Google has amended its privacy policy to state explicitly that data users share with personalised AI features in Search or Gemini can be used to serve targeted ads based on their activity across other connected Google services. The Hacker News reported the update, quoting the new policy language as telling users: "You may choose to allow certain Google services, including services like Search or Gemini Apps, to access data from other Google services you use," with that data potentially used for ad personalisation. The report's headline frames this as Gmail and Photos data shared with AI search; the policy excerpt itself refers more generally to data from other connected Google services, and that scope should be confirmed against the full wording.
For Hong Kong organisations that hold staff and customer mail in Google Workspace, the change lands as a documentation event that nonetheless sharpens a live compliance question: what exactly is now in writing, and whose obligation it is.
A documentation change, not a new data flow
The report does not describe any new data pipeline being built. Cross-service sharing between Google products and its ad business has existed for years and has been litigated in other jurisdictions. What is new is the explicit extension of that language to conversational AI, where a prompt such as "my mother's chemotherapy appointment" carries far richer personal detail than a keyword search ever did.
The ambiguity that matters most
One unresolved point should be stated plainly rather than buried: Google's current public wording does not make clear whether corporate Workspace tenants fall within the scope of consumer ad personalisation at all. That should be checked directly against Google's enterprise terms and privacy notice before any internal escalation, not against secondary summaries of this policy change.
If enterprise tenants are excluded, the risk for Hong Kong companies sits elsewhere: personal Google accounts connected to Gemini, shadow-AI usage by staff, and AI feature defaults chosen years ago for convenience — that is, the areas admins are not looking at. If they are not excluded, or the position remains ambiguous, the corporate-tenant framing above stands. Either way, admins should treat the scope question as unresolved until primary sources confirm it.
Where PDPO exposure appears to sit
On the face of the Ordinance, the notification and purpose-limitation duties appear to rest with the Hong Kong organisation that collects the data, not with Google. Under the s.6(2) agency framing, the local company is more likely the data user; Google is more likely a processor in the commercial relationship.
Two principles apply. DPP1 requires the purposes of collection to be stated openly to the data subject, typically through the personal information collection statement (PICS). DPP3 restricts subsequent use to those purposes unless prescribed consent has been given. Whether advertising-informed use of staff mail would fall outside a PICS as currently drafted is a question for a PDPO practitioner, not a finding this article can assert.
Note also that the PDPO contains no GDPR-style accountability principle. The practical expectation that organisations document their data decisions derives instead from the codes of practice and AI/new-technology guidance issued by the Privacy Commissioner for Personal Data (PCPD), which should be treated as the reference point in any audit.
A Workspace admin review checklist
- Audit feature availability. Review tenant-level Gemini and AI-in-Search settings, and confirm what data each feature can draw on and where it goes.
- Reconcile the PICS. Compare the organisation's personal information collection statement against Google's updated policy wording; amend where stated purposes have drifted (DPP1).
- Brief the sensitive functions. HR, legal and finance staff who paste personal records into AI tools need to understand that personal Google accounts connected to Gemini create pathways corporate policy may not cover.
- Document decisions. Record enable/disable choices and the rationale, aligning with PCPD codes of practice and AI guidance; review retention schedules separately under DPP5 and access controls under DPP4.
- Check the opt-out surface. Consumer-side controls such as My Ad Center and activity settings sit alongside Workspace admin switches over AI feature rollout. Defaults chosen for convenience may no longer match the organisation's risk appetite.
The scope question above should be resolved against Google's enterprise terms first; everything else in the checklist can proceed regardless of the answer.
Google 已修訂其私隱政策，明確指出使用者在 Search 或 Gemini 個人化 AI 功能中提供的數據，可用於按其在其他已連接 Google 服務上的活動投放定向廣告。The Hacker News 報道了是次更新，並引述新政策條文向使用者表示：「You may choose to allow certain Google services, including services like Search or Gemini Apps, to access data from other Google services you use」，該等數據可能用於廣告個人化。報道標題將此事框定為 Gmail 及相片數據交予 AI 搜尋；政策節錄本身則較籠統地指向其他已連接 Google 服務的數據，有關範圍應對照完整條文予以確認。
對於在 Google Workspace 存放職員及客戶郵件的香港機構而言，此項變更雖屬文件層面的事件，卻令一個持續存在的合規問題更為尖銳：如今白紙黑字寫下的究竟是甚麼，以及責任落在誰人身上。
文件層面的變更，而非新的數據流
報道並未描述任何新建的數據管道。Google 產品與其廣告業務之間的跨服務共享已存在多年，並曾在其他司法轄區對簿公堂。新出現的是該套條文被明確延伸至對話式 AI——「我母親的化療預約」這類 prompt 所攜帶的個人資料詳盡程度，遠非關鍵字搜尋可比。
最關鍵的含糊之處
有一點懸而未決，與其含糊帶過，不如明言：Google 現行公開條文並未清楚說明企業版 Workspace 租戶是否根本落入消費者廣告個人化的範圍之內。任何內部向上通報之前，應直接對照 Google 的企業條款及私隱通告查證，而非依賴針對是次政策變更的二手摘要。
若企業租戶獲豁免，香港公司的風險所在便在別處：已連接 Gemini 的個人 Google 帳戶、員工使用影子 AI，以及多年前為求方便而揀選的 AI 功能預設值——亦即管理員平時不會檢視的範疇。若並未獲豁免，或情況仍然含糊，則上述企業租戶的框架依然成立。無論如何，在一手資料予以證實之前，管理員應將範圍問題視為未有定論。
PDPO 風險所在
從條例表面看，告知及目的限制的責任，似乎落在收集數據的香港機構身上，而非 Google。根據第 6(2) 條的代理框架，本地公司較可能屬 data user；在商業關係中，Google 更可能屬處理者。
兩項原則同時適用。DPP1 要求向資料使用者公開說明收集目的，通常透過收集個人資料聲明（PICS）進行。DPP3 則限制其後用途須限於上述目的，除非已取得條例訂明的同意。以廣告用途使用職員郵件是否超出現行 PICS 所載範圍，須由 PDPO 執業人士判斷，並非本文可以斷言的結論。
另須注意，PDPO 並無 GDPR 式的問責原則。機構須記錄其數據決定的實際期望，源自個人資料私隱專員公署（PCPD）頒布的實務守則及其 AI 及新科技指引，應視為任何審核的參考基準。
Workspace 管理員檢視清單
- 審核功能可用範圍。 檢視租戶層級的 Gemini 及 Search 內 AI 設定，確認每項功能可取用哪些數據及其流向。
- 核對 PICS。 將機構的收集個人資料聲明與 Google 更新後的政策條文對照；如所載目的已出現偏移，則加以修訂（DPP1）。
- 向敏感部門作出說明。 慣於把個人資料記錄貼入 AI 工具的人力資源、法務及財務人員，須理解已連接 Gemini 的個人 Google 帳戶會產生企業政策未必涵蓋的途徑。
- 記錄決定。 記錄啟用／停用的選擇及理據，與 PCPD 實務守則及 AI 指引保持一致；另按 DPP5 檢視保存期限安排，按 DPP4 檢視存取控制。
- 檢查退出機制。 My Ad Center 及活動設定等消費者端控制，與 Workspace 管理員就 AI 功能推出的開關並存。當年為求方便揀選的預設值，可能已不再配合機構的風險承受度。
上述範圍問題應先對照 Google 企業條款解決；清單上的其餘各項，無論答案為何均可照常進行。