Why you Shouldn't Share from Google Drive

TL;DR

1. Share links travel. Anyone with a Google Drive share link can open the file and, by default, download it, and unless you’re a Workspace admin with audit log access, you can’t see who downloaded it.
2. Named sharing still allows downloads. Sharing with specific people limits who can open a file, but by default they can still download it and pass it on.
3. Google's 2025 changes organize access but don't stop copies. Limited access folders and folder-level inheritance change how access works inside Drive, not what people do with a file once they have it.
4. Cleaning up takes admin tools or a script. Workspace admins can turn off sharing outside the organization or transfer a departing employee's files, and a short Apps Script can unshare a whole folder.
5. Secure sharing adds tracking and device control. Tools like Orangedox add secure file sharing on top of Google Drive: they show who viewed a file and when, lock access to each recipient's devices, can block downloads and let you revoke access at any time.

In short: use Drive to store and collaborate, and a secure sharing layer for confidential documents that leave your team.

Google Drive is a great tool for storing your documents and collaboration with your team using their tools like Google Docs, Sheets and Slides. However, what happens when you need to share these documents with someone else? and most importantly how safe are my shared documents?

To answer this question let’s look at the different ways you can share your docs using Google Drive.

Sharing with a Share Link

When Google first created Google Drive they needed an easy way for documents to be shared, mainly because these documents reside on Google servers (not your computer) they’d need to provide an easy way for someone to actually download a copy of the document. So they came up with share links.

Sharing a file using Google Drive using a share link is the easiest way to share your documents. Anyone with the link will be able to view and download the file. However, therein lies the issue, anyone with the link can view and download the document. This means that it can be shared with whomever and since Google Drive doesn’t show you a file’s downloads you’ll have no idea who, or how many people have downloaded your document. This is probably your worst nightmare if you’re sharing something confidential.

Share with Specific People

I imagine that Google probably got lots of feedback from their customers around how insecure their share link feature worked and in response to this they created a second way of sharing files: “Share with Specific People”. You specify the email address of an individual and only they would be able to access the file.

Great problem solved!

Unfortunately not. Firstly this feature requires that your recipient has a Google account, unless your Google Workspace admin has turned on visitor sharing, and secondly, by default they can still download the file and share it with anyone they want. So although this is great for collaborating with a team of individuals that you trust, what about sending confidential information to someone you don’t fully trust?

Secure Document Sharing

Secure document sharing is a feature that is provided by third-party plugins for Google Drive like Orangedox. It helps to solve the issue of sharing directly from Google Drive, ensuring that your documents are only viewed by the intended recipient.

How does secure document sharing work?

When sharing using a secure document-sharing service you’ll be able to share with anyone who has an email account, not just Google users. Secondly you’ll be able to prevent the document from being downloaded. This will force your audience to view the document online, allowing you to control access and help prevent it from being shared without your permission.

Here's what you get with a secure sharing tool:

1. Share with anyone, not just Google account holders. Your recipients can access documents regardless of what email provider they use.
2. Prevent downloading. You can force recipients to view the document online only, removing their ability to save a local copy.
3. Track who views your document and when. You'll know exactly who has opened your file and how many times, something Google Drive doesn't offer for shared links.
4. Revoke access at any time. Changed your mind about sharing? You can disable access instantly, even after the link has been sent.
5. Control the number of devices each recipient can view from, limiting forwarding and shared access.

But couldn’t they just share the link and/or password?

Orangedox gets around this issue by not relying on passwords, as they can easily be shared. Instead, your documents are attached to a specific recipient's device (like their phone, laptop, tablet, etc..) once it's first opened, which prevents the recipient from being able to forward access to someone else. Even if they share the link to the document, once it’s attached to a device only that device will be able to open that document link.

You can then simply control the number of devices each recipient can view your documents from, and disable access whenever you want.

Google Drive's Sharing Changes

Google has made several notable updates to how sharing and permissions work in Drive in 2025. While some of these changes are positive steps toward better permission management, they also highlight the limitations that remain when it comes to truly securing confidential documents.

Limited Access Folders (February 2025)

In February 2025, Google rolled out general availability of "limited access" folders across both My Drive and shared drives. Folder owners and shared drive managers can now restrict a folder so that only specifically added individuals can open it, even if others have general access to the parent shared drive. This is useful for keeping sensitive project files within a broader team drive without exposing them to everyone.

It also helps to know what happens when you change a shared folder. If you stop sharing a folder with someone, the change applies to every file and subfolder inside it, unless they were given more access to a specific file. Deleting works differently: moving files to the trash doesn't end access, and anyone you shared them with can keep opening them until they're permanently deleted, which happens automatically after 30 days in the trash. To cut off access straight away, stop sharing first, then delete.

Folder-Level Permission Inheritance (September-October 2025)

From September 22, 2025, Google stopped allowing individual files and folders within a shared folder to have more restrictive permissions than their parent folder. Previously, you could limit access to a specific file independently of the folder it sat in. Now, permissions must be managed at the folder level, as items inherit the access settings of their parent. The exception is a limited access folder: a file or subfolder that needs tighter access than its parent now belongs in one.

Additionally, the "Editors can change permissions and share" setting was updated: turning it off still prevents editors from sharing an item directly, but if the item's owner moves it into a shared folder, the folder's permission changes will now also apply to that item, even if the item's owner wasn't the one making the changes. And from October 8, 2025, Google began applying limited access to items that have this setting turned off, as its announcement of the change explains.

Because of these inheritance rules, unsharing a single file takes a different approach.

Tip: to stop sharing one file inside a shared folder without changing the whole folder, move the file out of it. Google suggests moving it to a new, dedicated folder with limited access, and once the file is in a folder you own, you control its sharing. Then check the file's own sharing settings, because anyone given access to the file itself keeps it.

What This Means for You

These changes make internal permission management more consistent and predictable. However, they don't address the core problem with sharing confidential documents externally: once someone has access to a file, by default they can still download it and redistribute it freely. Google's updates focus on how access is structured within Drive, not on preventing recipients from saving or forwarding your content once they have it.

How to Remove Sharing Permissions from Multiple Google Drive Files and Folders at Once

For organizations, revoking access one file at a time isn't feasible. Google Workspace admins can make bulk changes in the Admin console, and a short Apps Script can unshare one folder and everything in it.

Using the Admin Console

Google Workspace admins can switch off sharing outside the organization. In the Google Admin console, go to Menu > Apps > Google Workspace > Drive and Docs, click Sharing settings > Sharing options, and turn external sharing off. External users then also lose access to any items previously shared with them. You can apply the setting to the whole organization or to one organizational unit or group, and it can take up to 24 hours to see changes.

It's a blunt tool, though: people in that unit or group also can't share Drive files or links with anyone outside the organization from then on.

For a targeted cleanup, the security investigation tool lets admins search Drive log events, select files in the results and choose Audit file permissions. From there they can manage who has access to those files, change their link-sharing settings and review the pending changes before saving. It's only in some editions: Enterprise Standard and Plus, Education Standard and Plus, Frontline Standard and Plus, Enterprise Essentials Plus and Cloud Identity Premium, not the Business editions.

Using Google Apps Script for Bulk Unsharing

If you need to remove sharing from one folder and everything in it, without changing settings for the whole organization, Google Apps Script can do it. The script below works through the folder, its files and every subfolder. For each item it sets general access to Restricted, so only people added by name can open it, then removes everyone added by name except the owner.

To use it, go to script.google.com, start a new project, paste the code and replace YOUR_FOLDER_ID with the folder's ID, the part of its web address after /folders/. Then run removeSharing and approve the permissions it asks for. Before you do:

1. Run it from the account that owns the folder, and try it on a test folder first. It removes access for everyone except the owner.
2. Use it on folders in My Drive. In a shared drive, members keep access through the shared drive itself.
3. Apps Script stops a run after six minutes, so for a very large folder, run it on one subfolder at a time.
4. Anything it can't change, such as files you can only view, is listed in the execution log.

Workspace Admin Guide: Stopping Sharing When an Employee Leaves

When an employee leaves, a Google Workspace admin should move the files they own to someone who stays, then delete the account. Here's how, following Google's steps to delete a user:

1. In the Google Admin console, go to Menu > Directory > Users.
2. Point to the departing user, click More options, then Delete user.
3. If you're a super admin, select Transfer under Data in other apps, choose Drive and Docs, and enter the email of the manager or IT admin who will take over the files. Other admins must transfer the data before deleting the user, with the Transfer ownership tool under Apps > Google Workspace > Drive and Docs.
4. Click Delete User.
5. Ask the new owner to review the transferred files and remove any sharing that's no longer needed. Transferring files doesn't change who has access to them.

Two things to know: the transfer doesn't include files in shared drives, which your organization owns rather than the user, and any data that isn't transferred is deleted. Deleted Drive files are kept for 20 days, but only restoring the user brings them back.

Conclusion

Google Drive is a great tool for storing your documents and collaborating on their creation. But it lacks the security features needed to ensure that your documents are protected. Instead look to third party plugins, like Orangedox, to help securely share your documents. You can see how the two compare in Orangedox vs Google Drive.

FAQ

Is Google Drive safe for sharing confidential documents?

For internal team collaboration among trusted colleagues, Google Drive is generally safe. However, for external sharing of confidential information it has significant gaps: recipients can download and redistribute files, there's no download tracking on share links, and once someone has downloaded a copy, you can't take it back. For sensitive external sharing, a dedicated secure document sharing tool is a better choice. Our guide "Is Google Drive safe?" covers the wider question of how secure Drive is.

What's the difference between a share link and sharing with a specific person in Google Drive?

A share link can be accessed by anyone who receives it, and there's no restriction on who can use it. Sharing with a specific person limits access to that individual's Google account. However, by default both methods still allow the recipient to download your document and share it further. Neither option provides the document-level controls you'd get from a secure sharing platform.

Do the 2025 Google Drive permission changes make my documents more secure?

The 2025 updates, including limited access folders and folder-level permission inheritance, improve how access is structured within teams and shared drives. But they don't prevent recipients who already have access from downloading and re-sharing your files. For external confidentiality, these changes don't close the gap.

Can I stop someone from downloading a document I've shared on Google Drive?

Partly. A file's owner can turn off downloading, printing and copying for viewers and commenters, and since July 2025 Google Workspace owners can do the same for editors. That removes the download option, but it can't stop screenshots or screen recording. Orangedox's view-only sharing also blocks downloading, printing and saving, and adds page-by-page tracking for each recipient and a limit on the devices each recipient can use. On the Teams plan, dynamic watermarking also puts each recipient's email address across every page.

Does secure document sharing work for people who don't have a Google account?

Yes, this is one of the key advantages of third-party secure sharing tools. Unlike Google Drive's built-in sharing, which works best when recipients have a Google account, tools like Orangedox work with any email address regardless of the provider.

What happens if I want to revoke access to a document I've already shared?

With Google Drive, you can remove access for specific people you've shared with, but anyone who downloaded a copy keeps it. Setting a share link's general access back to Restricted stops the link working for anyone you haven't added by name. With Orangedox, you can disable access at any time, and it takes effect immediately, even mid-session. Because access is locked to each recipient's devices rather than the link, a forwarded link doesn't open on a new device once you've set a device limit.

How do I stop sharing just one file inside a shared folder?

Since September 2025, a file can't have less access than the folder it's in, so you can't simply remove people from that one file. Move it out of the shared folder instead, ideally into a new folder with limited access as Google's help on sharing folders suggests, then check the file's own sharing settings for anyone added to it directly. If you share the file through Orangedox, you can disable one recipient's access to it without affecting anyone else, and their activity history stays.

How do we stop sharing files when an employee leaves the company?

In Google Workspace, transfer the departing employee's Drive files to another user, then delete their account under Directory > Users in the Admin console. Super admins can transfer the files in the delete dialog; other admins must use the Transfer ownership tool first. Transferring doesn't change who has access, so the new owner should then review the files and remove any sharing that's no longer needed. Files in shared drives aren't part of the transfer, because the organization owns them.

Is Orangedox suitable for large businesses?

Orangedox is designed to work as an added document security layer on top of your Google Drive, making it accessible for businesses of all sizes already using Google Workspace. It provides enterprise-relevant features like per-recipient device control, access audit trails, and granular revocation, without requiring you to move away from your existing Drive infrastructure. You pay only for admins, never for recipients, and the Teams plan adds manager access, dynamic watermarking and a dedicated support rep.

Start your 14-day free trial of Orangedox Virtual Data Rooms and see what Orangedox can do for your business.

Orangedox provides one-click virtual data rooms that are directly synced with your Google Drive folders.