# 34 Disable Google Takeout

> v0.0.3 · role: Prevent · [policy: #15 · #4](https://docs.google.com/spreadsheets/d/1nOztaPd1Y7eNeRSR_hdovYy-ncpx-bAx/edit?usp=sharing&ouid=115159875779023172526&rtpof=true&sd=true)

Google Takeout gives every user a one-click bulk archive of their mailbox, Drive and other service data. Turning it off removes that self-service export path — the fastest way for a compromised account, or a departing employee, to walk out with everything at once. It applies per OU, and the shared 'Data export permission' toggle covers the jointly-controlled core services while nine other services each carry a switch of their own.

Documentation: [Allow or block Google Takeout](https://knowledge.workspace.google.com/admin/users/advanced/allow-or-block-google-takeout)

## Caveats

- Nine services carry their own Takeout switch — YouTube, Photos, Blogger, Play, Pay, Location History, Maps, Books and Play Console are NOT covered by the shared 'Data export permission' toggle, so missing them leaves the control half-applied.
- Takeout off does not stop data leaving — a user can still download from Drive, sync with Drive for desktop, or forward mail. It removes the bulk one-click archive, nothing more.
- Takeout is applied per OU or configuration group, not per user — verify that the people you meant to cover actually sit in the OU you changed, and check for group-based overrides.
- Changes can take up to 24 hours to propagate — and an export already queued before the change may still complete.

## Setup steps

1. Select the root org — or the OU (organizational unit) holding sensitive staff — in the left OU tree, then open the consolidated Takeout controls page. — `Data › Data import & export › Google Takeout`

   - **OU** = root / high-risk OU

   docs: [How the organizational structure works](https://knowledge.workspace.google.com/admin/users/advanced/how-the-organizational-structure-works)

2. Turn off the shared 'Data export permission' that governs Drive, Gmail, Calendar, Chat and the other jointly-controlled core services. — `Data › Data import & export › Google Takeout › User access to Takeout for Google services`

   - **Data export permission** = Don't allow for everyone

3. Turn Takeout off individually for each service that is NOT covered by the shared toggle — these each carry their own switch and stay ON otherwise. — `Data › Data import & export › Google Takeout › Services with individual controls`

   YouTube, Google Photos, Blogger, Google Play, Google Pay, Location History, Google Maps, Google Books, Play Console = OFF

4. Confirm the users you intended to cover actually sit in the OU you changed — Takeout applies per OU or configuration group, not per user. — `Directory › Users`

   Verify OU membership

   docs: [Move users to an organizational unit](https://knowledge.workspace.google.com/admin/users/advanced/move-users-to-an-organizational-unit)

## How to verify

1. As a test user, open takeout.google.com — the covered services must refuse export ("service not available"). User-visible, no admin access needed.

## Settings screens

- Data > Data import & export > Google Takeout
  - console: https://admin.google.com/ac/managedsettings/850805570439
  - screenshot: ../screenshots/admin.google.com/ac/managedsettings/850805570439.png
- Directory > Users (spot-check an OU member after the change)
  - console: https://admin.google.com/ac/users
  - screenshot: ../screenshots/admin.google.com/ac/users.png