9 SEP 2026 — Google is rolling out Gemini Spark control of Google Photos, letting the agent search, edit, curate, build shared albums and turn a photographed concert flyer into a calendar entry. The two safeguards named are that edits work on a copy and new albums are private by default. Both describe the output. Neither describes what the agent can read.
What is shipping
Google Photos lead Shimrit Ben-Yair announced it on 3 September. It is rolling out over several weeks to Gemini AI Pro and Ultra subscribers in the United States, in English, and Google has announced no wider international rollout.
A user connects their Google Photos account inside the Gemini app, after which Spark can act on the library: editing images, curating and sharing albums, and running scheduled workflows.
The stated protections are simple: Spark edits a copy of an image, leaving the original intact, and albums it creates start private.
The safeguards address accidents, not access
Editing a copy prevents the agent from destroying a photograph, and private-by-default prevents it from publishing one. Both are sensible, and both are about what the agent writes.
To find the concert flyer, the agent has to look at the photographs. To curate an album of a holiday it has to understand which images belong to it. Search, curation and scheduled workflows are read operations over the whole library by construction, and no setting described here narrows that.
That is not a hidden flaw. It is the feature. The gap is between what the announcement emphasises and what a user is actually granting when they connect the account.
What is in a photo library
A modern camera roll is the most complete personal archive most people hold, and very little of it was taken to be looked at by anything but the owner.
It contains faces of people who never agreed to anything, precise locations and timestamps, and the photographs everyone takes for convenience rather than memory: a passport page, a prescription, a bank letter, a payslip, a bruise, a test result, a door code written on a hand.
The convenience photographs are the problem. They are taken to be read once and forgotten, they are never curated, and they sit in the same library that an agent now has standing permission to read on a schedule.
The comparison that makes it concrete
Granting an assistant access to a mailbox is a familiar bargain. People understand it, partly because mail is text and text is what everyone assumes a language model reads.
Images are different in a way intuition has not caught up with. A model reading a photograph produces a description of it, which means connecting a library converts ten years of pictures into ten years of searchable text about what those pictures show, who is in them and where they were taken.
That derived text is the artefact worth thinking about. A photograph of a prescription is inert until something reads it; once read and described, the medicine is a string, and strings are what systems retain, index and act on.
Scheduled workflows change the shape of consent
A one-off request is bounded. The user asks, the agent looks, the task ends. A scheduled workflow removes the user from the loop by design. That is its purpose, and it turns a permission granted once into a process running indefinitely.
That is where a photo library differs from a mailbox or a calendar. The library keeps growing, and a rule written against last year's contents applies to photographs that do not exist yet, taken in circumstances the user was not thinking about when they wrote it.
It is the same structural point we made about agent inventories reaching only the operator's own estate. Standing permissions are easy to grant, hard to remember, and rarely revisited.
Who is not in the room
The subscriber consents. Everyone else in their photographs does not, and cannot, because there is no mechanism by which they would know.
Under most data protection regimes personal photography sits inside a household exemption, so this is largely a matter of norms rather than law. But the norm was built for a person looking through their own pictures, not for a system that reads all of them, describes them and acts on what it finds.
We have followed the same argument through wearable cameras, where Norway regulated the conduct rather than the device. A photo library is that question pointed backwards at pictures already taken.
What Google could publish
Three things, none of them onerous. Whether library content is used for model training or personalisation beyond fulfilling the request, stated separately from the general Gemini policy.
What is retained after a task finishes, and whether the agent's descriptions of photographs persist as an index, since a searchable text description of a private library is a new artefact with its own exposure. And a per-workflow scope, so a user can grant an agent an album rather than everything.
The feature is useful and the engineering caution is real. What is missing is a plain sentence about the read side, and that is the side a user cannot see.
View author profile → · Editorial policy
