Gemini API logging is on by default now: opt out in Node.js

Originally published on Extenify.

Gemini API logging flipped to "on" for every paid project created on or after October 26, 2026, and nothing in your code or your error logs will tell you. From that date, generateContent calls in new projects keep the full prompt, the response and earlier turns for up to 55 days. Here is what gets stored, who can read it, and the few lines of Node.js that put the decision back in your hands.

What actually changed

Google's changelog says new paid-tier projects now store Generate Content requests by default, the same way the Interactions API always has. Projects created before October 26 keep whatever they had, which is usually off.

API	Project created before Oct 26, 2026	Created on or after Oct 26, 2026
Generate Content	Off unless someone enabled it	On
Interactions API	On	On

The scope is wider than the name suggests:

• Batch and streaming calls (batchGenerateContent, streamGenerateContent) are logged too.
• Calls through the OpenAI-compatible endpoint are logged.
• Only paid projects have logs. Free-tier keys have no logs but fall under different (looser) data terms.

A few inputs are never logged: Imagen, Veo, Gemini embedding models, the Robotics model, requests containing video, GIFs or PDFs, and public preview agents. So an embeddings pipeline is safe; a review classifier is not.

What a log entry holds, and for how long

This is not a token counter. Opening an entry in Google AI Studio's Logs page shows the whole payload: prompt, response and prior conversation context. Anyone with access to the project can read it.

Retention works like this:

• 55 days by default, after which entries are marked for deletion.
• Owners can shorten it to 7, 14 or 28 days.
• Entries you save into a dataset never expire until you delete the dataset.

On the paid tier, logged data is not used for training. That changes only if you share a dataset with Google or join the invite-only Contributor Tier, both of which move the data under the Unpaid Services terms, where human reviewers may read it.

One thing opting out does not touch: Google's separate abuse monitoring still keeps prompts and outputs for 55 days, used only for policy enforcement.

Opt out per request in Node.js

A request-level setting overrides the project setting, so the most dependable fix lives in code. In @google/genai (2.31.0 or later), store sits inside config. Over REST it is a top-level store field next to contents.

The trap is scattered call sites. Wrap the SDK once and make "don't store" the default:

// llm/gemini.js - the only file allowed to import @google/genai
import { GoogleGenAI } from '@google/genai';

const client = new GoogleGenAI({}); // uses GEMINI_API_KEY

export function askGemini(model, contents, { config = {}, keepLog = false } = {}) {
  // store is set last, so a stray config.store can't re-enable logging
  return client.models.generateContent({
    model,
    contents,
    config: { ...config, store: keepLog },
  });
}

Then guard it in CI:

# fail the build if anything else imports the SDK directly
! grep -rl "@google/genai" src --include=*.js | grep -v "llm/gemini.js"

Pin the minimum SDK version in package.json. Older versions silently ignore the setting.

Interactions API caveat: it stores requests on purpose so you can continue a conversation with previous_interaction_id. Its store flag is a top-level argument, and turning it off means you must send the full history yourself on each turn.

Belt and braces: the project switch

In AI Studio, open Logs, pick the project that owns your production key and check the Settings panel. It has separate toggles for Generate Content and Interactions. Turn Generate Content off unless you use it deliberately.

You want both layers:

1. The request flag protects you from the project someone creates next month with the new default.
2. The project switch protects you from a call site that forgot the flag, and covers OpenAI-compatible calls where the docs show no per-request option.

Repeat the check for every project that holds a production key. New features and new environments often get fresh projects, which is exactly where the new default applies.

If you keep logging on

Logs are useful: real production prompts make better evaluation sets than invented ones. If you keep them, keep them tidy:

• Cut retention to 7 or 14 days.
• Strip emails, phone numbers and order IDs before sending. A classifier rarely needs them.
• Treat datasets as permanent copies and delete them after the evaluation.
• Don't share datasets containing user content with Google.
• Limit who can open the project.

This matters most if you pipe user text through Gemini: store reviews, support tickets, or page content from a browser extension's AI feature. Make sure your privacy policy and store data disclosures still describe what your backend really does.

For comparison, OpenAI's Responses API also keeps application state for 30 days by default and accepts store: false. If you abstract several providers behind one client, make "no storage" the default there too.

Key takeaways

• Paid Gemini projects created on or after Oct 26, 2026 log full Generate Content requests by default; older projects are unchanged.
• Logs live up to 55 days; datasets built from them never expire.
• Send store: false (SDK 2.31.0+) through a single wrapper, and switch off project-level logging too.
• Opting out doesn't stop Google's separate 55-day abuse-monitoring retention.
• If you keep logs, shorten retention and redact personal data first.

The original post has the full checklist, FAQ and the exact policy quotes in the complete guide to Gemini API logging and how to opt out. If store reviews are the text you feed into an LLM, Extenify's app review and extension analytics dashboard collects them daily so you only send the ones that matter.

Did your team find out about this default from the changelog, or from spotting full prompts in AI Studio's Logs page?