Google’s Gemini API Now Logs Your Prompts by Default on New Paid Projects

Google flipped a default in the Gemini API on Monday, October 26, and developers handling sensitive data should notice. New paid-tier projects now store Generate Content requests by default, according to the Gemini API release notes.

That covers generateContent, streamGenerateContent and batchGenerateContent, the main endpoints most apps use to send a prompt and get a response. It brings Generate Content in line with the Interactions API, Google’s newer stateful API, which already stored requests by default.

What changed

Until now, logging on the Generate Content API was opt-in. You had to turn it on in Google AI Studio, the browser-based console developers use to manage Gemini projects.

Now, for new paid projects, the API parameter store defaults to true. Every prompt and response is saved to the project’s logs unless someone says otherwise.

The changelog entry is brief: “Existing projects keep their current setting.”

Who’s affected

Only projects created on or after October 26, 2026. Per Google’s logs and datasets guide, projects created before that date keep their existing setting, which is off (store=false) unless someone previously turned logging on in AI Studio.

Log storage is only available on the paid tier, so free-tier projects aren’t part of this.

The guide says logging covers calls made through Google’s OpenAI compatibility endpoints too. If your team points OpenAI-style client code at Gemini, those requests count.

Some inputs aren’t logged at all. Google lists Imagen and Veo models, embedding models, the Gemini Robotics model, public preview agents, and inputs containing videos, GIFs or PDFs.

What gets stored, and for how long

Stored requests show up in the AI Studio logs dashboard, where you can inspect “the full prompt and response from Gemini, and the context from the previous turns.”

Logs expire after a default retention window of 55 days. You can shorten that to 7, 14 or 28 days. Fifty-five is the maximum.

Logs saved into datasets don’t expire. Datasets are curated collections of logs, meant for building test sets and evaluations, and can be exported as CSV, JSONL or Google Sheets.

Developers can also choose to share datasets with Google “as demonstration examples” to contribute to Gemini research and development. That’s an explicit choice, per the docs, but it’s a few clicks away from logs that are now on by default.

How to turn it off

Two ways:

• Per request: set store to false in the request config. That setting takes precedence over the project default. It requires recent SDKs: google-genai 2.33.0 or later for Python, @google/genai 2.31.0 or later for JavaScript, 1.79.0 or later for Java and 1.76.0 or later for Go.
• Per project: turn off Generate Content API logging in the Settings panel of the AI Studio logs dashboard.

One wrinkle: if your app runs on an older SDK, the per-request flag isn’t available, so the project toggle is the only lever. And Google warns that turning off Interactions API logging in the same panel breaks its automatic conversation history unless you override it per request.

How this compares

Google isn’t the first to default to storage. OpenAI’s data controls page says its Responses API keeps application state for at least 30 days by default, or whenever store is set to true. OpenAI also keeps abuse-monitoring logs for up to 30 days across API features, unless a customer is approved for zero data retention.

The difference is purpose. OpenAI’s stored responses mostly power features like multi-turn state. Google’s Generate Content logs are a debugging and evaluation tool, laid out in a dashboard for people on your team to browse.

Our read

Our read: the logs feature is genuinely useful. Being able to replay real prompts and responses is how you debug an AI app, and most teams end up building something like it themselves.

But defaults are policy. Most developers never change them, and a default of “store everything for 55 days” means prompts full of customer data will sit in a dashboard unless someone actively opts out.

There’s also an access question. The logs live in a dashboard tied to the project, so the circle of people who can browse them is whoever your team grants project access. That may be wider than the circle who should see, say, a support transcript with a customer’s medical details.

The catch: Google applied the change only to new projects, which is the considerate way to do it. Nobody’s existing app silently started logging. But the next project your team spins up for a sensitive workload will, and that’s exactly the kind of thing that slips through a security review.

Why it matters

Why it matters: if your company has data-handling commitments (contracts, health-privacy rules, regional privacy law), check your project-creation checklist. A new project now needs an explicit store=false or a dashboard toggle to keep the old behavior.

It also matters for data deletion promises. If you tell users their conversations aren’t retained, a 55-day log you didn’t know about makes that statement false.

Who this affects

• Developers building on Gemini: any new paid project, including test projects that later go to production.
• Security and compliance teams: another default to audit when projects are created.
• End users of Gemini-powered apps: their prompts may now be stored for up to 55 days in the developer’s logs, whether or not the app’s privacy policy says so.

The takeaway

The takeaway: a small changelog line with real compliance consequences. Logging is useful; logging by default is a decision someone should make on purpose.

What to watch:

• Whether Google adds an organization-wide policy so admins can set the default once, rather than project by project.
• Whether other API providers follow with stored-by-default logging for their core endpoints.
• Clearer documentation on who inside a customer’s organization can see stored logs.

Image: Chad Davis / Wikimedia Commons, CC BY 2.0