Google faces refiled lawsuit over Gemini AI access to private messages

The core of the legal dispute

Google is currently facing a refiled class action lawsuit in San Jose regarding its Gemini AI features. The plaintiffs, Thomas Thele and Melo Porter, allege that the company secretly activated 'Smart features' for all Gmail, Chat, and Meet accounts on or about October 10, 2025. They argue this move allowed the AI to scan and analyze private communications, including email attachments, without any user notification or consent.

The lawsuit centers on the idea that these features were previously an 'opt-in' choice for users seeking to personalize their experience. The plaintiffs claim that by flipping the switch for everyone, Google gained the ability to exploit the entire recorded history of private messages. They argue this gives the company 'unmerited, improper, and monetizable insights' into the private lives of millions of people.

Google has consistently denied these allegations in court and in public statements. The company maintains that it did not change any settings and that smart features have been available as an optional tool for many years. As reported by PPC Land, Google's official stance is that Gmail content is not used to train the Gemini model, contrasting with the plaintiffs' fears of widespread data exploitation.

How the AI access works

The specific setting at the heart of the case is found within Google's data privacy menu on mobile devices. It is labeled as 'Smart features' and includes a description stating that turning it on allows the company to use email, chat, and video content to personalize products. The plaintiffs argue that while the setting is worded as an 'opt-in' agreement, Google effectively turned it on by default for everyone.

The complaint highlights a discrepancy between the menu's wording and Google's actual Terms of Service. The current terms only mention using artificial intelligence for specific tasks like simultaneous translations and spam detection. The plaintiffs argue that the 'Smart features' toggle is actually the gateway for Gemini AI to track and analyze the contents of private communications across various platforms.

To illustrate the potential reach of this technology, the lawsuit cites a tech column describing how Gemini could identify personal details from a user's 16-year email history. The plaintiffs use this to argue that even if a user hasn't seen a specific piece of data leaked, the AI's ability to 'know' personal details is a significant privacy risk. They claim this capability allows Google to combine private communications with existing data profiles to create a comprehensive map of a user's life.

Who is affected by the suit

The proposed class for this lawsuit is broad, seeking to include all natural persons residing in the United States who hold Google accounts. Specifically, it targets anyone whose private communications in Gmail, Chat, or Meet were tracked by Gemini AI after the alleged October 2025 switch. The complaint estimates that the number of affected class members could reach into the millions.

The plaintiffs argue that the impact extends beyond just Google users to include third parties who are not affiliated with the company. Because the AI can access communications with people who do not have Google accounts, the suit claims the tracking violates the Stored Communications Act. This law protects the privacy of electronic communications between different service providers and users.

The lawsuit also points to the scale of the potential impact by citing statistics on Gmail usage. It notes that approximately 41.9% of US citizens use Gmail, which equates to over 130 million American users. The plaintiffs argue that the sheer volume of data—including financial records, medical care, and religious affiliations—makes the unauthorized access a significant matter of public concern.

Legal hurdles and next steps

This is the second time this year that the plaintiffs have attempted to move forward with this specific lawsuit. A federal judge previously dismissed the first amended complaint in July 2026 because the plaintiffs failed to allege a concrete injury. The court ruled that the users could not point to any specific message the AI had actually read or any real harm caused by the alleged tracking.

In response to that dismissal, the plaintiffs refiled a second amended complaint in August 2026. This new version includes a third plaintiff and introduces new arguments regarding the confusing nature of the settings menu. Google has since moved to dismiss this new version as well, and the court has not yet issued a ruling on that motion as of late October.

If the case proceeds, the plaintiffs are seeking a wide range of remedies, including statutory damages and an injunction against further access. They are also asking the court to order Google to destroy all data obtained through the alleged illegal tracking. The outcome will depend on whether the court decides that the lack of a specific, documented instance of data misuse is enough to move forward with the case.

Privacy and security risks

A major component of the plaintiffs' argument involves the long-term security of data stored by Google. The complaint references a 2018 vulnerability in Google+ that exposed the data of over 52.5 million users. The plaintiffs argue that any information stored through the Gemini AI platform is at risk of being stolen if it is not already exposed. They use this history to argue that unauthorized access by the company is a precursor to potential security breaches.

The lawsuit also leans on historical data regarding how much people value their digital privacy. It cites a Pew Research Center report from 2015 showing that 93% of adults consider it important to control who can get information about them. The plaintiffs use these figures to argue that Google's actions violate the fundamental expectations of its user base, who expect their private communications to remain confidential.

The court is tasked with balancing Google's right to provide integrated AI services with the users' right to privacy. While Google argues that these features are standard and controlled by the user, the plaintiffs maintain that the lack of clear notice constitutes a violation of trust. The final ruling will likely set a precedent for how 'default' AI settings are treated under current privacy laws.