Gemini API now stores prompts by default on new paid projects

Google changed a default in the Gemini API: since October 26, new paid-tier projects store generateContent requests by default. That means full prompts and responses sit in AI Studio logs for up to 55 days unless you turn it off. If your app sends customer names, orders or support tickets to Gemini, a new project now keeps a copy of them.

What actually happened

Per the Gemini API release notes, generateContent, streamGenerateContent and batchGenerateContent now default to store=true on new paid projects. That matches the Interactions API, which already stored by default. Projects created before October 26 keep their current setting, which is off unless you turned logging on yourself.

The logs and datasets guide fills in the rest:

• What's stored: the full prompt, the full response and the context from earlier turns.
• Retention: 55 days by default. You can set a project to 7, 14, 28 or 55 days. Logs you save to a dataset don't expire.
• Opt out per project: in AI Studio's Logs settings, toggle Generate Content and Interactions logging separately.
• Opt out per request: pass store=false. For Generate Content that needs a recent SDK: google-genai 2.33.0+ (Python), @google/genai 2.31.0+ (JavaScript), 1.79.0+ (Java), or 1.76.0+ (Go).
• Catch: turning Interactions API logging off also stops automatic conversation history, unless a request overrides it.

The same release notes list a Gemini API CLI (gemini-api) beta on October 27, built for coding agents and CI pipelines. If an agent spins up a fresh project for it, that project gets the new default.

Why it matters for your business

Logging is useful. You can debug a bad answer, build an eval set and see what users actually ask. But it's also a second copy of your customer data, held by a vendor, for nearly two months. That copy belongs in your privacy policy and your data map, and you should decide on it deliberately.

What we'd do this week:

• List your Gemini projects and note which ones were created on or after October 26.
• Pick a policy per app. Internal tools with no personal data: logging on, short window. Anything with customer PII: store=false in code, not just a dashboard toggle someone can flip back.
• Pin your SDK version so the per-request flag actually works.
• Check your saved datasets. Those never expire.

Sources: Gemini API release notes, Gemini API logs and datasets guide.