Google Workspace (Gmail, Docs, Drive, and related tools for organizations) is governed by the Google Cloud Privacy Notice, the Cloud Data Processing Addendum, and service-specific privacy notices, which state that customer content is not scanned for advertising and that no ads appear in Workspace Core Services. The product has nonetheless been the subject of a 2020 New Mexico Attorney General lawsuit alleging COPPA violations tied to the education edition, a 2021 Dutch government Data Protection Impact Assessment that flagged high privacy risks around telemetry transparency (later reported resolved in 2023), and disclosed subprocessor and corporate-parent relationships (Google LLC, a subsidiary of Alphabet Inc.) documented in Google's own terms pages.
TIMELINE
NO ENTRIES ON FILE YET.
ULTIMATE PARENT
TOOLS WE RECOMMEND
PLUS
RECEIPTS
9 ON FILE
COLLECTION
Google's Workspace for Education privacy notice states that customer data — content users provide or create, such as emails in Gmail or documents in Drive — is processed to deliver the core service, for example processing an email address to send and deliver messages.
Google's December 2020 Workspace data protection whitepaper discloses a distinct 'service data' category — separate from customer content — that includes information about security settings, operational details, and billing information collected while providing and administering the service.
The Workspace (Personal) Additional Terms of Service disclose that the specific Google contracting entity a customer deals with — and therefore the applicable data controller — varies by the customer's billing address, naming Google Australia and Google Cloud India as authorized resellers in those regions.
Google's Workspace subprocessors terms page discloses that the ultimate parent company for all listed Google Group subprocessors is Google LLC, itself a subsidiary of Alphabet Inc.
Google's Workspace security whitepaper states there is no advertising shown within Google Workspace Core Services and that Google does not collect, scan, or use data in Core Services for advertising purposes.
The Google Cloud Privacy Notice, which covers Google Workspace, states that Google does not share Service Data with companies, organizations, or individuals outside of Google except in specifically enumerated cases, such as when a customer chooses to procure a third-party app through the Workspace Marketplace.
Google's Workspace subprocessors terms page discloses named third-party subprocessors and Google affiliates engaged to perform limited data-processing activities in connection with Workspace Core Services, including companies such as EPAM Systems and GlobalLogic.
In July 2023, Google's Workspace blog stated that the Dutch Ministry of Education had affirmed to the Dutch Parliament that Google delivered on privacy commitments made in response to a Data Protection Impact Assessment conducted by the Dutch government and education sector representatives, allowing continued use of Google Workspace in the public sector.
Google's Workspace security whitepaper discloses that customer data stored in the service is indexed by Google to provide features such as spam filtering, virus detection, spellcheck, and the ability to search emails and files within an account.