Is Gemini Safe? Gemini Privacy for Legal Teams

Is Gemini Safe to Use With Client Material?

Gemini’s privacy protections depend on the account you use. A familiar work email address alone does not establish which terms apply.

Google distinguishes Gemini as a Workspace core service from Gemini as an additional service. Business Starter, Business Standard and Business Plus include the core service with enterprise data protections. Additional-service access can carry consumer data handling. Google’s edition and access guide identifies the distinction.

For example, a solicitor drafting a reply to a client email needs approval for the account actually open in Gemini. Approval for the firm’s managed account does not cover switching to a personal account in another browser profile.

Approve defined uses, permitted material and responsible staff. A provider’s training restriction alone does not decide whether a particular client document belongs in the service.

Gemini Apps Activity

Gemini Apps Activity is the history saved to your Google Account. Its Keep Activity setting is on by default for personal-account users aged 18 or over. The default auto-delete period is 18 months. Other options are three months, 36 months or no automatic deletion.

To turn off Gemini Apps Activity on a personal account, follow Google’s activity instructions:

1. Open Gemini and confirm which Google Account is signed in.
2. Select Settings & help, then Activity.
3. Select On, then Turn off. Choose Turn off and delete activity if you also intend to remove the saved history.
4. Reopen Activity and confirm Keep Activity is off.

Turning it off still leaves new conversations saved with your account for up to 72 hours. They do not appear in the visible activity history.

Across a team, record the account type for each authorised user. Workspace users cannot change the administrator’s conversation-history setting. Have the administrator confirm the applied setting for each relevant group, then check an ordinary staff account.

Human Review and Training

With consumer Keep Activity on, Google uses saved activity to improve services, including training generative AI models. Human reviewers assess some chats. Reviewed conversations are disconnected from the account and retained for up to three years, even after activity deletion.

Turning Keep Activity off stops future chats being used to train Google’s AI models unless you submit feedback. Feedback can include conversation content and lead to human review. Safety-related human review can still happen with activity off. Google also says Gemini settings do not control processing chats into anonymised data for service improvement.

These distinctions appear in the Gemini Apps Privacy Hub. Turning history off does not create a confidential professional account. Keep client material out of personal Gemini chats, including feedback submissions.

Gemini in Google Workspace

For qualifying Workspace use, Google says content is not human reviewed or used for generative AI model training outside your domain without permission. Existing Workspace access permissions govern what Gemini retrieves. A user who can access a sensitive file can still bring it into Gemini.

The Workspace generative AI privacy terms and controls cover both Gemini within Workspace apps and the managed Gemini app. Their histories are separate. Retention in a Workspace app’s side panel can run from 90 days to indefinitely, as administrators determine.

The managed Gemini app has conversation history on by default, normally retained for 18 months. Administrators can select three, 18 or 36 months, or turn history off. With history off, new chats remain saved for up to 72 hours.

The Gemini app is available by default to eligible adult users under a qualifying Workspace licence. Administrators can disable it or limit access by group or organisational unit. Its service switch does not disable Gemini features inside Workspace apps. Review both sets of controls before treating the firm’s configuration as approved.

Gemini Privacy Settings to Check

Record a specific approval configuration so staff know which Gemini use is permitted.

• Confirm the account’s qualifying edition and the applicable Workspace agreement, service-specific terms and data-processing terms.
• Set access separately for the Gemini app and Gemini features inside Workspace services.
• Set conversation retention and decide whether staff can delete individual chats. Keep required matter records in the firm’s approved record system.
• Review connected Google apps and the files each user can access. Disable connections that the approved task does not need.
• Treat third-party connected apps as a separate approval: Google’s Workspace privacy hub says their use has different terms.
• Set a feedback rule that prevents staff attaching client material to product feedback.

For personal accounts, read the Gemini notice alongside the Google Privacy Policy. Activity deletion does not by itself remove information other Google services retain. Keep separate decisions about data location in your data sovereignty assessment.

Before enabling client work, save the approved account type and settings with the permitted uses. Give staff a clear instruction to stop when Gemini opens under a different account.