The habit is so automatic most people don’t think of it as a data disclosure. You receive a document in another language — a foreign medical report, a lease agreement from an international supplier, a contract written in French — and you paste it into Google Translate. A few seconds later you have a readable version.
What you also have is a record on Google’s servers of exactly what that document said.
AI translation has become one of the least scrutinized privacy risks in everyday document handling. Free consumer translation tools from Google, Microsoft, and DeepL process hundreds of millions of words per day, much of it sensitive personal and professional content. The privacy implications have not caught up with the convenience.
What Happens When You Submit Text to a Translation Service
When you paste text into Google Translate or drag a document into DeepL’s free web interface, that content is transmitted to the service’s cloud servers, processed by their translation models, and — depending on the service tier and configuration — may be:
- Temporarily stored for quality assurance, abuse detection, or auditing purposes
- Logged in service logs alongside your IP address, browser fingerprint, and session data
- Used to improve the translation model — Google explicitly states in its terms that submissions to consumer products may be used to improve its services, which includes improving its AI models
None of this is hidden, exactly — it’s in the terms of service. But the terms of service for translation tools are almost universally unread, even by people who would never post a sensitive document publicly.
The Free Tier vs. Paid Tier Distinction
The most important distinction in translation service privacy is between free consumer products and paid professional or API tiers.
Google Translate (free) is a consumer product. Google’s privacy policy for consumer products covers the free version. Data submitted through the free version of Google Translate may be used to train and improve Google’s AI models. This is the same policy that governs many of Google’s free services.
Google Cloud Translation API (paid) is a business product governed by different terms. Google’s Cloud terms include a commitment that customer data is not used to train AI models without explicit opt-in. The Google Cloud Translation API also supports data residency configurations that specify where processing occurs.
DeepL Free — the free tier of DeepL’s web interface — processes translations on DeepL’s servers. DeepL’s terms for the free product permit retention of submitted text for up to 30 days for the purpose of service improvement.
DeepL Pro — the paid subscription — changes this materially. DeepL Pro commits to immediate deletion of submitted text after translation is complete and explicitly states that Pro-tier translations are not used to improve models.
The pricing difference between free and Pro is modest for individual use. The privacy difference is substantial if you’re translating anything confidential.
What Counts as a Sensitive Document?
The categories of documents people regularly translate through free consumer tools include:
Medical documents — Physician letters, radiology reports, lab results, prescription documents, and hospital discharge summaries frequently arrive in non-English languages for patients with international family members or healthcare histories. Medical information is among the most sensitive categories of personal data under GDPR, HIPAA, CCPA, and equivalent frameworks.
Legal documents — Contracts, NDAs, lease agreements, immigration filings, and court documents. Many legal agreements contain explicit confidentiality obligations that extend to how the document may be shared or disclosed. Sending an NDA through a consumer translation tool to which you’ve granted data usage rights may constitute a breach of that NDA’s confidentiality terms.
Financial records — Bank statements, tax filings, investment account statements, and insurance documents in foreign languages are commonly pasted into translation tools. These contain account numbers, balance information, and tax identifiers.
Immigration documents — Visa applications, residency documents, passport supporting materials, and government correspondence in foreign languages are frequently submitted to free translation services. These contain national identification numbers and personal status information.
Personal correspondence — Emails, messages, and letters from family members, particularly in families that span multiple languages, are regularly pasted into translation tools. While less regulated than medical or legal documents, this is still personal communication with disclosure implications.
Compliance Risks for Business Users
If you use a free consumer translation service for business documents, the compliance exposure extends beyond personal privacy:
HIPAA (US): Free consumer translation services typically do not offer Business Associate Agreements. Sharing protected health information through a service without a BAA is a potential HIPAA violation. This applies to healthcare providers, their staff, and their business associates.
GDPR (EU): Under GDPR, transmitting personal data to a data processor requires a Data Processing Agreement. Free consumer translation tools are not structured as data processors under GDPR — they’re structured as service providers with their own data use rights. Pasting EU residents’ personal data into Google Translate’s free consumer product without a valid DPA creates liability.
Attorney-Client Privilege: Legal documents, once disclosed to third parties, may lose their privilege protection in certain jurisdictions. The question of whether using a translation service constitutes a waiver of privilege has been tested in courts, with outcomes depending on the specific facts and jurisdiction.
NDA Violations: As noted above, NDAs with confidentiality clauses that prohibit disclosure to third parties may classify submission to a third-party AI service as disclosure, regardless of whether the intent was merely to translate.
Microsoft Translator and Bing Translate
Microsoft’s translation products follow a similar pattern to Google’s tiered approach.
Microsoft Translator’s free tier and Bing’s translation features are consumer products covered by Microsoft’s consumer privacy policies, which permit use of submitted content for product improvement.
Microsoft Azure Translator, the API product, is covered by Microsoft’s Data Protection Agreement for Azure customers. Azure’s terms include commitments against using customer data to train models without explicit opt-in, and support data residency configuration.
For business use, the distinction between Microsoft’s consumer translator and its Azure API product is as significant as the distinction between free Google Translate and the Cloud Translation API.
Safer Alternatives for Confidential Translations
Several options reduce exposure when translating sensitive documents:
Paid API tiers: Google Cloud Translation API, DeepL Pro, and Microsoft Azure Translator all offer better privacy terms than their free consumer counterparts. If translation is a regular part of your workflow, the cost difference is worth the compliance improvement.
Local/on-device translation: The privacy ideal is a model that runs entirely on your device. LibreTranslate, hosted locally, processes translation without any network transmission. Several mobile translation apps offer offline modes that download language packs and process locally. The trade-off is typically translation quality and language coverage.
Professional human translation: For the highest-sensitivity documents — legal, medical, immigration — professional human translators who operate under confidentiality agreements offer protections that no consumer AI translation tool can match. Professional translation firms typically offer NDAs as standard.
Redaction before translation: If you must use a free tool, consider whether you can translate a redacted version that removes personal identifiers — names, dates, account numbers, national IDs — and then reapply them manually. This reduces the exposure of the most sensitive elements while still allowing machine translation of the substantive content.
On-Device AI and the Future of Private Translation
Smaller, more efficient language models are increasingly capable of running on consumer hardware. Several smartphones now offer system-level on-device translation that processes languages without network requests.
Apple’s Translation app offers offline translation for supported languages when language packs are downloaded. Samsung’s Live Translation features increasingly leverage on-device processing. Google’s offline translation in Google Translate uses downloaded models that process locally.
The on-device option isn’t perfect — downloaded models have smaller vocabularies and may produce lower-quality translations for technical or legal language — but it eliminates the data transmission problem entirely. For sensitive document translation, the quality trade-off is often worth accepting.
What Good Policy Looks Like
For individuals:
- Use paid translation tiers or API products for any document you wouldn’t post publicly
- Prefer on-device translation apps that support offline processing
- For sensitive personal documents (medical, legal, immigration), consider professional translation or redact personal identifiers before machine translation
For organizations:
- Establish and communicate a clear policy on which translation tools staff may use for which document categories
- Obtain and maintain Data Processing Agreements with any translation vendor handling personal data
- Ensure translation tools used for medical or legal content are covered by appropriate BAAs or privilege-preserving contracts
- Include translation tools in your data inventory — they’re a data processor just like any other
The Pattern Behind the Habit
The translation use case reveals a broader pattern in how people interact with AI tools: the friction between the usefulness of cloud-based AI and the privacy cost of feeding those systems with sensitive information.
Translation is unusual in that the privacy sensitivity is almost always high — you’re typically translating something specifically because it came from another context and needs to be understood in a new one — and the habit of using free consumer tools is deeply ingrained.
The fix is not complicated. For most people, it’s a matter of identifying which documents are sensitive, switching to a paid or on-device alternative for those, and leaving the free tools for content that genuinely doesn’t require protection.
The key question to ask before pasting: would I be comfortable if the company running this service could read everything I’m about to submit? If the answer is no, use a different tool.