The Share Link button sits next to every file in Google Drive, Dropbox, and OneDrive. Click it, set the permission to “Anyone with the link can view,” and paste the URL into an email or a message. It takes about four seconds and feels completely harmless.
That four-second decision can expose your file permanently — and you’ll likely never know it happened.
How Shareable Links Work (And Why That’s the Problem)
When you generate a shareable link for a cloud file, you’re not sending the file to a specific person. You’re creating an access credential — a URL that functions as a key to that file — and sharing that key broadly.
Shareable links are typically constructed from a base domain plus a long, random-looking string of characters. That string is designed to be difficult to guess, but “difficult to guess” is not the same as “private.” The link is functional for anyone who has it, regardless of whether they were supposed to receive it.
That link can travel without your knowledge:
- The person you sent it to forwards it in an email thread that gets CC’d widely.
- It gets indexed by a search engine after someone shares it on a public forum.
- It appears in a corporate email archive that gets breached years later.
- A web archive service captures it when someone with the link visits a page that embedded it.
- Your email provider can read the link in the message you sent.
None of these scenarios require anyone to “hack” the link. They happen through ordinary, everyday behavior — and they’re largely invisible to you.
The Indexing Problem
Search engines index publicly accessible content. A shareable cloud link set to “Anyone with the link” is technically public — it’s not behind authentication — which means it can be indexed if someone posts the link on a public page.
There are documented cases of Google Drive links to sensitive documents — including personal medical records, financial documents, and confidential business materials — appearing in search results because the link was included in a publicly accessible webpage. This is not a hypothetical edge case. It’s a predictable consequence of how web crawlers operate, and it happens with enough regularity that security researchers have built tools specifically to discover indexed drive links.
What Stays Accessible After You Think You’re Done
Most people assume that a shareable link expires when they’re done with whatever they needed it for. In practice, most platforms do not expire shareable links automatically. Unless you explicitly revoke the link, it remains active indefinitely.
That means:
- The link you generated to share a document with your accountant two years ago is still active.
- The link you sent to a contractor to download project files is still working.
- The link to an internal document you shared with a colleague who has since left the company is still accessible to them.
Google Drive, Dropbox, and OneDrive all support link expiration — but it’s not the default. You have to know the option exists and remember to set it every time.
Link Types That Offer Less Protection Than They Look Like
Comment-only links don’t prevent the underlying content from being extracted. Someone with a comment-only link to a Google Doc can still copy the document’s text. Comment access is a permission setting, not an access control on the content itself.
“Anyone with the link can view” on Google Photos shared albums differs from the equivalent setting in Google Drive. Photo albums with this setting can be embedded on external websites, and individual images within the album can be directly linked — meaning individual photos can be shared without any reference to the original album context.
Password-protected links on platforms like Dropbox Paper and Canva can be brute-forced for weak passwords. And the password is often included in the same email as the link — making it largely ineffective if the email is compromised.
The Corporate and Professional Risk
Shareable links create specific liability in professional settings that individuals often underestimate.
When you share a client contract, a draft proposal, or an internal presentation via a generic shareable link, you’ve created a copy of that document accessible to anyone with the URL — outside your organization’s data governance controls. If that document is later involved in a dispute, there may be no way to demonstrate who accessed it or when.
Enterprise cloud storage platforms typically include audit logging — a record of who accessed a file and when — but only for files accessed through authenticated sessions. Shareable link access often bypasses audit logging entirely. You can’t reconstruct who opened the file or how many times.
What Organizations With Compliance Requirements Do Instead
Organizations operating under regulatory requirements — healthcare, financial services, legal — typically prohibit shareable link access for sensitive documents. Instead, they use:
Authenticated sharing — sharing that requires the recipient to log in with a verified email address. Google Drive supports this: you can share with specific named email addresses rather than generating a generic link. Access is tied to an identity.
Temporary, single-use links — generated per request, tracked to a specific recipient, and expired after first use or a defined time window.
Dedicated secure file transfer services — tools built specifically for document delivery, with audit logging, expiration controls, and recipient verification.
None of these are as fast as clicking “anyone with the link.” That friction is the point.
The Riskiest File Types for Link Sharing
Not all files carry the same risk if a link is exposed. The highest-risk categories:
- Tax documents and financial statements (contain account numbers, income data, government IDs)
- Legal documents and contracts (may contain personal information about multiple parties)
- Medical and health records (protected under HIPAA when handled by covered entities, but not when shared via personal cloud links)
- Personal identity documents (passports, driver’s licenses, Social Security cards photographed and stored in cloud)
- Business documents with competitive information (pricing, customer lists, product roadmaps)
For these categories specifically, the “anyone with the link” permission should be treated as unavailable, regardless of how convenient it would be.
Revoking Links You’ve Already Sent
If you’re reading this with a growing sense of unease about links you’ve generated in the past, the cleanup process is tedious but doable.
In Google Drive: open each file, click Share, expand the link settings, and change or remove the existing link access.
In Dropbox: go to the file, click the link sharing option, and select “Remove link” or set an expiration date.
In OneDrive: open the sharing settings for the file and remove or expire existing links.
The practical problem is that most cloud storage apps don’t give you a centralized view of all the files you’ve shared via link. You have to find them individually, typically through the “Shared” section of your storage interface — which may not be comprehensive.
A Better Default
The correct default for any sensitive file is person-specific sharing — sharing with a named email address that requires authentication — rather than a generic shareable link. Use shareable links only for content you’d genuinely be comfortable with anyone seeing, and set an expiration date every time.
For documents you need to share privately and retrieve later, a private storage service built around access control rather than convenience-first sharing offers a more defensible model.
The share button is not the problem. The assumption that convenience and privacy can coexist in the default state is.