Is Google Drive safe for client files? A checklist
Drive is fine for many jobs. This checklist covers the settings to check and one rule for client deliveries.
Is Google Drive safe for client files? Drive is fine for many jobs, and a news story alone is not a reason to move everything. What matters is which Google settings you have switched on, who can open each folder, and whether client work sits in accounts you also use for personal things. This guide gives you a checklist to run through, and one rule that keeps client deliverables apart from personal and AI-connected accounts.
Is Google Drive safe for client files after the reported Google change?
On 26 October 2026, Proton published Google can now use your Gmail data for ads: How to turn it off. On 27 October 2026, MEGA published Google can now use your Gmail, Drive and Google Photos to target ads. Both are written by companies that sell privacy-focused storage, and both describe the same change.
As they report it, Google changed its privacy policy on 16 October 2026. The old wording said content from Drive, Gmail or Photos would not be used for personalized ads. The new wording adds an exception: if you choose to connect those apps to Google features that support personalized ads, such as Personal Intelligence, data from them can shape the ads you see. Proton quotes Google as saying that connecting your apps is opt-in, and says that if you never connected them, nothing changes for you.
MEGA adds that, per Google's Drive privacy page, Drive itself still does not use your information for advertising purposes. We have only read these two reports, not Google's own pages, so check Google's policy and help pages before you quote any of this to a client.
For a studio, the useful takeaway is narrow: it is worth knowing whether any Google account that holds client files has been connected to one of these AI features.
Step 1: Check which Google features are connected
Proton describes this route. MEGA says Google is updating these settings, so labels may differ on your screen.
Open your Google Account and go to Data & privacy.
Open Personalization settings, then Manage Personalized Recommendations in Search Services.
Under Additional Personal Intelligence, find Connected Content apps.
If Google Workspace or Google Photos is connected and you did not mean to connect it, disconnect it.
If you use Gemini, check its settings too. Proton says to look in both places, and MEGA names Connected Apps in Gemini and the Keep Activity setting as things to review. Do this for every Google account that touches client work, including the ones your team members use.
Write down the date you checked and what you found. If a client asks, a one-line answer such as "we checked on that date and nothing was connected" is better than a guess.
Both reports also say that disconnecting does not erase data Google has already saved. Proton points to Search Services History and My Ad Center as separate places to review and clear, and MEGA lists the same two steps. If you did connect an account that holds client files, decide whether to delete that history too.
Step 2: List who has access
Settings are only half of the question. Old shares that nobody remembers are easy to miss, so check them on purpose.
Open each active client folder and read the list of people with access. Remove freelancers and former staff who no longer work on the project.
Look for links that anyone with the address can open. Keep them only where you meant it.
Check old Gmail threads for attachments that contain finished or sensitive work, such as contracts, unreleased campaigns or tax papers.
Check the shared folders you did not create. A client or a partner may have added people you have never met.
When you send finished work through another tool, look for the controls you will need whichever one you pick. In Tarkle, you can set a password on a transfer, set a link expiry date, and disable a link in one click when plans change.
Step 3: Find client files in personal accounts
A common gap is a designer who starts a project from a personal Gmail address, a freelancer who sends final files from their own Drive, or a founder who keeps old client folders in the account they use for family photos and personal apps.
Search each personal account you or your team use for client names and project names. Make a short list of what you find, then move each item into the account your business controls. Delete the personal copy once the client file has its new home and the old shares are revoked.
If the files should go into a Tarkle workspace, you can import them from Google Drive without downloading them first. The import brings in files, so pick the files inside a folder rather than the folder itself.
The rule: one account for client deliverables
Here is a simple rule you can put in a one-page policy:
Client deliverables live in one business account. One owner, named roles, and a short list of people with access.
Personal accounts hold nothing a client owns. No client folders, no client attachments, no final files.
Treat any account connected to an AI assistant as off limits for client files. This is our cautious rule, not a statement about how any one tool behaves. If an account has Gemini, Personal Intelligence or another AI tool connected, keep client files elsewhere unless the client has agreed.
Create the business account first, then move projects into it one client at a time as they become active. Do not try to migrate everything in a weekend. Start with the clients whose files are most sensitive.
This rule works with Google Workspace, with Drive, or with any other tool. It is about separation, not about which brand you pick.
Step 4: Decide how clients receive finished files
Storing a file and sending it are different jobs. A shared Drive folder is a good place to work on files with a client who already lives in Google. For a finished delivery to someone outside your team, a link with a password and an expiry date is often a better fit. Our guide on sharing files with clients without Google Drive goes through that approach, and file sharing vs cloud storage explains the difference.
Recipients can open a Tarkle link without creating a Tarkle account. That helps when an outside printer or a client's colleague needs one file once and will never sign in anywhere.
What Tarkle says about your content
Since this article is about trust, here is what Tarkle's own Terms of Service say, in plain words and without legal advice. You own the files and other content you upload. Tarkle may use your content only to operate, secure and support the service and to follow your instructions. Tarkle does not use your content to train AI models. Some features, such as smart filenames, send limited content or metadata to an AI provider to produce a result for you. The provider is not allowed to use it for training, and you can choose not to use these features. Read the Terms in full before you rely on them in a client contract.
Common mistakes
Treating the news as a reason to panic and move everything. Disconnecting one setting may be all you need.
Checking only your own Google account and forgetting your team's.
Disconnecting an AI feature and assuming old data is gone.
Leaving old shares open after a project ends.
Keeping client files in the same account as personal photos and apps.
Next step
Pick your three most active clients and run steps 1 to 3 for them this week. If you want a separate place to send finished work with a password and an expiry date, you can Start for free and send a first transfer to see how it looks to a client.
