You do not need to read a privacy policy to answer this question. Open Google Photos and search your own library for a word like beach, passport or dog.
If results come back, then something on the server side has looked at your pictures and described them. That is the answer, and it is not a matter of opinion or of trusting a policy page: a service that cannot read your files cannot search inside them.
What Google Photos actually is
Encrypted in transit and encrypted at rest. Your upload is protected from anyone intercepting the connection, and the stored copy is protected from someone walking away with a disk. Both are real and both matter.
Not end to end encrypted. With end to end encryption the key exists only on your devices, and the provider stores something it cannot open. Google holds the key to your library, which is precisely what makes the useful features possible.
The word encrypted covers both arrangements, which is why it tells you almost nothing on its own. The question that separates them is simple: can the provider open the file without you? For Google Photos the search box answers yes.
What that means in practice
The content is readable by the system. Face grouping, object search, automatic albums and content moderation all require it. These are not side effects, they are the product.
Staff access is governed by policy, not by mathematics. That is not an accusation, it is a description of the model. Policy is reviewable and it can change; mathematics cannot. If your threat model includes a change of policy, of ownership or of jurisdiction, the distinction is the whole point. If it does not, this model is perfectly reasonable.
Where the copy actually lives. Encrypted at rest describes this room; it does not describe who holds the key.
The part most people get wrong: shared links
A shared album link is unlisted, not protected.
Anyone holding the link can open the album. That includes the person your recipient forwarded it to, and a link pasted into a group chat that someone later leaves. The link stays valid until you revoke it, and revoking is a deliberate action you have to remember to take, months after you have forgotten the album exists.
Treat a share link like a password you have handed out and cannot take back quietly. It is the single most common way private photos stop being private, and it has nothing to do with encryption.
When the trade is worth it anyway
We are not going to tell you to delete the app. The search and the automatic albums are genuinely useful, and they are only possible because the content is readable. That is a coherent trade and most people should take it for most of their pictures.
What is worth doing is splitting the library deliberately:
- Everyday photos stay where the features are. Nothing is gained by making your holiday album inconvenient.
- The small set you would not want read goes somewhere zero knowledge, where the provider holds no key. Identity documents, medical images, anything covered by professional confidentiality.
That split is the practical answer, and it costs almost nothing. The mistake is treating the whole library as one decision.
pCloud 2 TB lifetime, with the Crypto zero knowledge folder
Relevant here for one reason only: the Crypto folder is the zero knowledge part, where the provider holds no key. Use it for the small set described above, not as a replacement for a library you actually search.
Three settings worth checking today
- Review your shared links. In the app, look at what is currently shared and revoke what no longer needs to be. This is the highest value ten minutes on this page.
- Check whether backup is on for every folder, including screenshots and downloads. People are usually surprised by what is being uploaded.
- Decide where the sensitive set lives, and actually move it. A plan that stays a plan protects nothing.
If the underlying question is about Drive rather than Photos, the same reasoning applies and we went through it in is Google Drive secure and in does Google Drive scan your files. For choosing where the sensitive set goes, see the best cloud storage for photos.
The short version
- Search your own library. If it finds things, the content is readable. That is the test.
- Encrypted at rest is not end to end encrypted, and only the second means the provider cannot open your files.
- Shared links are unlisted, not protected, and they outlive your memory of them.
- Split the library rather than deciding for all of it at once.
Commercial links carry the rel="sponsored nofollow" attribute; an affiliate commission may apply at no extra cost to you.
Frequently asked questions
- Is Google Photos end to end encrypted?
- No. Your photos are encrypted in transit and encrypted at rest on Google's storage, which protects them from someone intercepting the connection or walking off with a disk. Neither of those is end to end encryption, which would mean Google itself cannot read the content. You can confirm this in ten seconds without reading any policy: search your own library for a word like beach or dog. If results come back, something on the server side read your pictures.
- Can Google employees see my photos?
- The honest answer is that the system can read them, which is the part that matters for a privacy decision. Access by staff is governed by internal policy and logging rather than by mathematics, and policy can change while mathematics cannot. With end to end encryption the question does not arise, because the provider holds no key. That is the whole difference between the two models.
- Are shared Google Photos links private?
- A shared album link is unlisted, not protected. Anyone who has the link can open it, including someone the link was forwarded to, and it stays valid until you revoke it. Treat a share link as a password that you have handed out and cannot take back silently. Revoking access is a deliberate action you have to remember to take.
- What is the difference between encrypted at rest and end to end encrypted?
- Encrypted at rest means the provider holds the key and unlocks your data to serve it, index it or scan it. End to end encrypted means the key exists only on your devices, so the provider stores something it cannot open. Almost every mainstream photo service is the first kind. The marketing word encrypted covers both, which is why it tells you very little on its own.
- Should I stop using Google Photos?
- Not necessarily, and a page that tells you to would be overselling. The search, the face grouping and the automatic albums are genuinely useful and they are only possible because the content is readable. What is worth doing is deciding deliberately: keep the convenient library for everyday pictures, and put the small set you would not want read into a zero knowledge service. Mixing the two is the practical answer for most people.
Store your files privately → pCloud
Swiss privacy · 10 GB free · optional zero-knowledge Crypto
