Is Gemini Private? What Google Keeps, and Who Can See It

Is Gemini private enough for privileged client data? No. Gemini is private only to the degree a firm configures it to be: activity saving off, temporary chats, or Workspace terms that restrict training. In its default state Gemini keeps chats for 18 months and sends a sample to human reviewers.

Whether Gemini is private in practice turns on the account rather than on the model, and the gap between a consumer Gemini account and a managed one is where the confidentiality duty that firms practicing on third-party paper carry actually applies. This article covers how long Google keeps Gemini chats private, who can read them, which Gemini privacy controls a user can switch off, what Gemini retrieves inside Google Workspace, whether using Gemini risks attorney-client privilege, which Gemini version is private enough for client data, and how a firm uses Gemini without exposing a client.

[cta-1]

Key takeaways

1. Gemini does not keep your data private by default. Google keeps Gemini chats for 18 months, sends a sample to human reviewers, and keeps reviewed chats for up to three years.
2. Only a Workspace or Vertex AI account carries contractual terms barring model training.
3. Gemini reaches whatever Drive content the user can already open, so an overshared matter folder becomes an overshared answer.
4. Chats a human reviewer has read survive deletion of the activity, which makes the control that matters the one applied before a prompt is sent rather than after.

How long Google keeps your Gemini chats

How long does Gemini keep your data? For 18 months by default, and longer in two cases that matter. The auto-delete window can be set to 3 months, 36 months or indefinite. Chats a human reviewer has read are retained for up to three years and survive deletion of the activity, and temporary chats are kept for 72 hours.

Google sets out all four windows on its Gemini Apps Privacy Hub, and the hub states the retention asymmetry in its own words: "Chats reviewed by human reviewers (and related data like your language, device type, location info, or feedback) are not deleted when you delete your activity. Instead, they are retained for up to three years."

The four retention windows

1. Default auto-delete for saved activity: 18 months from the date of the chat.
2. User-selectable alternatives: 3 months, 36 months, or saved until the user deletes it.
3. Chats routed to human review: up to three years, and not removed when the user deletes the activity.
4. Temporary chats: 72 hours, after which Google states they are deleted.

The 36-month figure circulates as though it were the standard. It is the longest option a user can select, not the default, and selecting a shorter window changes only what Google deletes going forward.

Why deleting activity is not the control

A policy instructing lawyers to clear Gemini activity weekly looks like a control and is not one, because the three-year reviewer copy sits outside the activity record the instruction deletes. The control with effect is applied to the prompt before it leaves the lawyer's hands: what goes in decides what can be retained, and no retention setting undoes a disclosure after the fact.

Who can see your Gemini conversations

Who can see your Gemini conversations depends on the account. On a consumer account, human reviewers at Google and at its service providers read a sample of chats. On a managed Workspace account, a firm's administrators can reach the same conversations through audit logs and Vault retention.

What human reviewers see

Google's privacy hub states that "Human reviewers (including trained reviewers from our service providers) review some of the data we collect", and it asks users not to enter confidential information they would not want a reviewer to see. Google disconnects conversations from the user's account before a reviewer reads them, which reduces the identifiability of a chat without reducing the content of it. De-identification removes the account name; it does not remove the text of the clause.

Who can reach prompts on a managed account

On a managed account, Gemini activity sits inside the same administrative surface as Gmail and Drive, so Google Vault retention rules and eDiscovery search reach it alongside everything else in the domain. Several questions follow:

1. Which administrators hold the Vault privilege, and whether that assignment matches the firm's conflicts and ethical-wall expectations.
2. Whether the firm's retention schedule names Gemini activity at all, or leaves it on the Workspace default.
3. Whether a litigation hold that preserves email is understood to preserve prompts about the same matter.
4. Whether a departing user's Gemini activity survives offboarding, as mailbox content does.
5. Whether prompts are in scope for the firm's information-security policy, or only mail and documents are.

Firms usually reach the discovery question after Gemini is already in use. A firm that would preserve a custodian's mailbox on a hold has to decide whether the same hold reaches that custodian's prompts, and prompts on a managed account are records in the same system.

Can you stop Gemini from saving your prompts

You can stop Gemini from saving your prompts, and the controls are not all equivalent. Turning off the Keep Activity setting stops future chats from being saved or used to improve Google services. Temporary chats are not saved to history and are not used for human review. Google still retains both for 72 hours to respond to the user and to protect the service.

The setting is called Keep Activity in the current interface, and the older label Gemini Apps Activity still appears in some help pages for the same control.

What each control does not reach

1. Turning Keep Activity off governs chats from that point forward. It does not reach a chat a reviewer has already read, which stays on the three-year clock.
2. A temporary chat is excluded from history and from human review, and still carries a 72-hour retention window. It also uses the recent part of the same session as context, so it is not a clean break between questions.
3. Shortening the auto-delete window changes the deletion date for future activity. It does not purge what is already saved under a longer setting.
4. None of the three controls changes who can reach activity on a managed account, which the firm's own retention rules govern.

The strongest consumer-side configuration still leaves a 72-hour window and a reviewer path no settings page closes, which is why the account tier matters more than the switches do.

Does Gemini reach your Google Workspace files

Gemini has access to the Google Workspace files the signed-in user can already open. Google states that Gemini only retrieves content in Workspace the user has access to, which means Gemini inherits a firm's existing sharing permissions rather than adding its own. An overshared matter folder therefore becomes an overshared Gemini answer.

What Google commits to

Google's Workspace AI documentation states that "Gemini only retrieves relevant content in Workspace that the user has access to", and the same page states that customer data remains the customer's own and is not used to train Gemini models or for ads targeting. That is a permission-respecting retrieval model rather than a new exposure surface.

The control is a Drive sharing audit

The exposure is the permissions themselves. A matter folder shared to the whole domain three years ago so one colleague could open a single exhibit is invisible in day-to-day work, because nobody browses to it. It stops being invisible the moment an associate asks Gemini a question the folder happens to answer. The checks that matter most:

1. Audit domain-wide and anyone-with-the-link sharing across matter folders, and close what no current matter needs.
2. Decide which organizational units get Gemini at all, rather than enabling it domain-wide and auditing afterwards.
3. Re-run the sharing audit at matter close, where stale permissions accumulate.
4. Archive shared drives holding closed matters rather than leaving them open to the domain.

Connected apps sit outside the commitment

Google's privacy hub states that "Google does not monitor or secure data from custom third-party Connected Apps", and names third-party servers connected through the Model Context Protocol among them. A firm permitting connected apps is accepting a third party's controls rather than Google's.

What Google's contract says about prompts and client data

Gemini enterprise data protection is set by contract rather than by a settings page. Google Cloud's Service Specific Terms provide that absent the customer's prior permission or instruction, Google will not store prompts or generated output outside the customer's account for longer than is reasonably necessary to create the output. The same terms disclaim that generative AI services are not designed for or intended to meet a customer's regulatory or legal obligations.

The two clauses that matter

Both sit in section 20 of the same document, and the two clauses cover different ground. Section 20(h) provides: "Absent Customer's prior permission or instruction, Google will not store outside Customer's Account (i) Customer Data prompted to a Generative AI Service for longer than is reasonably necessary to create the Generated Output, or (ii) the Generated Output." Section 20(b) provides: "Generative AI Services ... are not designed for or intended to meet Customer's regulatory, legal, or other obligations." Google publishes both in its Service Specific Terms.

Where the duty stays

The storage clause is a real obligation and a strong one, and it is why a Vertex AI project is a different proposition from a consumer chat window. The disclaimer says the service is not built to carry the firm's professional obligations, so nothing in the enterprise terms moves the confidentiality, supervision or competence duty to the vendor.

The Workspace training position

On the Workspace side, Google's AI documentation states that customer data is not used to train Gemini models or for ads targeting, which closes the training question consumer terms leave open. What the terms provide and what a settings page suggests are different things, and the terms are the ones a counterparty or a regulator reads.

Does using Gemini waive attorney-client privilege

Using Gemini does not waive attorney-client privilege by itself, and it can put the privilege at risk in a way that is hard to undo. Privilege depends on confidentiality being maintained, so disclosing privileged content to a third party that reads, retains or reviews it is the exposure. Google's own guidance asks users not to enter confidential information into Gemini and says not to rely on it for legal help.

The disclosure is the risk, not the tool

The two are often discussed interchangeably, but they are different questions. Whether a disclosure defeats the privilege turns on the familiar questions: whether the communication was made in confidence, whether the holder took reasonable steps to keep it confidential, and whether a third party's access was consistent with those steps. A consumer account in which a sample of chats is read by reviewers at Google and at its service providers is a harder set of facts to defend than a managed account under negotiated terms.

What the conduct rules require

American Bar Association (ABA) Model Rule 1.6(c) requires a lawyer to make reasonable efforts to prevent inadvertent or unauthorized disclosure of information relating to the representation, and ABA Formal Opinion 512 applies that duty to generative AI tools specifically, including the obligation to understand how a tool handles the information put into it. Reasonable efforts is a standard rather than a checklist, which is why the account tier and the retention settings are the evidence a firm would point to.

Google's privacy hub asks users not to rely on Gemini Apps for legal, financial, medical or other professional help, and states that output is for informational purposes only.

Which Gemini version is safe for client data

The Gemini version that can be safe for client data is Gemini in a Workspace or Vertex AI account, once the controls are configured and the terms are read, because those are the versions governed by the customer's own terms rather than Google's consumer terms. Gemini free and Gemini Advanced are not safe for client data, because both run under consumer terms that allow human review and service improvement.

The table is a terms comparison rather than a feature comparison. A paid consumer subscription buys model capability and retention configurability, not a different contract, and the contract is what decides whether client material can go in. The same tier-and-contract analysis applied to Microsoft's assistant sits in our guide to whether Copilot handles confidential information.

What separates the two managed options

Gemini in Workspace is governed by the customer agreement and administered through the Admin console, so a firm's exposure is largely a configuration problem. Gemini on Google Cloud is governed by the Service Specific Terms and runs inside the firm's own project, so the exposure is largely a contract and architecture problem. Teams comparing those against the wider field will find the same tier logic applied to a research-led tool in our assessment of Perplexity's privacy position.

[cta-2]

Private AI alternatives for confidential client work

The most private AI for confidential client data is decided by the contract rather than by the privacy settings. Three legal tools that publish terms a firm can hold them to are Spellbook, Harvey and CoCounsel. Each states that customer material is not used to train models, and each is built for a different slice of legal work.

Why a legal tool is judged differently

That is a different test from the one a general assistant tool passes. A consumer chat window asks the user to configure privacy; a legal tool is expected to contract for it, and to say in writing what it does with an uploaded agreement. The equivalent analysis for the other general assistant lawyers reach for first sits in our guide to ChatGPT and confidential client data.

Spellbook

Spellbook is an AI platform for transactional legal work that runs inside Microsoft Word. The Review feature surfaces risks and proposes redlines as native Word Track Changes a lawyer accepts or rejects, the Draft feature works from a team's own precedent, and the Compare to Market feature benchmarks a clause position against 2,300+ benchmark standards, drawing on a corpus of more than 20M real contracts.

Pros

1. Negotiated zero data retention agreements with the underlying model providers, so request and response content is not persisted by them.
2. SOC 2 Type II, Health Insurance Portability and Accountability Act (HIPAA) compliant, General Data Protection Regulation (GDPR) and EU AI Act compliance documented in one place.
3. Work happens in the document the lawyer is already in, so confidential material does not move into a separate chat environment.
4. Outputs arrive as tracked changes attributable to the lawyer rather than as text to copy across.
5. Free seven-day trial with no sales call, so the confidentiality position is testable before a purchase.

Cons

1. A transactional-contract specialist rather than a legal research or litigation platform, and it does not answer the primary-law research questions CoCounsel is built for.
2. Not a document repository, so a firm still owns its retention and matter-filing posture.
3. Depth is concentrated in commercial and transactional work, a weaker match for a litigation-led practice.

The compliance detail sits on the security page, which documents the certifications above alongside single sign-on, multi-factor authentication and the zero data retention position with the model providers.

Harvey

Harvey is a legal AI platform built around a dedicated secure workspace, with Vault workspaces for large document sets and a published positioning spanning legal, regulatory and tax work.

Pros

1. Contractually committed through the Platform Agreement that inputs, outputs and uploaded documents are not used to train underlying models.
2. Annual SOC 2 Type II and ISO 27001 audits, plus ISO 27701 and ISO 42001 certification.
3. Security Assertion Markup Language (SAML) single sign-on, audit logs and network address allow-listing (restricting sign-in to a firm's own network addresses) for firm-side administration.
4. Customer-set retention policies with deletion on demand.
5. Data residency currently available in the European Union, Switzerland, the United States or Australia.

Cons

1. Hosted in Microsoft Azure, so the protection rests on contractual terms and subprocessor flow-down rather than on anything processed locally.
2. Work happens in Harvey's own workspace, so documents are uploaded into a separate environment rather than reviewed in place.
3. Published positioning spans legal, regulatory and tax work rather than in-document contract drafting, so a contract-heavy team is evaluating a broader platform than a contract workflow requires.

Harvey documents each of those controls on the Harvey security page, including the training commitment, the audit cadence and the regional hosting options. A dedicated secure workspace gives tighter administrative control over a document set, and it moves the document out of the drafting environment to get it.

CoCounsel

CoCounsel is Thomson Reuters' legal AI assistant tool, grounded in Westlaw primary law and Practical Law guidance alongside an organization's own documents. Thomson Reuters completed its acquisition of Casetext on August 17, 2023, so the research library and the AI now sit under one vendor.

Pros

1. SOC 2 and ISO 42001 certification stated on the product page.
2. Grounded in Westlaw primary law and Practical Law guidance, with each step traceable to a source a lawyer can check.
3. Agentic research, analysis and drafting from a single plain-language request.
4. One vendor relationship covering both the research library and the AI layer, which simplifies the diligence.

Cons

1. A cloud-hosted service, so confidentiality rests on the contract, the encryption and the vendor's controls rather than on local processing.
2. Grounding and strongest work are research and litigation rather than transactional contract review inside the document.
3. Sold through sales-led plans tied to Westlaw and Practical Law packages, so the cost of the AI layer is hard to separate from the library underneath it.

Thomson Reuters sets out the certifications and the grounding model on the CoCounsel product page. A tool that cites primary law produces output a lawyer can verify rather than trust. Each citation links back to the underlying case, statute or Practical Law page, so an answer can be checked against its source rather than taken on faith.

Firms weighing the two enterprise options against each other will find the research-depth and workflow-scope differences in our CoCounsel and Harvey comparison. One capability set finds and verifies legal authority; the other drafts and negotiates contract language.

How to use Gemini without exposing client data

A firm can use Gemini without exposing client data by restricting what goes in rather than by trusting the settings. Strip client names, matter numbers and deal figures from every prompt, turn off Keep Activity or use temporary chats, audit Drive sharing before Gemini reaches a matter folder, and treat every output as an unverified draft.

The steps that carry the weight

1. Sanitize before sending. Remove party names, matter numbers, deal values, and dates specific enough to identify a transaction. The trigger is every prompt rather than every sensitive prompt.
2. Decide which work categories are permitted at all, by account tier. Nothing drawn from client paper unless the account carries negotiated terms.
3. Configure before rollout rather than after: Keep Activity off or temporary chats as the default, and the Drive sharing audit completed before Gemini reaches a practice group.
4. Extend the policy to supervised work. The duty covers output produced by juniors, contract attorneys, paralegals and vendors, and a prompt sent by a supervised person is the firm's prompt. The trigger is onboarding, and again at any staffing change on a matter.
5. Address AI use at matter intake. Check whether the engagement letter speaks to it and whether the client's own outside-counsel guidelines restrict it, because some do and the restriction binds whether or not anyone read it.
6. Verify every output against a source before it leaves the firm. Treat a citation, a figure or a clause summary as unverified until checked, and record who checked it.
7. Record the configuration and the policy decision where a supervising lawyer can point to it, because reasonable efforts is evidenced rather than asserted.

Where the policy lives day to day

Day-to-day use is the other half of the policy, because a lawyer who knows which tasks the tool handles well is less likely to paste a whole agreement into a chat window to find out. The patterns that work on legal material are covered in our guide to how lawyers can use Gemini.

Verification deserves its own habit: treat a citation, a figure or a clause summary as unverified until checked against a primary source. The tools built for checking legal propositions against primary law work differently from a general assistant tool, as our overview of AI legal research assistants sets out.

Where Spellbook fits

Private AI for contract drafting and review has to meet a narrower test than a general assistant does, because the document itself is the confidential material. Spellbook runs contract drafting, redlining and review inside Microsoft Word, grounded in a team's own playbooks and in a set of more than 20M real contracts, under zero data retention agreements with the underlying model providers.

A general assistant tool has to be configured to be safe across every kind of work a firm does, which is why the answer to the privacy question keeps returning as a question about the account. The scope of what a contract tool touches is the agreement in front of the lawyer and the team's own precedent behind it.

What the platform does not do

The Review feature helps legal teams identify risk in incoming paper and proposes redlines as native Track Changes the lawyer accepts or rejects, so the judgment and the attribution stay with the lawyer. None of that is a research capability: the platform is a commercial-contract specialist and does not do legal research or litigation work.

Try Spellbook free to see how the Review feature works in Word on a live agreement, using a team's own playbook positions.

[cta-3]

Frequently asked questions

Is Gemini safe for confidential information?

Not in its default configuration. Gemini saves chats for 18 months, routes a sample to human reviewers, and Google's own guidance asks users not to enter confidential information into it. On a managed Workspace or Vertex AI account the terms are different, and that is the version a firm would assess for confidential work.

Are your conversations with Gemini private?

Conversations on a consumer account are private from the public and not private from Google. Saved activity is used to develop and improve Google services, a sample is read by human reviewers at Google and at its service providers, and reviewed chats are retained for up to three years even after the user deletes the activity.

Can my firm's administrator see my Gemini chats?

On a managed Workspace account, yes. Gemini activity sits in the same administrative surface as Gmail and Drive, so administrators with the relevant privilege reach it through audit logs and Vault retention. On a personal account a firm administrator has no access, which is also why personal accounts are the harder problem.

If I upload a document to Gemini, is it private?

An uploaded file follows the same rules as a typed prompt. On a consumer account it can be saved with the activity, used to improve Google services, and included in the sample routed to human review. On a managed account it is covered by the customer agreement. A document uploaded in a temporary chat is excluded from history and human review and still carries the 72-hour window.

Which AI chatbot is the most private?

No chatbot is most private in the abstract, because the account tier and the contract decide the answer rather than the model. The useful comparison is between the enterprise terms of each rather than the consumer versions most people have tried, and the field is surveyed side by side in our review of the most private AI tools for legal work.

Is Gemini GDPR compliant?

Google offers data processing terms for its enterprise services and positions them to support customer compliance, and the same Service Specific Terms state that generative AI services are not designed to meet a customer's regulatory or legal obligations. The compliance judgment stays with the firm: the terms are an input to a data protection impact assessment rather than a substitute for one.

> About this content: This article is provided for informational purposes only. It does not constitute legal advice, and reading it does not create an attorney-client relationship. For legal advice on a specific situation, consult a licensed attorney in your jurisdiction. Spellbook is a software product; it supports legal professionals' work but does not replace their judgment. References to AI model capabilities and vendor terms reflect publicly available information as of the publication date and may change.