Google Cloud Storage

What Google Cloud Storage is

Google Cloud Storage is the managed object storage service of Google Cloud Platform. It stores files of any kind in containers called buckets, with a flat namespace, immutable object versions and a HTTP/HTTPS API. It is used as a backend tier for file uploads (user generated content, profile pictures, document attachments), media hosting (images, video), backups, machine learning training datasets and as a static asset CDN tier. Operators choose the bucket location (single region, dual region or multi region) and the storage class (Standard, Nearline, Coldline, Archive) for each bucket.

What data is involved

From a privacy perspective the data inside the buckets matters more than the service itself. Buckets typically contain personal data: user uploaded files, profile photos, account documents, backups of databases, datasets used to train models. Cloud Storage itself logs each API access (bucket read, write, delete) in Cloud Audit Logs, which include the caller identity (service account or user account) and the IP address. End user IPs are logged when public buckets are accessed directly from a visitor's browser.

GDPR and ePrivacy implications

As a backend storage service, Google Cloud Storage falls under the GDPR rules for processors. Google acts as a data processor under its Cloud DPA. The lawful basis for the underlying processing (storing user files, hosting images) depends on the use case. ePrivacy Art. 5(3) does not apply to backend storage itself, but if the operator serves assets directly from storage.googleapis.com to the visitor's browser, Google may set cookies on that domain that require consent. Operators usually mitigate this by serving assets through their own domain (using signed URLs or a CDN that proxies the bucket).

Data residency and US CLOUD Act exposure

EU regional buckets (europe-west1 Belgium, europe-west3 Frankfurt, europe-west9 Paris, europe-southwest1 Madrid, europe-north1 Finland, europe-central2 Warsaw, etc.) keep the object data in that region with replication inside the region. The eu multi region replicates across multiple EU regions. However, Google LLC remains a US company subject to the US CLOUD Act, which can compel Google to disclose data to US authorities regardless of where the data is stored. The CNIL, BfDI and DSK have all expressed concerns about US hyperscaler use for sensitive workloads. For very sensitive cases, Google offers Sovereign Controls and partnerships (T Systems for Germany, S3NS for France) that restrict admin access to EU personnel and EU controlled key management.

Configuration choices that affect compliance

Choose EU only bucket locations for personal data. Enable Customer Managed Encryption Keys (CMEK) via Cloud KMS to keep the encryption keys under operator control. Enable Cloud Audit Logs (Data Access logs) for accountability, with retention aligned to the data protection register. Use Object Versioning and Bucket Lock for retention compliance. Use Signed URLs to serve assets to the visitor's browser through the operator's own domain rather than directly from storage.googleapis.com, which avoids Google domain cookies. For highly regulated workloads, evaluate Sovereign Controls (Assured Workloads), T Systems (Germany) or S3NS (France).

Practical compliance steps

Sign the Google Cloud DPA and Standard Contractual Clauses. Document the bucket locations in the record of processing. Run a Transfer Impact Assessment focused on US CLOUD Act exposure, with mitigations (CMEK, audit logs, EU only locations, optionally Sovereign Controls). List Google as a sub processor in the privacy notice with the categories of data, the EU storage location and the transfer mechanism. If public buckets are loaded directly into the visitor's browser, list any Google cookies in the cookie policy or migrate to signed URL delivery through the operator's own domain.