Google’s Gemini AI Scans Private Google Drive Files Without Permission

In a troubling development for user privacy, Google’s Gemini AI has been caught scanning files stored on Google Drive without user consent. This revelation has sparked a fierce online debate about data security.

Users are asking whether any online content can now be private or safe from theft in the age of AI. If Gemini can read and ingest PDFs on your Google Drive without your permission, what else will AI eventually access from your private files?

Unexpected AI Summaries Raise Alarm

Notice about the AI behavior came from Kevin Bankston, who is Senior Advisor on AI Governance for the Center for Democracy and Technology. Bankston had stored a PDF of his tax return on his personal Google Drive, and Gemini AI accessed the PDF without permission. Bankston shared his experience on social media platform X, stating:

“After opening a tax return document as a PDF in Google Docs, Gemini spontaneously provided a summary of my taxes without being asked or given any information."

This unexpected behavior from Gemini AI has left many users wondering about the extent of AI’s reach into their personal files.

The Scope of Gemini’s Scanning

Initial investigations suggest that Gemini’s unauthorized scanning primarily affected PDF files stored on Google Drive. However, the full extent of this behavior remains unclear, leaving users concerned about the privacy of their sensitive documents.

Difficulty in Disabling the Feature

Adding to the frustration, Bankston encountered significant challenges when trying to disable Gemini’s access to his files.

“When I asked Gemini for instructions on how to disable it, I received directions to settings that don’t exist," Bankston explained.

When he finally located the correct setting to disable Gemini in Google Docs, it was already marked as inactive. In other words, the setting was not working. This discovery suggests that Gemini may have glitches causing it to bypass user-defined privacy settings.

Bankston eventually concluded that the glitch was probably caused by his enrollment in a beta trial of the AI feature called Workplace Lab. But whatever caused it, the fact remains that his personal information was available to AI without consent, and that his settings did not prevent access.

Your private files should stay private

User Reactions and Privacy Concerns

The news of invasive AI scanning has elicited mixed responses from the tech community and general users alike.

Several commenters point out that the AI tool that creates a summary is not the same as the AI tool that collects training data.

But many others express worry that Google’s productivity tools could be used for AI training without their knowledge or agreement. Some question the wisdom of storing sensitive documents like tax returns on cloud platforms in the first place, no matter how “reputable” the company in charge.

One commenter on Bankston’s X post notes that as AI moves into wearable devices, these privacy issues will be even more invasive. Wearable devices will sense your location, motion, heartbeat, blood pressure, and more.

T.Boone captured the most common user reaction when he posted on X, “Everything we do online is available to companies that don’t have our best interest at heart.”

Implications for AI Ethics and Data Privacy

This incident raises important questions about the balance between AI advancement and user privacy. As AI becomes more integrated into our daily digital lives, the need for transparent policies and user control over data access becomes increasingly critical.

But who is truly advocating for these guardrails?

The Future of AI and Privacy Law

As the debate unfolds, it’s clear that tech companies like Google will need to address these privacy concerns head-on.

Corporate executives will often pursue any avenue toward maximum profits, no matter what they say in public about ethics.

A long history of lawsuits testifies that usually, the only way to make sure companies operate ethically is to create clear laws that protect individual rights and intellectual property, with strict oversight from an outside authority.

AI must have legal guardrails

Google Already Fielding Multiple Copyright Lawsuits

Google has always claimed that user data is protected in Google Workspace, and that any data there will not be used for AI training. However, user confidence in the trustworthiness of Big Tech is low, based on recent revelations about the desperation of AI companies for new training data, as well as reports of use of copyrighted data for AI training.

And it’s a disturbing sign that Google has assured users of its AI tools that the company will defend all users from copyright lawsuits—why would the company need to assure users of protection unless Google knew full well that there would be many copyright lawsuits on the way?

Will Google Pay Any Attention to Your Privacy Rights?

In France, Google was found guilty of copyright infringement and had to pay a $217 million fine for its Gemini AI tool’s behavior.

The question for users is, will a company willing to infringe even legal copyright actually follow its own stated policies on user privacy? The amount of effort that would be required to protect user privacy from AI is significant. Users jaded by years of misbehavior from giant tech companies may not be willing to trust Google’s claims that private data will remain private.

And it’s not just tax information or your social security number at risk. Theoretically, all content connected in any way to the internet might eventually be at risk for unauthorized AI scans.

That novel-in-progress you are so proud of. The art you work on lovingly in your spare time and scan into your computer so you can make prints or display it for sale. Should everything online become lawful food for AI? If it is, an AI user may be given your thriller’s exact plot to copy when they ask Gemini for help. Though of course, the AI will pretend that it is not your thriller’s exact plot or your unique painting style that is being copied without payment to you. But plenty of authors and artists have seen their work ingested into Google without permission.

For generations, all this creative work by individuals has been protected by copyright as soon as it was printed or put into tangible form in any way.

Now, leaders at AI companies are even going so far as to argue that anyone who ever puts something online has agreed that their content can be copied, recreated, and used in any way as soon as it’s on the internet. Mustafa Suleyman, Microsoft’s AI CEO, argued this point and described anything on the web as “freeware.”

Suleyman’s viewpoint is what might be politely called “counterfactual.” In other words, it’s wrong because it contradicts the law. There is no exemption in copyright law that states that anything on the internet is automatically not covered by copyright.

Suleman’s assertion sounds like a student caught by his teacher for plagiarizing an essay. Any adult in America who has been through middle school knows perfectly well that you cannot take someone else’s words as your own just because they are on the internet.

Both Google and OpenAI have scraped and transcribed a million hours of YouTube content for their training data. That means that anything you upload on YouTube will become more food for AI that may produce something almost exactly like your work. You may see your work echoed a thousand times by AI copycats, despite the fact that technically, you have copyright.

Is AI stealing human work?

What Users Can Do

While Google has yet to officially respond to these allegations, users concerned about their privacy can take several steps:

1. Regularly review and update privacy settings in Google Drive and other cloud storage platforms. (But take this one with a grain of salt—it may not work.)
2. Opt out of AI tools to try to keep your information from being scraped. (Again, there is no way to prove whether opt-outs will be effective.)
3. Consider encrypting sensitive documents before uploading them to the cloud.
4. Store your documents on your hard drive and back them up to another hard drive, not the cloud.
5. Make sure you have excellent security software.
6. Stay informed about AI developments and their potential impact on data privacy.

Advocacy for AI Regulation from the Government

Privacy and the law of copyright are two cornerstones of American life.

A United States without these two protections will be completely transformed from the free nation that has existed for almost 250 years.

Though even experts cannot foresee all the potential consequences of the current trends in AI, hundreds of tech leaders have asked that the government act swiftly to control the use of AI content.

By supporting lawmakers who understand this crucial task, you can exercise your democratic power to help create a future that preserves freedom and economic opportunity.