Skip to content
Submit incident
AII-1000-95803
AllegedThe record is a lawsuit, complaint or accusation that has not been decided.Supporting sources are pending verification.

Google Gemini accessed Gmail users' private emails without consent, class action filed

Google reportedly activated a Gmail feature in October 2025 that allowed its Gemini AI to read private emails and attachments from all users without their knowledge or consent. An Australian engineer discovered the feature was enabled by default on all accounts and prompted a class action lawsuit against the company.

October 2025 Β· Google Β· Privacy and surveillance
October 2025
AII-1000-95803
Quick facts
Organization
Google (subject)
Category
Privacy and surveillance
Country
United States
Date
October 2025
Drafted by
Raidu Incident Detection

What happened

Google activated a Gmail feature in October 2025 that enabled its Gemini AI model to read private emails and attachments from all Gmail users.

The feature was enabled by default on all user accounts without explicit user consent or knowledge.

An Australian engineer discovered the feature and identified that users' personal, financial, health, and work-related emails were being accessed to train the AI system.

Reported impact

The unauthorized access to private communications raised serious privacy concerns regarding protection of personal data.

A class action lawsuit was filed against Google over the secret activation of this functionality.

Index analysis

The feature allowed Gemini to read sensitive information including financial data, health information, and personal or workplace correspondence without user authorization.

Governance controls

Users can disable the feature by accessing Gmail settings and turning off 'Intelligent features and personalization' in privacy settings and 'Google Workspace intelligent feature settings'.

Classification

Organization
Google (subject)
Category
Privacy and surveillance
Industry
IT infrastructure and hosting
Country
United States
Harm status
Actual harm
Intent
Unintentional
Timing
Post-deployment
Harm types
Human or fundamental rights
Harmed
Consumers, General public
Failure modes
Training data misuse
Consequences
Litigation
AI systems
Gemini
Regulations
GDPR (cited)

Sources and evidence

Sources not yet published

This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.

How sources are verifiedSuggest a source for this incident