to document the opt‑out flow can lead to gaps in evidence for data‑subject‑access‑request (DSAR) handling and breach‑notification obligations.
- Continuous‑compliance programs need to map this new data‑use to control‑owner responsibilities and collect audit‑ready logs of user consent status.
Who Is Affected — Cloud‑service users, SaaS platforms that embed Google Search, and any organization that relies on Google’s media‑search features for internal workflows (tech, media, education, retail, etc.).
Recommended Actions
- Review and update your privacy policy and consent mechanisms to reflect Google’s expanded data‑use.
- Enable the “opt‑out” setting for all corporate accounts and document the configuration as part of your SOC 2 evidence library.
- Incorporate the new data‑processing activity into your Data‑Protection Impact Assessment (DPIA) and verify DSAR workflows can retrieve or delete the media used for AI training.
Source: ZDNet Security
Technical Notes
- The policy applies to any media saved to “Search Services History” when a user is signed in to a Google account.
- No CVE or exploit is involved; the risk is privacy‑related exposure through consent‑management gaps.
Source: same as above