Google's Gemini AI caught scanning Google Drive PDF files without permission

Cloud data, ownership, and expectations

• Many argue this reinforces the old lesson: data on cloud services effectively belongs to the provider, not the user.
• Several note that Google has long scanned Gmail/Drive content for search and features; others respond that this doesn’t legitimize new AI uses.
• Some see this as yet another example of “there is no cloud, just someone else’s computer,” implying you should assume mining and aggregation.

What Gemini is actually doing

• Key debate: is “scanning” for on-demand summaries materially different from traditional indexing/search or spellcheck-like features?
• Several stress the distinction between inference (summarizing a user’s document) and training (adding it to the model’s dataset); they accuse the article/tweet of blurring these to imply secret training.
• Others worry less about current technical details and more about the precedent: data processed now could later be logged, reused, or repurposed for training.

Permissions, toggles, and misconfiguration

• Central complaint: AI summarization ran on files despite settings appearing disabled.
• Some commenters interpret the behavior as a bug or confusing interaction between multiple settings/Labs flags; others see dark patterns or deliberate opacity.
• There is disagreement over whether the user had effectively “opted in” by pressing a Gemini button once, and whether that should cascade to all similar files.

Opt‑in, regulation, and robots/AI exclusion

• A recurring proposal: all AI features (training and scanning) should be explicit opt‑in, with clear language and regulatory penalties for noncompliance.
• Counterpoint: summarization-on-open-docs is just “running an algorithm for you” and doesn’t merit legal restriction beyond normal product choice.
• Some discuss robots.txt‑style mechanisms (ai.txt, NoAI tags) and argue they’re weak because scrapers have few incentives to respect them.

Trust, encryption, and alternatives

• Several advocate client-side encryption or providers where data is encrypted with keys the service can’t access; others note this ultimately still requires trust.
• Some describe migrating off Google (alternative OSes, offline/on‑prem setups) or tightly controlling which apps can access cloud storage.
• A number of commenters say they now default to assuming any unencrypted cloud data will be mined for AI and other purposes.

Ethics, accountability, and public understanding

• Some think concern is overblown and rooted in misunderstandings of how LLMs work; they call for better education about indexing vs training vs inference.
• Others focus on incentives: powerful actors have means and motives to overreach; without strong safeguards and whistleblowers, abuse is seen as likely.
• A minority call for more direct social accountability for engineers and product managers who build privacy‑eroding features.