How to Prevent Downloads in Google Drive?

Why preventing Google Drive downloads matters

A file that sits in Google Drive can be audited, re-permissioned and revoked. A file that has been downloaded cannot. Once a copy lands on a laptop, a USB stick or a personal cloud account, every control you set in Drive stops applying to it.

That is why download control is one of the first things security teams ask about. The common reasons:

• Insider risk and offboarding. The most common exfiltration pattern is an employee pulling large batches of files in the weeks before they leave. Native sharing settings do nothing to stop someone who already has access.
• Regulated data. HIPAA, PCI DSS and GDPR all expect you to limit where sensitive data travels. A downloaded spreadsheet of patient records or card numbers is outside every control you can show an auditor. If you work in healthcare, see Is Google Drive HIPAA Compliant?
• Intellectual property. Roadmaps, contracts, source code and pricing models are easy to take and hard to trace once they leave Drive.
• Compromised accounts. An attacker with a stolen session behaves like a very fast insider. Bulk downloads are often the first sign.

The good news is that Google has added real controls since 2024. The rest of this guide covers what each one does, which edition you need, and where the gaps still are.

Method 1: Block downloads file by file (owners and shared drive managers)

Any file owner can turn off downloading, printing and copying for a file, and this works on every Google Workspace edition. The setting used to cover only viewers and commenters. Since July 2025, Google lets file owners and shared drive managers apply the same restriction to editors.

Steps (Google Drive Help):

1. Open Google Drive, Docs, Sheets or Slides and select one or more files.
2. Click Share.
3. Click the Settings gear at the top right of the share dialog.
4. Under People who can download, copy, and print, check only the roles you want to allow. Leave Viewers, Commenters and, if needed, Editors unchecked.
5. Save and close the dialog.

What changes for each role:

• Viewers and commenters lose the download, print and copy options in Drive, Docs, Sheets and Slides on every platform.
• Editors can still edit the file. They can copy and paste within the document and paste outside content in, but they cannot copy content out of it.
• The owner is not restricted by their own setting. Only an admin DLP rule can block the owner.

While you are in the share dialog, uncheck Editors can change permissions and share so editors cannot hand the file to someone else. Note that a folder's permissions still win: if an editor has access to the parent folder and shares the folder, the new person gets the file too.

The catch: this is manual. Every owner has to remember to do it on every sensitive file, and most never will. Collaborators can see which restrictions apply and who set them through Google's security limitations view, but nobody is checking whether the right files are restricted in the first place. For a guide to the rest of the share dialog, see How to Set Up Google Drive Sharing Permissions to Prevent Data Loss.

Method 2: Enforce download blocking with admin DLP rules

Admins can take the decision away from end users with a data protection rule that applies information rights management (IRM) automatically. Since January 2025, these rules can block every role, including owners and editors. When an admin rule and an owner setting conflict, the admin rule wins.

Steps (Google Workspace Admin Help):

1. In the Google Admin console, go to Menu > Rules > Create rule > Data protection. You need the View and Manage DLP rule privileges.
2. Name the rule and pick its scope (organizational units or groups).
3. Under Apps, choose Google Drive.
4. Set your conditions, for example a predefined detector for credit card numbers, a custom regex, or a classification label.
5. Under Actions, choose Disable download, print, and copy and pick one option:
   • For commenters and viewers only, which leaves editors unrestricted.
   • For all collaborators, which covers commenters, viewers, writers, owners and shared drive managers. Editors can still copy and paste inside the document.
6. Save and turn on the rule.

Useful details:

• The rule applies to My Drive and shared drives. Files are checked when someone opens them, so a user already viewing a file is not restricted until it reloads.
• Gemini follows the same rule. If a user is blocked from downloading a file, Gemini cannot read it on their behalf either.
• You can combine the rule with Context-Aware Access, so downloads are blocked only on unmanaged devices or outside approved networks.
• To both remove a public link and block downloads on the same content, Google says to create two rules with the same conditions and separate actions.

Edition requirement: DLP rules and Context-Aware Access are available on Enterprise Standard and Plus, Education Fundamentals, Standard and Plus, Frontline Standard, and Enterprise Essentials and Essentials Plus. Business Starter, Business Standard and Business Plus do not include them. See Google Workspace DLP: The Complete Guide for what each plan includes.

Where Google's native controls stop

Owner settings and admin DLP rules are a real improvement, but they answer one question: should this file be downloadable? They do not tell you who is downloading what, how much, or why. These are the gaps security teams run into most often.

1. No volume or behavior based blocking. Native rules judge each file on its content. You cannot write a rule like "alert or block when someone downloads 50 files in 10 minutes." Mass downloads by a departing employee or a compromised account look like normal activity, one file at a time.
2. Rules only fire on what they can detect. Google's Drive DLP scans the first 10 MB of extracted text in a file and does not scan audio or video files. Sensitive data in images and scanned PDFs is also easy to miss. If the rule never matches, the download is never blocked.
3. Preview mode printing still works. Google notes that data protection rules do not stop users from printing a file in Preview mode.
4. Business plans get no automation. On Business Starter, Standard and Plus, the only option is the manual owner setting.
5. Download events sit in audit logs, unread. Drive logs record downloads, but nothing alerts your team in Slack or your SIEM when a sensitive file leaves.
6. Blocking downloads does not fix exposure. A file shared with "Anyone with the link" is still readable by anyone, even if it cannot be downloaded. See Google Drive Block Sharing: A Comprehensive Guide.
7. AI agents are a new path out. An agent connected through the Google Drive MCP server reads files with the user's permissions and sends the content to an outside model. That is a copy leaving Drive that no download setting was designed for. More in Google Drive MCP Server: Secure Setup for Claude and AI Agents.

Google itself says these settings limit actions inside Drive, Docs, Sheets and Slides but cannot stop people sharing the content in other ways. Screenshots and photos of a screen are always possible. The goal is to make bulk exfiltration hard and visible, not to promise it is impossible.

🎥 Method 3: Detect and stop excessive downloads with Strac

Strac Google Drive DLP sits on top of Google's controls and covers the gaps above. It connects to Google Workspace over OAuth with no agent to install, and it works on every Workspace plan, Business editions included.

Threshold based download alerts and blocking. Set a limit such as a number of downloads in a time window, and Strac alerts or blocks when a user goes over it. You can apply the policy to all files or only to files that contain sensitive data. Strac tracks prints and moves the same way.

Alerts where your team already works. Download alerts go to Slack, Microsoft Teams, email or your SIEM, so a bulk download is seen in minutes instead of found in a log review weeks later.

Detection that reads the whole file. Strac scans the full file, including images and scanned PDFs through OCR, against a catalog of sensitive data types covering PII, PHI, PCI, credentials and source code, plus your own custom detectors. Download policies can then target only the files that matter. To get these findings as they happen, see How to Set Up PII Alerts in Google Drive Automatically.

Fix the exposure, not just the download. From the same console you can remove public links, remove external collaborators and apply Google Drive labels, one file at a time or in bulk. Strac also shows when each user last accessed a file, so you can revoke access nobody is using. Google Drive DSPM gives you the full inventory of sensitive files across My Drive and shared drives before you write a single policy.

Cover AI agents and endpoints too. Strac MCP DLP inspects and redacts Drive content before it reaches Claude, ChatGPT, Cursor or a custom agent. For files that do get downloaded, Strac Endpoint DLP and Browser DLP extend protection to the device and the browser.

Putting it together: use owner settings for one-off sensitive files, use admin DLP rules to enforce IRM by content if your edition allows it, and add Strac for download visibility, threshold based blocking and remediation across the whole drive. This is one part of a full Google Drive DLP program.

The Bottom Line

Google Drive can finally block downloads for every role. File owners and shared drive managers can restrict editors as well as viewers, and admins on Enterprise and Education editions can enforce it automatically with DLP rules. If you have not revisited these settings since 2024, start there.

Native controls still only decide whether a single file can be downloaded. They do not tell you that someone just pulled 300 files, they do not cover Business plans with automation, and they miss sensitive data their scanners cannot read. Those are the cases behind most real Drive exfiltration incidents.

Use Google's settings as the baseline and add Strac Google Drive DLP for threshold based download alerts and blocking, full file detection and one click remediation. That way you control both what can be downloaded and who is downloading it.

👉 Related reading

• Google Drive DLP: Protect Sensitive Data in Google Drive
• Google Workspace DLP: The Complete Guide
• How to Prevent Google Drive Leaks
• How to Set Up Google Drive Sharing Permissions to Prevent Data Loss
• Google Drive Data Classification
• How to Block PII in Google Drive Automatically
• How to Delete PHI in Google Drive Automatically
• How to Stop Gemini From Surfacing the Wrong Google Drive Files
• Google Workspace Security Best Practices

Related integrations: Google Drive DLP, Gmail DLP, Google Sheets DLP, Chrome DLP, Endpoint DLP, All integrations

See it on your own Google Drive

Strac connects to Google Workspace in minutes with no agent to install. You will see which sensitive files exist, who can reach them, and who is downloading them. Book a demo.

🌶️ Spicy FAQs on Preventing Downloads in Google Drive

Can viewers download files from Google Drive by default?

Yes. Unless the owner or an admin changes it, viewers and commenters can download, print and copy any file shared with them. View access alone does not stop someone from taking a copy.

Can I stop editors from downloading a Google Drive file?

Yes. Since July 2025, file owners and shared drive managers can uncheck Editors under "People who can download, copy, and print" in the share settings. Admins on supported editions can also block editors and owners with a DLP rule.

Can I block downloads for a whole folder?

Not with a single switch in My Drive. You can select several files and apply the setting to all of them at once, set the restriction at the shared drive level as a manager, or let an admin DLP rule enforce it by content across the organization.

Does disabling downloads stop screenshots?

No. Google is clear that these settings only limit actions inside Drive, Docs, Sheets and Slides. Screenshots, photos of a screen and retyping are always possible, which is why monitoring and alerts matter as much as blocking.

Can I prevent downloads on Google Workspace Business Plus?

Only manually. Business Starter, Standard and Plus support the owner setting on each file but not admin DLP rules. Strac adds automated, policy based download control on any Workspace plan.

How do I see who downloaded a file from Google Drive?

Download events appear in the Drive audit log in the Google Admin console. Strac surfaces the same activity as real time alerts in Slack, Teams, email or your SIEM, and can filter to sensitive files only.

Does blocking downloads also stop Gemini from reading a file?

When the block comes from an admin DLP rule, yes. Google states that Gemini cannot access a file on a user's behalf if that user is restricted from downloading, printing or copying it. External AI agents using the Google Drive MCP server are a separate path, covered by Strac MCP DLP.