Google Photos

Is Google Photos safe?

For keeping your photos from being lost or stolen, yes. Google Photos sits behind a Google account, which you can lock down with a passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary or 2-step verification, and we found no breach of the service. For privacy it is a weaker choice. Your library is not end-to-end encryptedEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary, Google's systems analyse every picture, and Apple's privacy label lists your photos and user ID under third-party advertising. Face grouping has also cost Google two biometric settlements. We score it 62/100, level with Gmail (62) and close to Google Maps (60).

Can Google see your photos?

Yes. Google encrypts photos on the way to its servers with HTTPS and again at rest, but it holds the keys. That lets it build search ("dog on beach"), memories, face groups and editing suggestions, and it lets automated systems scan uploads for illegal content. There is no setting that turns on end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary.

Locked Folder does not change this. It hides sensitive items from your grid, search and other apps and opens with your phone's screen lock. Google's help page says it is "protected by Google Photos' standard encryption practices". If you back it up, it is stored like the rest of your library; if you do not, the items exist only on that phone.

On ads, Google's safety page says it does not use your photos and videos for advertising "unless you choose to make data from Google Photos available to other Google services that support ads", for example by connecting Photos to personalised Search. Apple's label for the app is broader: photos or videos and user ID for third-party advertising, purchase history and coarse location for Google's own marketing, and contacts, search history and location linked to you for analytics and personalisation.

Face groups and the biometric settlements

Face groups builds a numerical model of each face in your library so you can search for a person. Only you see the groups and labels, and turning the feature off deletes the face models. Google keeps them until you do that, or until your account has been inactive for two years. Its own help page warns that face models "may be considered biometric data in some jurisdictions".

That warning has a history. In 2022 Google agreed to pay $100 million to settle Rivera v. Google, a class action alleging that face grouping broke Illinois' Biometric Information Privacy Act by collecting face data without notice or consent. Google admitted no wrongdoing and moved Illinois users to opt-in consent. In May 2025 Google agreed to pay Texas $1.375 billion to settle two lawsuits that covered location tracking, incognito searches and biometric data; the 2022 biometric suit named Google Photos, Google Assistant and the Nest Hub Max. Google signed the deal in October 2025, denied wrongdoing and said the claims concerned policies it had already changed.

When a scan locks you out

Google scans uploads for child sexual abuse material and, as US law requires, reports matches to the National Center for Missing and Exploited Children. That protects children. It also means a mistaken flag can cost you far more than your photos. In 2022 the New York Times reported on a San Francisco father whose Android phone uploaded photos of an infection on his toddler's groin, taken at a nurse's request for a doctor. Google disabled his account, cutting off his email, contacts, photos and phone service. Police found no crime, and Google did not restore the account.

Cases like this are rare, but they show why a single cloud copy is risky.

Bugs and breaches

We found no breach of Google Photos itself. The one notable incident was a bug in Google Takeout, the export tool. Between 21 and 25 November 2019, some people who exported their Google Photos data received videos belonging to strangers, and some of their own videos went to others. Google said fewer than 0.01% of people who exported in that window were affected and told them in February 2020.

How to use Google Photos safely

1. Protect the Google account with a passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary or 2-step verification. Your photos are only as safe as that sign-in. A code app such as Google Authenticator works, with the caveats on its page.
2. Use selective backup if some folders, such as screenshots of documents, should not go to the cloud at all.
3. Decide on face groups. If you do not want face models kept, turn the feature off; Google deletes them.
4. Check which other Google services can use your Photos data, since that is the route Google names for ads.
5. Share albums with named people rather than by link, and remove old links you no longer need.
6. Export your library with Google Takeout once or twice a year and keep it on a drive at home.

How we scored it

Scams and harmful content (78) is the strongest factor, since albums are private unless you share them. Security (70) and transparency and control (70) follow, for strong account protection and full export. Privacy (48) is the weakest, held back by the lack of end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary, an advertising entry on the App Store label and biometric face models. The regulatory record (48) is just as low because of the $1.375 billion Texas settlement; the $100 million Illinois settlement was a private class action.