This version of the Google Privacy Policy is effective October 1, 2026
The page states that this version took effect on October 1, 2026. It points to archived versions and a downloadable PDF, which are links on the page and are not part of the text analyzed here.
Supporting quotations
Effective October 1, 2026
Qualifications & exceptions
Effective date as stated on the page for this United States English version.
Not stated here
The archived versions and the PDF are not supplied, so this analysis does not say how this version differs from earlier ones.
Legal Rights & Agreement Rules · Permission or license
Google shares personal information when it believes disclosure is reasonably necessary for legal or protective reasons
Google says it will share personal information outside Google if it has a good-faith belief that disclosure is reasonably necessary to respond to applicable law, regulation, legal process or an enforceable governmental request; enforce applicable Terms of Service, including investigating potential violations; detect, prevent or address fraud, security or technical issues; or protect against harm to the rights, property or safety of Google, its users or the public. Google publishes a Transparency Report on the number and type of government requests, and elsewhere says its legal team reviews every request and frequently pushes back on requests that appear overly broad or improper.
Supporting quotations
We will share personal information outside of Google if we have a good-faith belief that disclosure of the information is reasonably necessary to:
Respond to any applicable law, regulation,legal process, or enforceable governmental request.
Enforce applicable Terms of Service, including investigation of potential violations.
Detect, prevent, or otherwise address fraud, security, or technical issues.
Protect against harm to the rights, property or safety of Google, our users, or the public.
Our legal team reviews each and every request, regardless of type, and we frequently push back when a request appears to be overly broad or doesn’t follow the correct process.
Qualifications & exceptions
The standard is a "good-faith belief" that disclosure is "reasonably necessary".
The statement that Google reviews every request and pushes back is a general description of practice, not a promise about any particular request.
Legal Rights & Agreement Rules · Company commitment
Google says it regularly reviews the policy and checks that its processing complies with it
Google says it regularly reviews this Privacy Policy and makes sure that it processes your information in ways that comply with it.
Supporting quotations
We regularly review this Privacy Policy and make sure that we process your information in ways that comply with it.
Qualifications & exceptions
A statement of internal practice; the policy does not describe who audits it.
Legal Rights & Agreement Rules · Company practice
Your information may be processed on servers outside your country, with the same protections and complaint handling
Google maintains servers around the world, and your information may be processed on servers outside the country where you live. It acknowledges that data protection laws vary among countries, with some providing more protection than others, and says that regardless of where your information is processed it applies the same protections described in the policy. It also says it complies with certain legal frameworks relating to the transfer of data. When it receives formal written complaints, it responds by contacting the person who complained, and it works with the appropriate regulators, including local data protection authorities, to resolve complaints about the transfer of data that it cannot resolve with you directly.
Supporting quotations
We maintain servers around the world and your information may be processed on servers located outside of the country where you live.
Regardless of where your information is processed, we apply the same protections described in this policy.
We also comply with certain legal frameworks relating to the transfer of data.
When we receive formal written complaints, we respond by contacting the person who made the complaint.
We work with the appropriate regulatory authorities, including local data protection authorities, to resolve any complaints regarding the transfer of your data that we cannot resolve with you directly.
Qualifications & exceptions
The policy refers to "certain legal frameworks" without naming them.
Not stated here
The specific transfer frameworks Google complies with are not named in this section.
Legal Rights & Agreement Rules · User right or choice
U.S. state laws give rights to know, access, correct, delete and opt out of profiling and targeted advertising
Google says U.S. state privacy laws provide the right to request information about how Google collects, uses and discloses your information; to access your information, sometimes in a portable format; to correct it; and to request that Google delete it. Many of these laws also provide the right to opt out of certain forms of profiling and targeted advertising, and the right not to be discriminated against for exercising these rights. For information such as health data that the CCPA treats as sensitive, Google says it only uses it for purposes permitted by the CCPA, such as providing services users request and expect.
Supporting quotations
U.S. state privacy laws also provide the right to request information about how Google collects, uses, and discloses your information.
give you the right to access your information, sometimes in a portable format; correct your information; and to request that Google delete that information
Many of these laws also provide the right to opt out of certain forms of profiling and targeted advertising.
They also provide the right to not be discriminated against for exercising these privacy rights.
Google only uses it for purposes permitted by the CCPA, like to provide services that are requested and expected by our users
Qualifications & exceptions
These are described as rights provided by state laws, which vary by state; this policy does not say which apply to a given person.
The sensitive-information statement is specific to the CCPA's treatment of sensitive information.
Legal Rights & Agreement Rules · User right or choice
Washington and Nevada health data laws add rights; Google processes covered health data with consent you may withdraw
The Washington My Health My Data Act and Nevada Senate Bill 370 provide specific rights, in addition to the rights above, that apply to health information. When you provide health information subject to these laws, Google says it processes it with your consent, which you may withdraw, or as otherwise permitted by those laws.
Supporting quotations
The Washington My Health My Data Act and Nevada Senate Bill 370 provide specific rights in addition to those rights above, that apply to health information.
When you provide health information subject to these laws, Google processes it with your consent, which you may withdraw, or as otherwise permitted by these laws.
Qualifications & exceptions
The alternative "as otherwise permitted by these laws" means consent is not the only basis described.
Legal Rights & Agreement Rules · Procedure
You exercise state-law rights through account tools or contact Google, and can ask it to reconsider a decision
Google says its privacy controls let you access, review, update and delete your information and export and download a copy of it, and let you control what information it uses to show ads or turn off personalized ads. When you use these tools, it validates your request by verifying that you are signed in to your Google Account. For questions or requests about rights under U.S. state privacy laws, you or your authorized agent can also contact Google, and if you disagree with the decision on your request you can ask Google to reconsider by responding to its email. Google also links more information about how it handles CCPA requests.
Supporting quotations
These tools allow you to access, review, update and delete your information, as well as
You can also control what information we use to show you ads, or turn off personalized ads
we’ll validate your request by verifying that you’re signed in to your Google Account
you (or your authorized agent) can also
if you disagree with the decision on your request, you can ask Google to reconsider it by responding to our email
We also provide more information on Google’s handling of CCPA requests.
Qualifications & exceptions
Validation for tool use is by being signed in; the policy does not describe other verification for contact requests.
Not stated here
The more detailed description of Google's handling of CCPA requests is linked but not supplied.
Legal Rights & Agreement Rules · Context
A table organizes the policy's information into categories used by some U.S. state privacy laws
Some U.S. state privacy laws require a description of data practices using specific categories. Google says the table that follows uses these categories to organize information already in the policy; it is a re-organization of the policy's statements, not a separate set of terms.
Supporting quotations
Some U.S. state privacy laws also require a description of data practices using specific categories. This table uses these categories to organize the information in this Privacy Policy.
Legal Rights & Agreement Rules · Company practice
Business purposes: security, fraud and abuse protection, and legal compliance including disclosure to law enforcement
Among the business purposes, Google lists using and possibly disclosing information to detect, prevent and respond to security incidents and other malicious, deceptive, fraudulent or illegal activity, for example IP addresses that malicious actors have compromised. It also lists using information to satisfy applicable laws or regulations and disclosing information in response to legal process or enforceable government requests, including to law enforcement, and says it provides information about the number and type of government requests in its Transparency Report.
Supporting quotations
Google uses and may disclose information to detect, prevent and respond to security incidents, and for protecting against other malicious, deceptive, fraudulent, or illegal activity.
Google also uses information to satisfy applicable laws or regulations, and discloses information in response to legal process or enforceable government requests, including to law enforcement.
Legal Rights & Agreement Rules · Company practice
Law enforcement or other third parties may receive information for the legal reasons described in the sharing section
The last entry in the disclosure table lists law enforcement or other third parties, for the legal reasons described in the Sharing your information section. That section ties disclosure to a good-faith belief that it is reasonably necessary to respond to law or legal process, enforce terms, address fraud or security issues, or protect rights, property or safety.
Supporting quotations
Law enforcement or other third parties, for the legal reasons described in
We will share personal information outside of Google if we have a good-faith belief that disclosure of the information is reasonably necessary to:
Qualifications & exceptions
The entry points to the legal-reasons conditions rather than creating a separate one.
Legal Rights & Agreement Rules · Restriction or exception
The policy covers all services of Google LLC and its affiliates, except those with separate privacy policies
This Privacy Policy applies to all of the services offered by Google LLC and its affiliates, including YouTube, Android and services offered on third-party sites, such as advertising services. It does not apply to services that have separate privacy policies that do not incorporate this Privacy Policy. Later the policy lists privacy notices for specific Google services.
Supporting quotations
This Privacy Policy applies to all of the services offered by Google LLC and its affiliates, including YouTube, Android, and services offered on third-party sites, such as advertising services.
This Privacy Policy doesn’t apply to services that have separate privacy policies that do not incorporate this Privacy Policy.
Qualifications & exceptions
The exclusion is for services with their own policy that does not incorporate this one; the list of specific-service notices later in the document shows examples.
Not stated here
The separate notices for specific services are linked but not supplied here, so the policy cannot say which terms govern in case of overlap.
Legal Rights & Agreement Rules · Restriction or exception
The policy does not cover advertisers' practices or other companies' services, including linked sites
The policy states it does not apply to the information practices of other companies and organizations that advertise Google's services, or to services offered by other companies or individuals, including products or sites they offer that may include Google services to which the policy applies, or products or sites displayed to you in search results or linked from Google services.
Supporting quotations
This Privacy Policy doesn’t apply to:
The information practices of other companies and organizations that advertise our services
Services offered by other companies or individuals, including products or sites they offer that may include Google services to which the policy applies, or products or sites displayed to you in search results, or linked from our services
Qualifications & exceptions
A third-party site that includes a Google service is outside this policy as to its own practices, even though Google's own handling of data it receives is covered.
Legal Rights & Agreement Rules · Company commitment
Google may change the policy but says it will not reduce your rights without explicit consent
Google says it changes the Privacy Policy from time to time. It says it will not reduce your rights under this Privacy Policy without your explicit consent. It always indicates the date the last changes were published and offers access to archived versions. If changes are significant, it says it will provide a more prominent notice, including, for certain services, email notification of Privacy Policy changes.
Supporting quotations
We change this Privacy Policy from time to time.
We will not reduce your rights under this Privacy Policy without your explicit consent.
We always indicate the date the last changes were published and we offer access to archived versions for your review.
If changes are significant, we’ll provide a more prominent notice (including, for certain services, email notification of Privacy Policy changes).
Qualifications & exceptions
The no-reduction promise is about rights under this Privacy Policy and requires explicit consent.
Email notification is described only for certain services.
Not stated here
What counts as a "significant" change is not defined.
Legal Rights & Agreement Rules · Context
Google lists separate privacy notices for payments, Gemini Apps, Fi, education, children and Family Link services
Google says the following privacy notices provide additional information about some Google services: Payments, Fiber, Gemini Apps, Google Fi, Google Workspace for Education, Read Along, YouTube Kids, Google Accounts managed with Family Link for children under 13 (or the applicable age in the country), the Family Link privacy guide for children and teens, and voice and audio collection from children's features on the Google Assistant. These notices are separate documents with their own terms.
Supporting quotations
The following privacy notices provide additional information about some Google services:
Payments
Fiber
Gemini Apps
Google Fi
Google Workspace for Education
Read Along
YouTube Kids
Google Accounts Managed with Family Link, for Children under 13 (or applicable age in your country)
Family Link privacy guide for children & teens
Voice and Audio Collection from Children’s Features on the Google Assistant
Qualifications & exceptions
The notices are described as additional information about those services; the policy does not say here how they rank against this policy where they differ, except that this policy does not apply to services with separate policies that do not incorporate it.
Several of them concern children, teens or students, who are different audiences from the general consumer users this policy addresses.
Not stated here
The listed notices are linked but not supplied, so their terms are not described in this analysis.
Legal Rights & Agreement Rules · Context
Members of organizations using Google Workspace or Cloud Platform are pointed to the Google Cloud Privacy Notice
If you are a member of an organization that uses Google Workspace or Google Cloud Platform, Google points you to the Google Cloud Privacy Notice for how those services collect and use your personal information. That notice is a separate document that is not supplied here.
Supporting quotations
If you’re a member of an organization that uses Google Workspace or Google Cloud Platform, learn how these services collect and use your personal information in the
Not stated here
The Google Cloud Privacy Notice is linked but not supplied, so what it says about organization accounts is not described.
Legal Rights & Agreement Rules · Context
Key term: affiliates are entities in the Google group of companies, including named consumer-service companies in the EU
The policy defines an affiliate as an entity that belongs to the Google group of companies, including the following companies that provide consumer services in the EU: Google Ireland Limited, Google Commerce Ltd, Google Payment Corp and Google Dialer Inc. It links a separate list of companies providing business services in the EU. This definition matters for the statements about providing personal information to affiliates and for the scope "Google LLC and its affiliates".
Supporting quotations
An affiliate is an entity that belongs to the Google group of companies, including the following companies that provide consumer services in the EU: Google Ireland Limited, Google Commerce Ltd, Google Payment Corp, and Google Dialer Inc.
Qualifications & exceptions
The named companies are examples for EU consumer services, introduced by "including".
Legal Rights & Agreement Rules · Context
Key term: non-personally identifiable information no longer reflects or references an identifiable user
The glossary defines non-personally identifiable information as information recorded about users so that it no longer reflects or references an individually identifiable user. This is the category the policy says may be shared publicly and with partners.
Supporting quotations
This is information that is recorded about users so that it no longer reflects or references an individually-identifiable user.
Qualifications & exceptions
The definition depends on the information no longer referencing an individually identifiable user; the policy does not describe the method used to reach that state beyond what the anonymization statement says.
Legal Rights & Agreement Rules · Context
Key term: personal information is what you provide that identifies you, plus data Google can reasonably link to it
The glossary defines personal information as information you provide to Google that personally identifies you, such as your name, email address or billing information, or other data that can be reasonably linked to such information by Google, such as information Google associates with your Google Account. This definition is what the "we do not share your personal information" commitment refers to, so data tied to your account falls within it.
Supporting quotations
This is information that you provide to us which personally identifies you, such as your name, email address, or billing information, or other data that can be reasonably linked to such information by Google, such as information we associate with your Google Account.
Qualifications & exceptions
The definition includes data "reasonably linked" by Google, so account-associated activity data is within it; data stored against device identifiers while signed out is described separately in the collection section.
Key term: sensitive personal information covers topics like medical facts, race or ethnicity, beliefs and sexuality
The glossary describes sensitive personal information as a particular category of personal information relating to topics such as confidential medical facts, racial or ethnic origins, political or religious beliefs, or sexuality. This is the category for which the policy says Google asks explicit consent before sharing outside Google and which it excludes from personalized-ad targeting.
Supporting quotations
This is a particular category of personal information relating to topics such as confidential medical facts, racial or ethnic origins, political or religious beliefs, or sexuality.
Google says its legal team reviews every government data request and pushes back on overly broad ones
Google explains that, like other technology and communications companies, it regularly receives requests from governments and courts around the world to disclose user data. It says its approach to complying rests on respect for the privacy and security of data you store with Google, that its legal team reviews every request regardless of type, and that it frequently pushes back when a request appears overly broad or does not follow the correct process. It points to its Transparency Report.
Supporting quotations
Google regularly receives requests from governments and courts around the world to disclose user data.
Our legal team reviews each and every request, regardless of type, and we frequently push back when a request appears to be overly broad or doesn’t follow the correct process.
Qualifications & exceptions
This describes a general approach; it does not state outcomes of any particular request.
Legal Rights & Agreement Rules · Company practice
Google processes information about content-removal requests to assess them and to promote transparency and prevent abuse
As an example of using information to benefit the public, Google says it processes information about requests to remove content from its services under its content removal policies or applicable law, to assess the request and to ensure transparency, improve accountability and prevent abuse and fraud in these practices.
Supporting quotations
we process information about
from our services under Google's content removal policies or applicable law to assess the request, and to ensure transparency, improve accountability and prevent abuse and fraud in these practices
Legal Rights & Agreement Rules · Context
The policy says it addresses U.S. state privacy laws including California, Virginia, Colorado, Connecticut and Utah
Google lists U.S. state privacy laws that its state-law disclosures address, beginning with the California Consumer Privacy Act, the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Act Concerning Personal Data Privacy and Online Monitoring and the Utah Consumer Privacy Act, and continuing with the Washington My Health My Data Act, Nevada Senate Bill 370, the Florida Digital Bill of Rights, the Texas Data Privacy and Security Act, the Oregon Consumer Privacy Act and the Montana Consumer Data Privacy Act.
Supporting quotations
These laws include:
California Consumer Privacy Act (CCPA)
Virginia Consumer Data Protection Act (VCDPA)
Colorado Privacy Act (CPA)
Connecticut Act Concerning Personal Data Privacy and Online Monitoring (CTDPA)
Utah Consumer Privacy Act (UCPA)
Washington My Health My Data Act (MHDM)
Nevada Senate Bill 370
Florida Digital Bill of Rights (FDBR)
Texas Data Privacy and Security Act (TDPSA)
Oregon Consumer Privacy Act (OCPA)
Montana Consumer Data Privacy Act (MTCDPA)
Qualifications & exceptions
The list names statutes; it does not say how each applies to a given person or what each requires.
Legal Rights & Agreement Rules · Context
The list of U.S. state privacy laws continues with New Jersey, New Hampshire, Nebraska, Iowa and others
The list continues with New Jersey Senate Bill 332, New Hampshire Senate Bill 255, the Nebraska Data Privacy Act, the Iowa Consumer Data Protection Act, the Delaware Personal Data Privacy Act, the Tennessee Information Protection Act, the Minnesota Consumer Data Privacy Act, the Maryland Online Data Privacy Act of 2024, the Indiana Consumer Data Protection Act, the Kentucky Consumer Data Protection Act and the Rhode Island Data Transparency and Privacy Protection Act.
Supporting quotations
New Jersey Senate Bill 332
New Hampshire Senate Bill 255
Nebraska Data Privacy Act (NEDPA)
Iowa Consumer Data Protection Act (IACDPA)
Delaware Personal Data Privacy Act (DPDPA)
Tennessee Information Protection Act (TIPA)
Minnesota Consumer Data Privacy Act (MNCDPA)
Maryland Online Data Privacy Act of 2024 (MDODPA)
Indiana Consumer Data Protection Act (INCDPA)
Kentucky Consumer Data Protection Act (KCDPA)
Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA)
Qualifications & exceptions
The list names statutes; it does not say what each requires or how it applies to a given person.