Google Gemini AI can data-mine you and now, your Google Workspace. Can pirates weaponize this?

Sponsor ad - 728w x 90h (at 72 dpi)

Google announced new features that connect data generated by group members within a Google Workspace to the Gemini Deep Research assistant in Google’s Gemini generative AI platform; enabling it to generate a result by synthesizing data scaped from the Internet with Workspace data.

It also means that the administrator of a Google Workspace in a business account has the ability to access to a group member’s Gmail, Docs, Drive and Chat content, and then “think through its findings, and create insightful multi-page reports in minutes.”

Sponsor ad

Says Google:

“Now you can start a market analysis for a new product by having Deep Research analyze your team’s initial brainstorming docs, related email threads and project plans. Or you can build a competitor report about a rival product that cross-references public web data with your strategies, comparison spreadsheets and team chats.”

Google Deep Research is available for all Gemini users – not just Workgroup users.

Further details

Announced on November 5, 2025, it’s the latest extension of the Gemini Deep Research feature, which was announced in December 2024 as part of Gemini Advanced. “To get started, just select ‘Deep Research’ from the Tools menu in Gemini on desktop and select your sources,” said Google.

Image is derived from an online demo designed for illustrative purposes only. Image source: Google

Google does disclose what Gemini collects, how it is used, who it is shared with and how long the data is retained is posted by Google.

Collected data includes:

  • Information you provide Gemini Apps: What you say to Gemini Apps (like the prompts you submit or speak). This includes what you share with Gemini Apps (like files, videos, screens you ask about, photos, and page content you share from your browser); Transcripts and recordings of your interactions with Gemini Live (including audio, video and screens you share with Live), your feedback and instructions
  • Content that Gemini Apps generates (like text, code, audio, images, video, public links, citations, chat summaries and personalized insights)
  • Information from your apps, browsers, and devices
  • Information collected through supplemental Gemini Apps features you opt into.
  • Location information from your device, IP address, or Home or Work addresses in your Google Account
  • Subscription information

Google uses this data, as described in its Privacy PolicyGoogle claims that it does not sell personal data if the user is opted out, or in jurisdictions that prohibit its sharing or sale to third parties, such as the European Union, and the states of California, Nevada and Washington

Opting out of Deep Research

Google provides a Gemini Settings landing page leading to detailed instructions as to how a user might opt out.  These settings include:

  • Disable ‘Smart Features’ for Workspace to prevent access to Gemini Live chats, the transcripts, audio, files, images, & YouTube videos, and any video or screenshares you choose to share with Live are saved in Gemini Apps Activity if your Keep Activity setting is on. 
  • Manage Gemini Apps activity by going to the Gemini Apps Activity page
  • In business and school accounts, disable specific product integrations to turn off Gemini as a core service or disable specific features and the side panel in apps like Gmail, Drive, Docs, Meet, and Chat.
  • Change auto-delete settings. Gemini Apps activity older than 18 months is auto-deleted. You can turn off Auto-delete or change the auto-delete period to 3 or 36 months

There is no setting to completely disable Deep Research, but according to a responder in Google Support, it can be temporarily disabled.

Users must also turn off “Use Gemini” in Google Photos, Chrome, “Other Google Products.”  It’s also useful to turn off AI summaries in Google Search by adding ‘-ai’ in your search queries, and for Android, extensions are available.

Also, if the admin of a user’s Google Workspace group happens to be the user’s boss, and company policy permits the boss access to user data as part of employee monitoring, the user’s ability to manage these settings could be limited.

It isn’t easy

Like all Google settings, these steps are likely not obvious to the average user.  If that user is accessing these features through Google software (e.g. Chrome or a Google app), data management is entirely within Google’s domain.

For Android, “Gemini is replacing the Google Assistant on many Android phones, and while you can manage its activity, it may not be possible to completely remove it from your device,” said Google

Why it matters

Beyond the privacy concerns, could an enterprising attacker breach the platform and access this data?  The connection between Workgroups and Deep Research implies that the data is private within the Google Workgroup.  Since the platform is hosted by Google, the probability of a breach is likely to be low.

Google says that “Gemini does not share your content outside your organization … and is not human reviewed or used for Generative AI model training outside your domain, without your permission.” But Google has also developed a reputation for not respecting opt-out choices by users.  This situation is even more concerning in Europe with its General Data Protection Regulation (GDPR)

But there’s another concern: Google’s business model is advertising. Can Deep Research data be used by Google itself, to fuel personalized advertising, and who might this data be sold to if the user hasn’t opted out – or even if they have? What happens if data collected by Deep Research is used to build personality profiles for ad targeting.

Once that data is sold, it may be weaponized if it falls into the hands of piracy attackers running end-user marketing campaigns that result in data exfiltration or implanting malware

Further reading

Gemini Deep Research can now connect to your Gmail, Docs, Drive and even Chat. Announcement. November 5, 2025. The Keyword blog. Google.

Generative AI in Google Workspace Privacy Hub. Informational. November 4, 2025 update. Google Workspace Admin Help. Google

Gemini Apps Privacy Hub. Landing page. Accessed November 6, 2025. Gemini Apps Help. Google

Manage & delete your Gemini Apps activity. Landing page. Accessed November 6, 2025. Gemini Apps help. Google.

Try Deep Research and our new experimental model in Gemini, your AI assistant. Announcement. December 11, 2024. The Keyword blog. Google.

From our Sponsors