An ordinary folder changes purpose
Fictional example: Lara shared a folder with three friends for a trip. Months later, she habitually saves a personal insurance document there. On review, she notices that the travel group still has folder access. She moves the private document to a suitable unshared location and checks that location’s permissions. Also check the affected file’s own sharing settings. Directly granted access can remain independently of the previous folder.
The problem was an old everyday share, not an unusual attack. Before adding more files, ask whether the folder still has the same audience and purpose as it did originally.
Separate named access from link access
A folder may be shared with specific accounts or through a broadly usable link. “Anyone with the link” does not mean “only the people I sent it to”. The link can be forwarded. Available options depend on the service and account type.
Review both sections of the sharing overview. A short list of familiar names does not rule out an additional open link. Check groups too: a group name may include more members than you remember. If uncertain, establish membership with the relevant administrator.
Match rights to the actual task
Reading does not automatically require editing permission. Distinguish viewing, commenting and changing content where those roles are available. Google Drive explains these roles and additional sharing settings in its provider guidance.
Also consider the parent folder. Permissions may come from there, so changing one file does not necessarily address the source of access. Consult current guidance before changing a wider area. Work accounts may have additional organisational restrictions.
Review without destructive shortcuts
Record the folder’s purpose, responsible person and intended recipients. Then remove unnecessary access or reduce rights deliberately. Do not delete an entire file merely to end a share. You might remove a working document that others still legitimately need.
Check the result again in the sharing overview. With non-sensitive test content, you can ask an intended participant to confirm that the planned access works. Do not share confidential files with extra people just to test permissions. Set another review point after the joint activity ends.
Understand the limits of control
Revoking access does not automatically remove copies that somebody has already downloaded or screenshots they have taken. A setting that limits downloads cannot guarantee that visible content will never be passed on. Google acknowledges these limits of technical sharing controls.
If sensitive material has already been shared too broadly, close unnecessary access and discuss the specific situation with the recipients or appropriate responsible service. This article cannot confirm deletion of other people’s copies. For future activities, a separate folder containing only the files actually needed is often easier to oversee than a large miscellaneous collection.
Your checklist
The checkboxes are for your own reference. No entries are sent to us. To keep a copy, print the page or save it as a PDF using your browser menu.
Common questions
Is “Anyone with the link” private enough?
That depends on the content and purpose. It does not restrict access to your original recipients and is not automatically appropriate for confidential files.
Why does someone retain access after a change?
They may have access through a parent folder or group. Check those routes rather than only the individual file.
Can I retrieve copies already downloaded?
Changing a cloud share does not automatically remove them. Address their handling directly and seek appropriate advice if necessary.
Sources and further information
Primary sources from public authorities, consumer organisations and providers. A source may be in another language; follow the guidance that applies to your service and where you live.
- Google Drive: Dateien teilen und Rollen unterscheidenSource review date:
- Google Drive: Freigaben beenden oder einschränkenSource review date:
- BACS: Cloud-Speicher und ZugriffsschutzSource review date:
- Google Drive: direkte und geerbte Zugriffsrechte unterscheidenSource review date:
