36 Disable Google Takeout

draft

Google Takeout gives every user a one-click bulk archive of their mailbox, Drive and other service data. Turning it off removes that self-service export path — the fastest way for a compromised account, or a departing employee, to walk out with everything at once. It applies per OU, and the shared 'Data export permission' toggle covers the jointly-controlled core services while nine other services each carry a switch of their own.

Documentation: Allow or block Google Takeout

Caveats

Takeout off does not stop data leaving — a user can still download from Drive, sync with Drive for desktop, or forward mail. It removes the bulk one-click archive, nothing more.
A configuration-group policy can override the OU setting — a user in the right OU can still export if a group they belong to carries a more permissive Takeout policy.
Changes can take up to 24 hours to propagate — and an export already queued before the change may still complete.

Setup steps

Select the root org — or the OU (organizational unit) holding sensitive staff — in the left OU tree, then open the consolidated Takeout controls page.

open ↗

https://admin.google.com/ac/managedsettings/850805570439 · captured 2026-07-15

Data › Data import & export › Google Takeout

OU

root / high-risk OU

How the organizational structure works
Turn off the shared 'Data export permission' that governs Drive, Gmail, Calendar, Chat and the other jointly-controlled core services.

Data › Data import & export › Google Takeout › User access to Takeout for Google services

Data export permission

Don't allow for everyone
Turn Takeout off individually for each service that is NOT covered by the shared toggle — these each carry their own switch and stay ON otherwise.

Data › Data import & export › Google Takeout › Services with individual controls

YouTube, Google Photos, Blogger, Google Play, Google Pay, Location History, Google Maps, Google Books, Play Console = OFF
Confirm the users you intended to cover actually sit in the OU you changed — Takeout applies per OU or configuration group, not per user.

open ↗

https://admin.google.com/ac/users · captured 2026-07-15

Directory › Users

Verify OU membership

Move users to an organizational unit

How to verify

As a test user, open takeout.google.com — the covered services must refuse export ("service not available"). User-visible, no admin access needed.

draft v0.0.3 Prevent policy #15 · #4 ↗