What Google Just Changed
Google updated its privacy policy in mid-October. According to The Verge, the company is adding an exception to its commitment not to use Drive, Gmail, and Google Photos for personalised advertising. Now, if you activate the personal intelligence features that connect these services to Google Search AI, your data can fuel ad targeting.
In other words: the price of personalised AI is a refined advertising profile. Google clarifies that advertisers do not directly access your email content or identity. But the company uses this data to personalise the ads it serves you, including on other platforms like YouTube.
Who Is Affected in Your Swiss SME
The risk primarily affects employees using Gmail for business, Google Drive, or Google Photos with the new AI features. Imagine an employee at your accounting firm in Martigny who activates personalised recommendations in Google Search. Their exchanges with clients, working documents, screenshots of QR invoices could contribute to their advertising profile — and indirectly reveal information about your business.
Regulated professions are particularly exposed. A medical practice, a notary's office, or a property management company handles sensitive data. Even without direct leakage, advertising cross-referencing can create awkward inferences. Algorithmic profiling does not respect the same confidentiality thresholds as processing declared to the Swiss nFADP (nLPD).
| Business profile | Risk level | Why |
|---|---|---|
| Fiduciary, accounting firm | High | Client tax and financial data in Gmail/Drive |
| Property management | High | Lease agreements, identity documents, tenant files |
| Hotel, restaurant | Medium | Bookings, customer preferences, event photos |
| Carpentry, crafts | Medium | Quotes, plans, site photos stored in Photos |
| Retail | Medium | Customer data, stock, supplier orders |
Hypothetical Case: The Sierre Carpentry
Let's imagine a five-employee carpentry in Sierre. The owner uses Gmail to communicate with architects and private clients. Progress photos from building sites are in Google Photos. Quotes and VAT invoices at 8.1% are in Drive. One day, he activates the new "Personal Intelligence" feature to get better answers from Google AI — for instance, to find a quote by describing the project.
Under the new terms, this activation opens the door to targeted advertising based on this content. The owner starts seeing ads for CNC saws on YouTube in the evening. No apparent harm. But a competitor buying these ad keywords indirectly deduces that this carpentry is investing in equipment. Worse: an unfortunate cross-reference could display an ad to a client whose confidential project appears in the emails.
The carpentry was not hacked. It simply accepted terms it did not read, in exchange for a convenient feature.
What Swiss SMEs Should Watch For
The nFADP and Cross-Border Transfer
The new Federal Act on Data Protection (nFADP, nLPD) strictly regulates the processing of personal data. The Google case raises a delicate question: your business data, which often contains client information, transits to US servers and serves commercial profiling. Compliance depends on your exact configuration, your legal notices, and the consents obtained. For certainty, consult a specialist or the Federal Data Protection and Information Commissioner (FDPIC).
Vendor Lock-In
Google conditions access to advanced AI features on this advertising opening. This is a classic model shift: first free or neutral, then paid with data. An SME that built its processes on Workspace finds itself trapped. Migrating five years of emails and documents represents a real cost, in time and service interruption.
The Hidden Costs of the Alternative
Going without Google is not free. Swiss-hosted solutions — Infomaniak, Exoscale, or self-hosted tools — charge a subscription. They offer fewer smooth integrations. Their AI is often less mature. The calculation is not straightforward: pay with personal data, or pay in Swiss francs with fewer features.
What AI Does Not Do Well Here
Google's AI assistants perform well at finding a document or summarising an email thread. They do not warn you of the policy change. They do not distinguish professional from personal data. They do not offer a "strictly business, no ads" mode. This granularity, you must build it yourself or buy it elsewhere.
What to Do Now
- Check your current settings. In your Google account, access the personalisation settings for search services. Disable "Personalised recommendations" if you do not want your Gmail, Drive, and Photos data to fuel advertising. This is reversible, but check the impact on the AI features you use.
- Audit your data stored with Google. Take inventory: which business documents are in Drive? Which professional photos in Photos? Which client exchanges in Gmail? Classify them by sensitivity. The most critical deserve Swiss hosting or additional encryption.
- Train your employees over lunch. Fifteen minutes is enough. Show them where these settings are. Explain the difference between professional and personal accounts. Ban the activation of experimental AI features on business accounts without approval.
- Evaluate a gradual migration. Do not change everything at once. Test an alternative service for limited use — for example, storing new quotes with a Swiss host. Compare reliability, support, integration with your existing tools. Our selection assistant can help you map your needs.
- Document your choices for the nFADP. Note which services process which data, where they are hosted, on what legal basis. In case of inspection or client complaint, this traceability protects your business. If you are considering automations with your data, the origin and flow must be clear from the start.
FlowBiz.ai supports Swiss SMEs on these data architecture and hosting choice questions. Based in Sion, we design AI solutions and automations hosted in Switzerland, delivered in stages. Contact us to discuss your specific situation, or try our two-minute AI quiz to identify your priorities.
