Google’s Privacy Policy and Your Gmail and Photos Data: Ads, Search, Gemini and the Gulf and Egyptian Data Laws

Reading time 7 min
Summarize with AI
Oct. 29, 2026

Google’s privacy policy, effective 16 October 2026, says it does not show personalised ads based on your content from Gmail, Google Drive or Google Photos. It also says you can let other services use that data, and Gemini’s Personal Intelligence is built on exactly that choice. For readers in Saudi Arabia, the UAE and Egypt, three data laws sit on top of it. We read all four sources on 29 October 2026.

What does Google’s privacy policy say about Gmail and Photos data and ads?

The policy states that Google does not show personalised ads based on your content from Drive, Gmail or Google Photos, unless you choose to make that data available to services that support personalised ads. Ad settings are managed in My Ad Center, and the policy says sensitive categories such as health or religion are not used for personalised ads.

Read the sentence carefully. It excludes content from those three products, and it leaves room for a user choice. It does not say that your Search activity, location or YouTube history stay out of ad personalisation, and we did not read it that way. Those signals are governed by your Ads personalisation setting, which you manage in My Ad Center, linked from Google’s privacy policy.

How does Search use data from your other Google services?

The policy says you may choose to allow certain Google services to access data from other Google services, so that Search can give a more personalised experience. It uses the same wording for Gemini Apps, which may access data from other services if you allow it. The policy frames this as something you switch on.

We could not open Google’s Search help page on personalisation during this check, so we do not describe what each Search toggle does. What the policy establishes is the direction: connecting services is a user choice, and the choice is the legal hinge in all three countries below.

What is Gemini Personal Intelligence and who can use it?

Personal Intelligence lets Gemini connect Gmail, Photos, Search and YouTube so its answers can use your own data. Google’s page calls it a beta that you opt into app by app. It is for users 18 and over on personal accounts, not Workspace business or education accounts, and the page excludes the European Economic Area, Switzerland, the UK and Nigeria.

Two gaps matter for marketers. The page does not say whether the connected data is used to train models or for ads, and it gives no Arab-country list. Saudi Arabia, the UAE and Egypt are not among the named exclusions, but we cannot confirm which accounts are eligible today. The Photos image feature is described as available to eligible US users only.

All three treat consent as a core ground for processing personal data, and all three let a person withdraw it. Saudi Arabia requires freely given consent for each purpose, the UAE requires a clear opt-in, and Egypt requires explicit consent with a right to withdraw. Direct marketing carries extra rules in Saudi Arabia and Egypt.

Point	Saudi Arabia (PDPL)	UAE (Federal Decree-Law 45/2021)	Egypt (Law 151/2020)
Status found on 29 Oct 2026	In force 14 Sep 2023, fully enforceable from 14 Sep 2024	Law in force from 2 Jan 2022; executive regulations not found issued	Executive Regulation 816/2025 issued 1 Nov 2025
Consent standard	Freely given, separate for each purpose, withdrawable at any time	Clear positive statement or action (opt-in)	Explicit consent (Art. 2), withdrawable
Sensitive data	Explicit consent; no legitimate-interest route	Covered, detail not confirmed	Licence plus written explicit consent (Art. 12)
Direct marketing	Simple opt-out (Art. 26 as cited)	Right to object to direct marketing	Prior consent, sender ID, opt-out; consent records kept 3 years (Arts. 17, 18)
Penalties found	Fine up to SAR 5 million (administrative); up to 2 years and SAR 3 million for harmful disclosure of sensitive data	None stated in the law itself, left to regulations	EGP 200,000 to 2 million for marketing breaches (Art. 43)

Sources: Securiti summary of the Saudi PDPL and Clyde and Co, September 2024; Clyde and Co, November 2021 and DLA Piper, January 2025 for the UAE; the Law 151/2020 text on Andersen’s site and Al Tamimi on the executive regulations for Egypt. Law-firm and vendor summaries are secondary sources, so check the official text before you rely on a number.

Does a Google setting satisfy these laws for your business?

No. Google’s controls govern what Google does with a user’s own account data. They say nothing about your obligations as a business that collects leads, runs retargeting or emails customers in these markets. Your consent records, privacy notice and marketing opt-outs must meet the local law on their own, whatever the user chose inside Gmail or Gemini.

The practical point for advertisers is that the user’s choice inside Google and the consent you collect are separate. A person who allows Gemini to read their Gmail has not agreed to your marketing. Keep your own consent log, make opt-out one step, and check that your Google Ads audience lists were built from consented data. Our piece on what Google’s AI Overviews cite in Arabic shows how little control a publisher has once the summary is built.

Our read

The policy sentence about Gmail, Drive and Photos is narrower than headlines suggest, and it rests on user choice. We would not tell a client that their customers’ emails feed ad targeting, and we would not tell them it never could, because it depends on a setting each user controls.

The bigger risk for Arab-market brands is closer to home: marketing consent. Egypt’s fines for marketing breaches and Saudi Arabia’s administrative fines are real, and the UAE’s rules still lack executive regulations, which makes the UAE the hardest to plan for. Treat that as a gap to watch, not as permission. We have not tested any Google setting inside an account for this piece, and this is not legal advice. Ask a lawyer in each country before you change how you collect consent.

FAQ

Does Google use my Gmail content to personalise ads?

Google’s policy, effective 16 October 2026, says it does not show personalised ads based on your content from Gmail, Drive or Google Photos, unless you choose to make that data available to services that support personalised ads. You can review ad controls in My Ad Center. We did not test an account.

Is Gemini Personal Intelligence available in Saudi Arabia, the UAE and Egypt?

Google’s page lists exclusions for the European Economic Area, Switzerland, the UK and Nigeria, and does not name Arab countries. It is a beta for adults on personal accounts. We cannot confirm account-level eligibility in each country, so check inside your own Gemini settings before you rely on it.

Which law applies if I use Google’s tools to market to users in Egypt?

Egypt’s Law 151/2020 and its executive regulation apply to processing personal data of people in Egypt, and the law’s marketing articles require prior consent and an opt-out. We are not lawyers, and which law applies to a specific campaign depends on where you and your audience are. Ask counsel.

Does the UAE have a working federal data protection regime?

The federal law was issued in 2021 and the sources we read say its executive regulations had not been issued, and its Data Office had not been established, as of early 2025. We found no source confirming they have since appeared. Check the UAE Data Office or a local lawyer for the current position.

Can I turn off personalisation that uses my other Google services?

Google’s policy says connecting services to Search or Gemini is something you choose to allow, and your ad settings are in My Ad Center. We could not open Google’s Search help page during this check, so we do not list the exact toggle names. Look in your Google Account’s data and privacy settings.

Before you change how your business collects consent in Riyadh, Dubai or Cairo, ask me for a tracking and consent review that you can hand to your lawyer.