Shared links on Google: is your quote, proposal or AI chat public?

You send a client a link to their quote. A supplier gets a link to a shared folder. Someone on your team shares an AI chat that drafted a proposal. Each of those shared links feels private because nobody else knows the address. Google treats it as a page. On 26 October 2026 Google rewrote one of its Search Central guides to tell the tools that make these links to keep them out of search by default, which tells you the pages are getting indexed and that keeping them out depends on a setting the tool may or may not have.

TL;DR: Shared links are ordinary web pages with long addresses. Google can index them once the address appears anywhere it crawls, unless the page carries noindex, a line telling search engines to leave it out. Check your AI chats, documents and quick landing pages, close links you no longer need, and give your site's one-person pages noindex.

What did Google change about shared links on 26 October?

Google's guide "Prevent user-generated spam on your site and platform" gained a section called "Only index content meant for Search" on 26 October 2026. It is addressed to services whose users make "shareable pages, generated outputs, or interactive tools", and it sets a default: "When pages are created for direct sharing, collaboration, or utility rather than public search discovery, apply the noindex rule (using a robots meta tag or X-Robots-Tag HTTP response header) or block crawling in robots.txt by default."

The changelog gives the reason as helping "platforms keep user-created pages that aren't meant for Search out of the index and detect spam earlier". The guide is written for the companies that run AI assistants, document tools and app builders. It still matters to an owner, because it confirms the default you were relying on was never guaranteed. An open share link stays out of Google only when the tool that made it says so in the page. Keeping a link out of Google also leaves it open to anyone holding a forwarded copy.

How does a private share link end up on Google?

An open share link, one that needs no sign-in, is a public page with an address too long to guess. Google does not need to guess it. The address only has to appear somewhere Google crawls: a forum post, a social post, a public document that links to it, a page that lists recent shares. Once Google finds the address, it can index the page like any other, unless the page tells it not to or sits behind a login Google cannot pass.

The two best-known cases both came from AI chats in 2025. Fast Company found over 4,500 shared ChatGPT conversations in Google results, from users who had ticked an opt-in box to make them "discoverable"; OpenAI removed the option, calling it "a short-lived experiment". Forbes then found that Google had indexed more than 370,000 shared Grok conversations. On Grok there was no box at all: pressing "share" created a page that search engines could read, and some of those chats held names, personal details and, in one case, a password.

Google's position, given to Forbes at the time, is the one the new guide repeats: "Publishers of these pages have full control over whether they are indexed."

Which of your shared links should you check first?

The links worth checking are the ones that carry a client's name, a price or a decision. In a small business that usually means three places.

• AI assistants. Any chat you shared to show a colleague or a client a draft. Deleting a ChatGPT conversation from your history does not delete its public share link; shared links are managed separately in the assistant's settings.
• Documents and proposals. Quotes, price lists, contracts and client folders shared with "anyone with the link". Google Drive's search can list every file you own with that setting, which turns a vague worry into a list you can work through.
• Quick pages from app builders. A booking form, a calculator or a one-off landing page made in a no-code or AI builder and sent to a handful of people.

Then search for yourself the way a stranger would. Put your business name, a client's name or a phrase you know sits in a proposal in quotes, and add site: with the domain of the tool you share from. If a page you meant for one person shows up, it is public, and the fix starts in the tool that made it.

How we keep one-person pages out of search on sharphaw.com

Your website sends one-person pages too, and those are the ones you control completely. On sharphaw.com, when we write to a business about a new site, the email links to a page made for that business at an address under /offer/. Every one of those pages tells search engines not to list it (noindex), while still letting them follow its links, and points to the public page, /new-website, as the address that counts. The rule applies to anything typed after /offer/, including made-up codes, because otherwise a stranger could invent an address and get a page under our domain into Google.

The same rule covers the page someone reaches after sending our contact form and the newsletter unsubscribe page. Neither is blocked in robots.txt. That choice is deliberate: Google has to be able to fetch a page to read its noindex, so a robots.txt block would hide the very instruction that keeps the page out.

If your site sends quotes, invoices, booking confirmations or client portals by link, ask whoever maintains it two things: can a stranger with the address open them at all, and do they carry noindex? Whoever built the site can check it in the page source in a few minutes, and it is worth asking before a quote page turns up in a search.

Noindex or robots.txt: which one keeps a page out of Google?

noindex keeps a page out of Google's results; robots.txt only stops Google fetching it. robots.txt is a small file at the root of your domain that tells crawlers which addresses not to fetch. Google's own introduction to it says the file "is not a mechanism for keeping a web page out of Google", and that a blocked page's URL "can still appear in search results", listed without a description.

That gap matters most for share links, because a share link exists to be pasted into emails, chats and posts, and every paste is a chance for Google to find the address. A page blocked in robots.txt can still be listed from those links alone, with Google unable to read anything on it that says otherwise. The new guide names both methods, but for a page that must not appear, noindex is the one that holds, either as a tag in the page or as the same instruction sent by the server (X-Robots-Tag), which also works for PDFs. Using both on the same page defeats the noindex, since Google never fetches a blocked page and so never reads it.

You found a private page on Google. What now?

Close it at the source first, and the order matters. Delete the shared chat, switch the document to restricted access or remove the page from the builder. Google can only change its own results; the page stays readable to anyone with the address until the tool stops serving it, and Google's removal requests for pages you do not own are only granted once the page is gone or changed.

Then ask Google to catch up. Google's Refresh Outdated Content tool lets anyone request an update to a result, with no need to own the site. For a page on your own website, Search Console (Google's free dashboard for site owners) has a Removals tool that hides a URL quickly while the noindex takes effect; that removal is temporary, so the noindex has to be in place before it runs out. If a result exposes personal information such as an ID number or bank details, Google has a separate removal request for it.

What to check this week

List the tools you have shared from this year, open each one's sharing settings and close the links that have done their job. Search your business name with site: on each tool's domain. Then ask one question about your own website: which pages are made for one person, and do they carry noindex?

On sharphaw.com, each of those pages carries its rule in the code with a note on why it is there, so the answer does not depend on someone remembering. If you want the same for your site, see what Foundation covers: it is the website alone, built and then kept by the same person, with the plans and terms published. Or get each new post by email.