Enhancing security controls for Google Drive third-party apps

In October of last year, we announced Project Strobe—a Google-wide effort to review third-party developer access to Google account and Android device data. As a result, we rolled out an updated user data policy further restricting access to Gmail data. Today we’re announcing plans to extend the same policy to Google Drive as part of Project Strobe.

With this updated policy, we’ll limit the types of apps that have broad access to content or data via Drive APIs. Apps should move to a per-file user consent model, allowing users to more precisely determine what files an app is allowed to access. This means that only certain types of apps can request restricted scopes from consumer Google accounts. As always, G Suite administrators are in control of their users’ apps.

How to prepare
If you’re not a developer, you don’t need to do anything to prepare for these changes. While changes will not go into effect until early next year, we recommend developers begin preparations ahead of time by taking the following steps to ensure their apps using Drive APIs stay compliant and keep working for users. You will not need to go through the verification process if your app is created and used by only your organization (and is marked as internal).

1. Before getting started, review the Drive updates to the user data policy and FAQ.
2. Ensure project owner and editor email addresses are up to date.
3. If you've developed a Drive app that uses any of the restricted scopes, we recommend migrating your app to use the drive.file scope in combination with the Google Picker. This combination will enable users to select the specific files from their Google Drive that they want to allow your app to access. Apps that use the drive.file scope will not be required to go through the restricted scope verification and third-party security assessment outlined in the policy.
4. If drive.file is not a possible option (e.g. for backup clients), you should begin preparing your app for the restricted scope verification, a process that, among other steps, ensures your use of data is compliant with the Limited Use Requirements and includes a security assessment if your app stores or transmits through servers. Restricted scope verification for the Drive API will begin early next year. Refer to the FAQ for more info.

In the next few months, we will start to notify impacted developers of the policy changes and will provide additional guidance on how to meet the updated policy requirements.