You tap Restore from backup on a new Android phone. Gmail repopulates. Maps offers "home" before you type it. YouTube on the TV resumes mid-video. One Google Account linked those moments, and the Privacy Policy at policies.google.com/privacy is where Google describes how that linking works.
Google lists the policy as effective October 16, 2026. We are not publishing a full line-by-line diff in this piece. What matters for everyday users is what the current text says out loud: Gemini Apps, cross-service personalization, and AI model training show up in the main policy, not only in a buried product FAQ. That is the kind of language worth putting on your watchlist when the policy changes.
This summarizes public Google privacy language Clerica monitors. It is not a device security audit or a guide to leaving the ecosystem overnight.
What Google Collects (and Where It Goes)
Think in lanes, not icons.
Signed in, Google describes saving and using activity across Search, YouTube, Maps, Gmail, Drive, Photos, Android, and Chrome: queries, watch history, locations you permit, files you store, and device signals like app version and IP.
Signed out, Google still describes cookies, device identifiers, and partner signals on sites that use AdSense, Analytics, or embedded YouTube players. Your activity on those sites may be associated with your personal information depending on account settings.
Location flows from Maps permissions, device sensors, Wi-Fi access points, and cell towers. Turn-by-turn navigation and "restaurants near me" sit in the same policy chapter as background signals you may not picture when you leave location on for one app.
The October 2026 policy also describes optional links between products, such as allowing Search or Gemini Apps to use data from Gmail, Drive, or Photos for a more personalized experience, subject to each product's controls.
Who Google Shares Your Data With
Google's disclosure list is long because its business touches publishers, advertisers, and developers, not only you.
The policy names people you choose to share with (shared docs, YouTube comments, Fitbit social features), third parties with your consent (apps connected to your Google Account), service providers processing on Google's instructions, domain administrators for school or work accounts, and law enforcement when Google believes disclosure is legally required.
On the web you do not "visit Google" so much as meet Google on someone else's page:
"Many websites and apps partner with Google to improve their content and services. For example, a website might use our advertising services (like AdSense) or analytics tools (like Google Analytics), or it might embed other content (such as videos from YouTube). These services may share information about your activity with Google and, depending on your account settings and the products in use (for instance, when a partner uses Google Analytics in conjunction with our advertising services), this data may be associated with your personal information."
That sentence is why your off-Google browsing can still land in the same account graph as your signed-in Search history.
Ads and measurement get their own business-purpose section: online identifiers, browsing activity, location, and ad interactions keep many services free and fund the targeting you see in Gmail, YouTube, and partner sites.
Clerica's Google tracker archives public policy text when these sharing sections move.
What You Cannot Opt Out Of
Google's policy foregrounds My Account controls. They are real. They are also not an off switch for having a Google Account.
"You can use our services in a variety of ways to manage your privacy. For example, you can sign up for a Google Account if you want to create and manage content like emails and photos, or see more relevant search results. And you can use many Google services when you're signed out or without creating an account at all, like searching on Google or watching YouTube videos." — from Google's Privacy Policy (effective October 16, 2026)
You can turn off Web & App Activity, Location History, or YouTube History, and tune Ad Settings. The policy still contemplates processing for security threats, auditing and measurement, maintaining services, legal reasons, and advertising as described in its business-purpose sections.
Signed out, you may still receive customized Search results unless you browse privately or disable signed-out customization. Signed in, Google may show Search results drawn from Gmail, Calendar, and other products when settings allow.
Workspace and Google Cloud add separate agreements. Your personal Pixel can still sync under the consumer policy while work mail answers to an admin you have never met.
The Clauses That Should Worry You
Cross-service use is explicit. Google gives concrete examples of mixing Search with mail, calendar, and photos when you are signed in and settings permit it.
AI development is explicit too. Under research and development, Google states:
"For example, we use publicly available information to help train Google's AI models and build products and features like Google Translate, Gemini Apps, and Cloud AI capabilities."
A separate section on publicly accessible sources repeats that training example. Product-specific AI settings may limit some flows, but the base policy frames model improvement as a stated purpose.
Retention and deletion still allow backups, legal holds, and abuse investigations after you remove content. Policy updates post with effective dates; continued use is how many services operationalize acceptance.
They count on you treating "I turned off ads personalization" as the same thing as "I read section 11."
Sam never opened policies.google.com. After restoring a new phone, Sam's signed-in YouTube queue, Maps labels, and Gmail threads reappeared anyway. The policy's cross-service examples describe exactly that kind of linked profile, whether Sam opted into reading them or not.
What You Can Do Before You Click "Agree"
You already agreed. These steps still matter:
- Visit myaccount.google.com and re-read Data & privacy, especially cross-product settings tied to Search and Gemini.
- Split work and personal accounts where you can, and note which policy governs each profile.
- Add google.com to a Clerica watchlist and watch for edits to AI, sharing, location, and retention sections, not footer years.
FAQ
Is the October 16, 2026 policy a dramatic rewrite?
We are not claiming a full diff in this article. The live document's effective date is a signal to re-read AI, cross-service, and partner site sections. When the effective date moves, re-read the AI, cross-service, and partner site sections instead of trusting memory.
I opted out of personalized ads. Am I done?
The policy still describes advertising, measurement, security processing, and service operation. Controls narrow lanes; they do not dissolve the account relationship.
Does Google "sell" my data?
U.S. state sale definitions appear in separate notices where Google provides them. Read those supplements with the main policy.
Why does Maps still know my commute?
Location can come from permissions, sensors, and IP depending on settings. Disabling one history type does not remove every signal the policy describes.
How is monitoring different from a privacy checklist?
Checklists summarize once. A watchlist diffs the next time Google edits policies.google.com before two billion accounts notice.
What you do with this
Convenience trained you to one login. The policy is written for everything that login touches.
Whose rules are you really following?
If you care about keeping your knowledge private, join us.
Clerica monitors publicly available privacy policies and terms for services you choose to follow. Google and its marks are trademarks of their respective owners. Clerica is not affiliated with or endorsed by Google. Clerica is not a law firm and does not provide legal advice.