Google is now saving your photos and voice to train its AI. You were opted in without being asked.

In June 2026, Google switched on a setting that saves the photos you take with Google Lens, the voice recordings from your searches, and video from its tools, then feeds that material into training its artificial intelligence (AI) models. If your Web and App Activity was already turned on, which it is for most people, Google enabled this for you automatically. The only warning was an email that did not ask you to agree to anything.

What is happening

The setting is called Save Media, and it sits inside a feature Google has renamed Search Services History. When it is on, Google keeps copies of the images, voice recordings, and video that move through Google Lens, Search Live, the speaking-practice feature in Translate, and ordinary voice searches. Google's own email to users says this media helps it develop and improve its services and technologies, including its AI models and safety measures. In plain terms, the photo you scanned of a contract, the voice note you spoke into search, and the document you photographed for translation can become training data.

Nobody was asked to opt in. If your Web and App Activity was already on, Save Media was switched on during the transition without a separate request, no toggle to accept and no confirmation screen, only an email notification that never spelled out in plain language that your media would help train AI. Seeing the full picture means cross-referencing that email against a separate help page, which most people will never do.

One detail sits in a policy footnote rather than the main text. When you use the Hey Google wake word, the assistant records a few seconds of audio from before you spoke, so your phone is capturing short windows of sound around the moments you talk to it. Google also collects activity from third-party sites that use its services, described in the policy as more than 2 million non-Google websites and apps, regardless of which browser or mode you use.

Why this hits harder for South African businesses

South Africa has its own data protection law, the Protection of Personal Information Act (POPIA), and automatic enrolment of this kind runs straight into it. POPIA requires that consent to process personal information be voluntary, specific, and informed. A setting that switches itself on because an older, separate setting happened to be enabled is none of those things. When the media being saved includes faces captured by Lens and voice recordings that can function as voice biometrics, the bar for valid consent rises.

There is a second problem under POPIA, around further processing. You may have agreed, years ago, to Google saving your search history so your results felt more useful. Using that same history and media to train commercial AI models is a different purpose, and POPIA limits how far a company may stretch the original reason you handed over your data.

Then there is the cross-border question, which is the one most local businesses overlook. Google processes data on servers around the world, and its privacy policy names a single transfer framework, the EU-US Data Privacy Framework, that covers the European Economic Area, the United Kingdom, and Switzerland. It names nothing specific for South Africa. Section 72 of POPIA sets conditions for sending personal information outside the country, and a South African business that lets client data flow to Google has to satisfy those conditions itself. The Information Regulator, the body that enforces POPIA, has grown steadily more willing to act on exactly this kind of gap.

For a small or medium enterprise (SME), the exposure is practical. If your staff use Lens to scan invoices, identity documents, or client paperwork, photograph whiteboards in meetings, or run voice searches on phones that also hold business email and client records, that material may now be saved and used for training. Under POPIA, every service that processes personal information on your behalf is an operator, and the duty to know what your operators do with your clients' information sits with you, not with Google.

What to do this week

1. Turn off Save Media. Open myaccount.google.com, go to Data and Privacy, then Activity Controls, then Search Services History, and toggle off Save Media. Do this on the accounts your business relies on first, then on personal accounts that touch work.
2. Delete the media Google has already kept. Go to myactivity.google.com and remove the images, voice recordings, and video already saved. Switching the setting off stops new collection but leaves the old material in place until you clear it.
3. Set your activity to auto-delete. In the same Activity Controls area, set activity to auto-delete after 3 months rather than holding it until you close the account. The shorter the retention, the smaller your exposure if Google itself is ever breached.
4. Check what your team puts into Lens and voice search. Ask whether anyone scans client documents, ID copies, or financial paperwork with Lens, or dictates sensitive information into voice search on a work phone. Write a short rule for what may and may not be photographed or spoken into Google tools on devices that hold business data.
5. Record Google as an operator in your POPIA documentation. List it alongside your other operators, note what personal information flows to it, and note the cross-border transfer. If the Information Regulator or a client ever asks how their data is handled, that record is what lets you answer.

Where Ubuntu Guard fits

If you are not sure what your staff devices are sending to Google, or where your POPIA obligations sit once client data starts flowing into someone else's AI training pipeline, that is the ground our cybersecurity assessment covers. We go through your devices, accounts, and data flows methodically, tell you where the gaps are, and give you a plain-language report you can act on. You can read how it works at our cybersecurity assessment page.

Not sure what your team's phones are quietly handing over? WhatsApp us and we will walk you through the next step: wa.me/27791595040.

Cybersecurity Made Simple

© 2026 Ubuntu Guard Cybersecurity | Durban, South Africa
ubuntuguard.co.za