Gemini

The general Privacy Policy states Google collects content users create, upload, or receive, but does not address ownership or licensing of user inputs — that would be governed by the Terms of Service, which was not retrievable. Silence on ownership within the supplied documents is a gap.

The supplied documents (a privacy policy and a links page) contain no statement about ownership of AI-generated outputs. Output ownership is a Terms-of-Service matter, and the Gemini/Google Terms of Service was not among the retrievable text.

The policy states Google uses publicly available information to train its AI models, including for Gemini Apps and Cloud AI. It does not, in the supplied text, clearly state whether a user's own Gemini prompts and uploads are used for model training — that carve-out would live in the Gemini Apps privacy notice, which was not retrieved. The training language present focuses on publicly available and research-and-development data.

The policy provides clear user deletion and export controls, including per-item, per-product, and full-account deletion, plus auto-delete options for activity. Retention is described as variable by data type with some data kept for legitimate business or legal purposes; no specific numeric retention schedule or deletion SLA is given in this text, but self-service deletion tools are clearly documented.

The policy states Google does not sell personal information and does not 'share' it as defined by the CCPA, and shares personal information outside Google only with consent, with domain administrators, service providers, or for legal reasons. However, it also shares non-personally identifiable information with advertising and measurement partners and allows specific partners to collect information from the browser/device for advertising. The advertising-oriented sharing broadens the footprint beyond what a standalone AI assistant strictly requires.

The policy provides multiple concrete opt-out and control mechanisms: Activity Controls, ad personalization settings via My Ad Center, signed-out search customization opt-out, and cookie/device-level settings. U.S. state privacy law rights including opt-out of profiling and targeted advertising are described.

The policy references compliance with U.S. state privacy laws (CCPA and others), the Washington My Health My Data Act, Nevada SB 370, and 'certain legal frameworks' for data transfers, but names no third-party audit or certification (no SOC 2, ISO 27001/42001, or EU AI Act attestation in the supplied text). Compliance is asserted rather than evidenced by named certifications. GDPR is implied through EU affiliate references but not explicitly claimed in this excerpt.

The supplied documents contain no commitments regarding model explainability, transparency into AI behavior, or enterprise auditing of the AI. Links to AI principles and a Responsible AI report are referenced but no auditability terms appear in the retrievable text.

The policy discloses encryption in transit, access restrictions with confidentiality obligations, security review of collection/storage/processing practices, and account-level features like 2-Step Verification. It does not mention encryption at rest, penetration testing, bug bounty, formal incident response, or any breach history in the supplied text, and no dedicated trust center/security report is cited beyond general safety pages.

The consumer policy references that Workspace/Cloud Platform users are governed by a separate Google Cloud Privacy Notice and that domain administrators control organizational accounts, implying a different regime for enterprise. However, no enterprise agreement was supplied, so the actual data-handling delta cannot be assessed from the retrievable text.

The general policy discloses that service providers review YouTube content and listen to samples of saved user audio to improve recognition technologies, and that access is restricted to staff who need it. It does not specifically address human review of Gemini prompts and responses — that would be in the Gemini Apps privacy notice, which was not retrieved.

The policy openly discloses that Google receives and responds to government and law enforcement requests for user data, states it reviews and pushes back on overly broad requests, and publishes a Transparency Report. This transparency is favorable, but the routine disclosure of user data to governments is an inherent exposure users should note.

The policy documents collection of a very broad range of PII (name, phone, address, IP, device identifiers, precise geolocation, activity, communications) and explicitly enumerates SPI categories including biometric information, health information, and demographic data such as race/ethnicity. While disclosure is detailed and much SPI is optional/consent-based, the breadth of sensitive data collected across the Google ecosystem is extensive.

The Privacy Policy is dated effective May 26, 2026 — well within 12 months of the analysis date — and it explicitly addresses AI/ML processing, model training, and Gemini Apps. However, no PRODUCT SURFACE was supplied to confirm coverage of Gemini's current capabilities, so under the INSUFFICIENT EVIDENCE RULE the rating is capped at YELLOW despite the strong recency.

Two documents were supplied, but Document 1 is essentially a landing page of links (not substantive policy text) and Document 2 is the full Privacy Policy; the actual Terms of Service, Gemini Apps privacy notice, and any DPA were not retrievable. With only one substantive policy document to compare, a meaningful cross-document check is not possible and no contradictions were identified in the available text.