Google recently launched an AI-driven search feature for Gmail, promising a more efficient way to find emails. Instead of just listing messages in order, it prioritises what it deems most relevant, supposedly cutting through inbox clutter.
While this may sound like a time-saver, privacy concerns are cropping up. Users are questioning what data Google collects, how long it stores it, and whether AI is now combing through their personal conversations.
A December 2023 survey by StartMail found that 95% of respondents worry about AI’s impact on privacy, and more than 40% are deeply concerned about AI scanning their emails.
Now the question is: ‘does Google’s latest foray into AI offer a welcome convenience, or does it risk users’ privacy?’
How the AI-Powered Search Works
While Google publicly refers to this update as “AI-enhanced search,” many suspect it runs on the company’s Gemini AI platform. The new Gmail AI search approach goes beyond simple keyword matching by considering factors such as recency, the frequency with which you click on emails from certain senders, and your regular contacts.
For example, if you search “reservation,” the AI might rank booking confirmations (like flight details or restaurant receipts) at the top.
By default, Gmail now sorts results under “Most relevant,” but users can switch to a “Most recent” view for a traditional chronological list. Some users report that this relevance-based ranking is a lifesaver for crowded inboxes, while others worry that changing the order may hide brand-new emails or obscure why certain messages are prioritized.
Gemini AI’s Data Practices
Google emphasizes that it does not use general Gmail content for training its AI models without permission. However, if you actively invoke an AI feature (for example, asking the AI to summarize an email or draft a reply), that content is processed to deliver the requested service.
The following table, curated with reference to insights from Topview.ai, summarizes the key data practices:
| Data Collected | How It’s Used | Retention | Potential Privacy Risk |
| Chats (including recordings of Gemini Live interactions), shared files, images, screens, product usage info, feedback, location data (device area, IP address, home/work addresses) | Provide, improve, and develop Google products, services, and machine-learning technologies, including Google Cloud | Up to 18 months (default, configurable to 3 or 36 months) in the Gemini Apps activity setting (Activity is on by default for 18+ users, optional for under 18) |
Potential unintended exposure or misuse |
| Conversations reviewed by human annotators (anonymized before review) | Improve quality and generative machine-learning models; human reviewers (including third parties) read, annotate, and process | Up to 3 years for reviewed/annotated data | Risk of unauthorized disclosure of anonymized data |
| Data collected even if Gemini activity is turned off | Provide core services and address technical issues | Up to 72 hours | Data is still collected, raising concerns over control. |
| Device assistant data (dialler, call/message logs, contacts, installed apps, screen content, smart home device names, playlists, etc.) | Personalize experiences and respond to user requests, accessed via system permissions and Google Assistant | Not specifically disclosed | Possibility of deep profiling of user habits |
| Supplemental features data (e.g., Gem names, custom instructions) | Collected and used to improve Google AI with human reviewers | Not specifically disclosed | Potential unintended exposure or misuse |
| Data shared with other Google or third-party services | Enhance cross-platform service quality | Varies by service policies | Increased data exposure across platforms |
Key clarifications:
- If you delete an AI conversation or turn off the “Gemini Apps Activity,” Google still retains recent interactions for up to 72 hours to facilitate service delivery and process feedback.
- A small percentage of chats may be selected for quality review (with personal identifiers removed) and could be stored for up to 3 years even if you delete your history.
- Although Gmail’s general inbox content is not automatically used for AI training, any snippet you provide to the AI (for instance, to generate a summary) is processed and stored for model improvement.
Public Sentiment
The StartMail survey highlights widespread concern about AI scanning private correspondence.
Ninety-five percent of respondents are worried about the broader privacy implications of AI, and over 40% are specifically concerned about AI reading personal emails.
Many experts believe that confusion over how AI processes and retains data contributes to this mistrust, especially when details are hidden in lengthy privacy policies.
“Integrating powerful AI into something as universally used as Gmail requires clear communication. While the ability to rank important emails is beneficial, Google must clearly define how long user data is retained, why it is kept, and who ultimately has access. Without that clarity, user trust is at risk.” – AI Analyst at Topview
Recommendations for Users
- Check Your Search Preferences
- Gmail defaults to “Most relevant.” If you prefer a traditional chronological view, you can switch to “Most recent” with a simple click.
- Review Gemini AI Activity Settings
- In your Google Account’s privacy controls, you can pause or delete AI interactions to limit data retention. By default, AI chat data is stored for up to 18 months, though you can adjust this setting to 3 months or up to 3 years.
- Stay Cautious with Sensitive Content
- Avoid using the AI to summarize or handle highly confidential emails. Once processed, the content may be stored for model improvement even if it is anonymized.
Google’s Gmail AI search offers a smoother and more efficient email experience by leveraging advanced algorithms to surface key messages. However, the balance between convenience and privacy remains a key issue.
As AI becomes increasingly integrated into everyday tools, users must decide whether the benefit of faster, more intuitive email search outweighs the potential privacy risks. The responsibility falls on both Google to maintain transparency and on users to actively manage their privacy settings.
