Google Gemini

Is Google Gemini safe?

Gemini is a reasonably safe AI assistant for everyday questions, mostly because it runs on a Google account, which is hard to break into if you turn on 2-step verification. It does not use your chats for advertising. The catch is how long Google keeps what you type. By default chats are saved for 18 months and used to train Google's models, and the ones picked for human review can stay for up to three years even after you delete them. We score it 60/100, a little above ChatGPT.

How long Google keeps your chats

Google's Gemini Apps Privacy Hub, updated in 2026, sets out three tiers:

Setting	How long chats are kept	Used for training
Keep Activity on (default)	18 months, or 3, 36 months or forever if you change it	Yes
Keep Activity off, or a temporary chat	72 hours	No, unless you send feedback
Chats picked for human review	Up to 3 years, even after you delete activity	Yes

Reviewers include outside contractors. Google says it disconnects reviewed chats from your account first, but the text of the conversation is what they read, and people put names, symptoms and addresses into prompts. Google's own advice is not to enter confidential information.

Apple's label is broad. It lists no data used to track you across other companies' apps, which is better than Character.AI. But precise location, contacts, emails or text messages, photos, audio, search and browsing history, and "sensitive info" may be collected and linked to your identity. Much of that applies only if you connect Gemini to Gmail, Drive, Maps or your phone's messages.

Security

Account takeover is the main risk for most people, and Google is good at stopping it: 2-step verification, passkeysPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary and the Advanced Protection Program are all available. Chats are encrypted in transit and at rest, not end to end. No breach of Gemini conversations has been reported.

The new risk is prompt injection, where hidden instructions in a web page, email or calendar invite trick the assistant into leaking data. In 2025 security firm Tenable reported three such flaws, which it called the Gemini Trifecta, including one that could send a user's saved information and location to an attacker through the browsing tool. Google fixed all three. The more apps you connect to Gemini, the more an attack like this could reach.

Children and teenagers

Google lets children under 13 use Gemini through a parent-managed Family Link account and gives teens extra content filters. In September 2025 Common Sense Media rated both versions "high risk", saying they were adult Gemini with filters on top and could still produce material about sex, drugs and alcohol and weak responses to signs of mental illness. Google said some of the tests may have used features not open to under-18s and that it was adding safeguards. We found no lawsuit alleging that Gemini harmed a child, unlike the cases against Character.AI and OpenAI.

Regulators and courts

There is no fine specific to the Gemini app. In September 2024 Ireland's Data Protection Commission opened an inquiry into whether Google assessed the data protection risks before training its PaLM 2 model on Europeans' data; we found no published decision by October 2026. In March 2024 France's competition authority fined Google €250 million in a dispute with news publishers, partly because Bard, Gemini's former name, was trained on their content without notice. A US class action claiming Google switched Gemini on in Gmail, Chat and Meet without consent was dismissed in July 2026 for lack of shown harm, with leave to amend. The FTC also included Alphabet in its 2025 study of AI chatbots and children.

Settings worth changing

1. Turn off Gemini Apps activity (Keep Activity) if you do not want chats used for training, or shorten auto-delete to 3 months.
2. Use a temporary chat for anything personal.
3. Check which apps are connected to Gemini and disconnect the ones you do not use.
4. Turn on 2-step verification or a passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary for your Google account.
5. Leave out names, health details and ID numbers, because human review can keep a chat for three years.

How we scored it

Security (70) and transparency and control (70) are Gemini's strongest factors, thanks to Google's account protection and clear retention settings. Privacy (48) is pulled down by default training and long human-review retention, and scams and harmful content (55) by the weak results for children. For video, Google's other big app, see YouTube.