Chrome Enterprise Premium threat and data protection features are available only for customers who have purchased Chrome Enterprise Premium.
Using Chrome Enterprise Premium threat and data protection, you can integrate Data Loss Prevention (DLP) features to use with Chrome to implement sensitive data detection for files that are uploaded and downloaded, and for content that is pasted or dragged and dropped.
This integration gives you control over what data Chrome users can share, such as Social Security numbers or credit card numbers. It only applies to Chrome browser on Windows, Mac, Linux and the Chrome operating system. Other platforms are not supported at this time.
Chrome Enterprise Premium and DLP
DLP integration with Chrome is included in the Chrome Enterprise Premium suite of features, which is part of Cloud Platform Security. To configure the DLP integration, you will use Google Workspace features.
Chrome Enterprise Premium includes:
- Use of Chrome management features
- Configuration of Chrome connectors
- Configuration of DLP rules in Google Workspace security (described in this article)
- Alerts and investigation of security events generated by Chrome (such as malware or sensitive data detection, phishing or social engineering, or password reuse)
For details on implementing Chrome Enterprise Premium, go to Protect Chrome users with Chrome Enterprise Premium threat and data protection .
Steps to set up DLP for Chrome Enterprise Premium
To implement and use the entire set of Chrome Enterprise Premium DLP protections, you must:
- Step 1: Set up Chrome browser Enterprise connector policies. Go to Set Chrome Enterprise connector policies for Chrome Enterprise Premium in Google Chrome Enterprise Help for details.
- Step 2: Set up data protection rules (described in this article) in Google Workspace Admin console.
- Step 3. Set up activity alerts. Go to View alert details (also in Google Workspace Admin Help) for descriptions of alert types.
After you create your DLP rules, when users upload, download, or copy and paste data into the browser, these actions can trigger events. You can:
- View reports in the security dashboard. Reports related to Chrome Enterprise Premium are:
- Investigate alerts indicating data sharing incidents using the security investigation tool. Go to About the security investigation tool for details.
- View audit log details in the Rule log events .
- Investigate whether a DLP rule violation is a real incident or a false positive. For details, go to View content that triggers DLP rules .
Scan images for sensitive content
Using optical character recognition (OCR), DLP for Chrome scans text in image files and images in PDFs for sensitive content. This includes files uploaded, downloaded and content printed in Chrome.
Supported attachment file types
The following image file types (if OCR is turned on) are scanned: BMP, GIF, JPEG, PNG, TIFF, and images within PDF files.
- Sign in to your Google Admin console .
Sign in using an account with super administrator privileges (does not end in @gmail.com).
- On the Admin console Home page, go to Security Access and data control Data protection.
- For Data protection settings, click Optical character recognition (OCR). The default state for Google Chrome is Off. Select Off and slide it to On.
- Click Save. This turns on OCR for data protection rules that apply to Google Chrome.
Note:Once turned on, the OCR setting will apply to all DLP for Chrome rules. You can’t apply it selectively to specific rules.
- Sign in to your Google Admin console .
Sign in using an account with super administrator privileges (does not end in @gmail.com).
- In the Admin console, go to Menu Rules.
- For Classify and protect your sensitive content, click Create rule.
- Click Nameand enter a name for the rule and, optionally, a description.
- For Scope, choose an option:
- To apply the rule to your whole organization, select All in domain.name .
- To apply the rule to specific organizational units or groups, select Organizational units and/or groupsand include or exclude the organizational units and groups.
- Click Continue.
- Under Apps, for Google Chrome, check File uploaded.
- Click Checkin the banner to ensure that OCR is turned on to scan text in images and PDFs. If Chrome is not checked, check the Chromebox to turn OCR on for Chrome.
- Click Continueto finish creating the rule.
DLP rule examples that support Chrome Enterprise Premium integrations with Chrome
- Before you create DLP rules with Chrome settings, be sure you have updated Chrome Enterprise connector policies to support Chrome Enterprise Premium features and integration with DLP. Go to Set Chrome Enterprise connector policies for Chrome Enterprise Premium for details.
- For general steps on creating DLP rules, go to Create DLP for Drive rules and custom content detectors .
DLP and Chrome Enterprise Premium integration - Data transfer rule examples
Here are some examples of blocking file downloads based on URL, warning of downloads with multiple email addresses, blocking uploads to a URL category, and blocking downloads based on file size.
Example 1: Block file downloads from drive.google.comThis example shows how to use rule settings to block file downloads. In this example, the download is blocked if it occurs from drive.google.com .
Before you begin, sign in to your super administrator account or a delegated admin account with these privileges:
- Organizational unit administrator privileges.
- Groups administrator privileges.
- View DLP rule and Manage DLP rule privileges. Note that you must enable both View and Manage permissions to have complete access for creating and editing rules. We recommend you create a custom role that has both privileges.
- View Metadata and Attributes privileges (required for the use of the investigation tool only): Security CenterInvestigation ToolRuleView Metadata and Attributes.
Learn more about administrator privileges and creating custom administrator roles .
- Sign in to your Google Admin console .
Sign in using your administrator account (does not end in @gmail.com).
- In the Admin console, go to Menu Security Access and data control Data protection.
- Click Manage Rules. Then click Add ruleNew rule.
- Add the name and description for the rule.
- In the Scopesection, choose Apply to all < domain.name
>or choose to search for and include or exclude organizational units or groups the rule applies to. If there is a conflict between organizational units and groups in terms of inclusion or exclusion, the group takes precedence.
Note that organizational units can contain devices, users or a combination of devices and users. This is important to know, because rules apply only to users for Chrome browsers and only to devices for Chrome OS. Keep this in mind as you create your DLP rules for Chrome Enterprise Premium.
- Click Continue.
- In Apps, for Chrome, select File downloaded.
- Click Continue.
- In the Conditionssection, click Add Conditionand select the following values: Important:Third-party cookies are necessary for Google Drive downloads to increase browser security and to make sure that only you can download your data. Google Drive uses googleusercontent.com
, a Google domain, but one that is regarded as a third party by Drive, to deliver your files and further increase security.
- Content type to scan—URL
- What to scan for—Contains text string
- Contents to match—googleusercontent.com
- Click Continue. In the Actionssection, under Chrome, select Block.
- (Optional) Choose a custom message to show end users.
- Select the Customize Messagecheck mark.
- Enter the message that will be shown to end users. The message can be 300 characters or less. Hyperlinks are allowed but count toward the character limit.
- (Optional) In the Alertingsection:
- Choose a severity level (Low, Medium, or High) for how an event triggered by this rule is reported in the security dashboard.
- Choose whether an event triggered by this rule should also send an alert to the alert center. Also choose whether to email alert notifications to all super administrators or to other recipients.
- (Optional) Choose a custom message to show end users.
- Click Continueto review the rule details.
- Choose a status for the rule:
- Active—Your rule runs immediately.
- Inactive—Your rule exists, but does not run immediately. This gives you time to review the rule and share it with team members before implementing. Activate the rule later by going to Security Access and data control Data protection Manage Rules. Click the Inactivestatus for the rule and select Active. The rule runs after you activate it, and DLP scans for sensitive content.
- Click Create.
Changes can take up to 24 hours but typically happen more quickly. Learn more
This example shows how to use rule settings to trigger a user warning under certain conditions. In this example, the user is warned if they try to download more than 30 email addresses at once.
Before you begin, sign in to your super administrator account or a delegated admin account with these privileges:
- Organizational unit administrator privileges.
- Groups administrator privileges.
- View DLP rule and Manage DLP rule privileges. Note that you must enable both View and Manage permissions to have complete access for creating and editing rules. We recommend you create a custom role that has both privileges.
- View Metadata and Attributes privileges (required for the use of the investigation tool only): Security CenterInvestigation ToolRuleView Metadata and Attributes.
Learn more about administrator privileges and creating custom administrator roles .
- Sign in to your Google Admin console .
Sign in using your administrator account (does not end in @gmail.com).
- In the Admin console, go to Menu Security Access and data control Data protection.
- Click Manage Rules. Then click Add ruleNew rule.
- Add the name and description for the rule.
- In the Scope section, choose Apply to all < domain.name
>or choose to search for and include or exclude organizational units or groups the rule applies to. If there is a conflict between organizational units and groups in terms of inclusion or exclusion, the group takes precedence.
Note that organizational units can contain devices, users or a combination of devices and users. This is important to know, because rules apply only to devices for Chrome browsers and only to users for Chrome OS. Keep this in mind as you create your DLP rules for Chrome Enterprise Premium.
- Click Continue.
- In Apps, for Chrome, select File downloaded.
- Click Continue.
- In the Conditionssection, click Add Conditionand select the following values:
- Content type to scan—All content
- What to scan for—Matches predefined data type
- Data type—Global - Email Address
- Likelihood threshold—Medium
- Minimum unique matches—30
- Minimum match counts—30
- Click Continue. In the Actionssection, under Chrome, select Allow with warning. The user is warned, but can proceed with the action if the rule is violated. If the user chooses to proceed after being warned, this action is recorded in the Rules audit log.
- (Optional) Choose a custom message to show end users.
- Select the Customize Messagecheck mark.
- Enter the message that will be shown to end users. The message can be 300 characters or less. Hyperlinks are allowed but count toward the character limit.
- (Optional) In the Alertingsection:
- Choose a severity level (Low, Medium, or High) for how an event triggered by this rule is reported in the security dashboard.
- Choose whether an event triggered by this rule should also send an alert to the alert center. Also choose whether to email alert notifications to all super administrators or to other recipients.
- (Optional) Choose a custom message to show end users.
- Click Continueto review the rule details.
- Choose a status for the rule:
- Active—Your rule runs immediately.
- Inactive—Your rule exists, but does not run immediately. This gives you time to review the rule and share it with team members before implementing. Activate the rule later by going to Security Access and data control Data protection Manage Rules. Click the Inactivestatus for the rule and select Active. The rule runs after you activate it, and DLP scans for sensitive content.
- Click Create.
Changes can take up to 24 hours but typically happen more quickly. Learn more
This example shows how to use rule settings to block file uploads to certain types of websites. In this example, the upload is blocked if the user tries to upload files to social media sites, such as Facebook.
Before you begin, sign in to your super administrator account or a delegated admin account with these privileges:
- Organizational unit administrator privileges.
- Groups administrator privileges.
- View DLP rule and Manage DLP rule privileges. Note that you must enable both View and Manage permissions to have complete access for creating and editing rules. We recommend you create a custom role that has both privileges.
- View Metadata and Attributes privileges (required for the use of the investigation tool only): Security CenterInvestigation ToolRuleView Metadata and Attributes.
Learn more about administrator privileges and creating custom administrator roles .
- Sign in to your Google Admin console .
Sign in using your administrator account (does not end in @gmail.com).
- In the Admin console, go to Menu Security Access and data control Data protection.
- Click Manage Rules. Then click Add ruleNew rule.
- Add the name and description for the rule.
- In the Scopesection, choose Apply to all < domain.name
>or choose to search for and include or exclude organizational units or groups the rule applies to. If there is a conflict between organizational units and groups in terms of inclusion or exclusion, the group takes precedence.
Note that organizational units can contain devices, users or a combination of devices and users. This is important to know, because rules apply only to devices for Chrome browsers and only to users for the Chrome operating system. Keep this in mind as you create your DLP rules for Chrome Enterprise Premium.
- Click Continue.
- In Apps, for Chrome, select File uploaded.
Note:For the File uploadedand Content pastedtriggers, the blocking behavior depends on the Delay file uploadsetting specified in Set Chrome Enterprise connector policies for Chrome Enterprise Premium . If the Delay file uploadsetting is set to Allow immediate upload,the file will upload during the scan. To prevent users from uploading files or content during a scan, set the Delay file uploadsetting to Delay upload until analysis is complete.
- Click Continue.
- In the Conditionssection, click Add Conditionand select the following values:
- Content type to scan—URL category
- Select category—Online CommunitiesSocial Networks
- Click Continue. In the Actions section, under Chrome, select Block.
- (Optional) Choose a custom message to show end users.
- Select the Customize Messagecheck mark.
- Enter the message that will be shown to end users. The message can be 300 characters or less. Hyperlinks are allowed but count toward the character limit.
- (Optional) In the Alertingsection:
- Choose a severity level (Low, Medium, or High) for how an event triggered by this rule is reported in the security dashboard.
- Choose whether an event triggered by this rule should also send an alert to the alert center. Also choose whether to email alert notifications to all super administrators or to other recipients.
- (Optional) Choose a custom message to show end users.
- Click Continueto review the rule details.
- Choose a status for the rule:
- Active—Your rule runs immediately.
- Inactive—Your rule exists, but does not run immediately. This gives you time to review the rule and share it with team members before implementing. Activate the rule later by going to Security Access and data control Data protection Manage Rules. Click the Inactivestatus for the rule and select Active. The rule runs after you activate it, and DLP scans for sensitive content.
- Click Create.
Changes can take up to 24 hours but typically happen more quickly. Learn more
This example shows how to use rule settings to block file downloads based on file type and size. In this example, the download is blocked if the user tries to download image files larger than 10 kB.
Before you begin, sign in to your super administrator account or a delegated admin account with these privileges:
- Organizational unit administrator privileges.
- Groups administrator privileges.
- View DLP rule and Manage DLP rule privileges. Note that you must enable both View and Manage permissions to have complete access for creating and editing rules. We recommend you create a custom role that has both privileges.
- View Metadata and Attributes privileges (required for the use of the investigation tool only): Security CenterInvestigation ToolRuleView Metadata and Attributes.
Learn more about administrator privileges and creating custom administrator roles .
- Sign in to your Google Admin console .
Sign in using your administrator account (does not end in @gmail.com).
- In the Admin console, go to Menu Security Access and data control Data protection.
- Click Manage Rules. Then click Add ruleNew rule.
- Add the name and description for the rule.
- In the Scopesection, choose Apply to all < domain.name
>or choose to search for and include or exclude organizational units or groups the rule applies to. If there is a conflict between organizational units and groups in terms of inclusion or exclusion, the group takes precedence.
Note that organizational units can contain devices, users or a combination of devices and users. This is important to know, because rules apply only to devices for Chrome browsers and only to users for the Chrome operating system. Keep this in mind as you create your DLP rules for Chrome Enterprise Premium.
- Click Continue.
- In Apps, for Chrome, select File downloaded.
- Click Continue.
- In the Conditionssection, click Add Conditionand select the following values:
- Content type to scan—File size
- What to scan for—Is greater than
- Enter file size (in bytes)—10000
- Click Add conditionand select the following values:
For information on the MIME types included in each system file category, click here .
- Content type to scan—File type
- What to scan for—Matches system file category
- System file category—Image
- Click Continue. In the Actions section, under Chrome, select Block.
- (Optional) Choose a custom message to show end users.
- Select the Customize Messagecheck mark.
- Enter the message that will be shown to end users. The message can be 300 characters or less. Hyperlinks are allowed but count toward the character limit.
- (Optional) In the Alertingsection:
- Choose a severity level (Low, Medium, or High) for how an event triggered by this rule is reported in the security dashboard.
- Choose whether an event triggered by this rule should also send an alert to the alert center. Also choose whether to email alert notifications to all super administrators or to other recipients.
- (Optional) Choose a custom message to show end users.
- Click Continueto review the rule details.
- Choose a status for the rule:
- Active—Your rule runs immediately.
- Inactive—Your rule exists, but does not run immediately. This gives you time to review the rule and share it with team members before implementing. Activate the rule later by going to Security Access and data control Data protection Manage Rules. Click the Inactivestatus for the rule and select Active. The rule runs after you activate it, and DLP scans for sensitive content.
- Click Create.
Changes can take up to 24 hours but typically happen more quickly. Learn more
DLP and Chrome Enterprise Premium integration - URL navigation rule examples
In these examples, navigation is blocked to websites in a particular URL category and to a custom list of URLs that you create.
Example 1: Warn of Chrome navigations to websites that match the “Games/Gambling” URL categoryThis example shows how to use rule settings to trigger a user warning when a user tries to navigate to a website with gambling content.
Before you begin, sign in to your super administrator account or a delegated admin account with these privileges:
- Organizational unit administrator privileges.
- Groups administrator privileges.
- View DLP rule and Manage DLP rule privileges. Note that you must enable both View and Manage permissions to have complete access for creating and editing rules. We recommend you create a custom role that has both privileges.
- View Metadata and Attributes privileges (required for the use of the investigation tool only): Security CenterInvestigation ToolRuleView Metadata and Attributes.
Learn more about administrator privileges and creating custom administrator roles .
- Sign in to your Google Admin console .
Sign in using your administrator account (does not end in @gmail.com).
- In the Admin console, go to Menu Security Access and data control Data protection.
- Click Manage Rules. Then click Add ruleNew rule.
- Add the name and description for the rule.
- In the Scopesection, choose Apply to all < domain.name
>or choose to search for and include or exclude organizational units or groups the rule applies to. If there is a conflict between organizational units and groups in terms of inclusion or exclusion, the group takes precedence.
Note that organizational units can contain devices, users, or a combination of devices and users. This is important to know, because rules apply only to users for Chrome browsers and only to devices for Chrome OS. Keep this in mind as you create your DLP rules for Chrome Enterprise Premium.
- Click Continue.
- In Apps, for Chrome, select URL visited.
- Click Continue.
- In the Conditionssection, click Add Conditionand select the following values:
- Content type to scan—URL category
- Select category—Games/Gambling
- Click Continue. In the Actionssection, under Chrome, select Allow with warning
. The user is warned, but can choose to proceed with the action that triggers the rule. If the user chooses to proceed, the action is recorded in the Chrome log.
- (Optional) Choose a custom message to show end users.
- Select the Customize Messagecheck mark.
- Enter the message that will be shown to end users. The message can be 300 characters or less. Hyperlinks are allowed but count toward the character limit.
- (Optional) In the Alertingsection:
- Choose a severity level (Low, Medium, or High) for how an event triggered by this rule is reported in the security dashboard.
- Choose whether an event triggered by this rule should also send an alert to the alert center. Also choose whether to email alert notifications to all super administrators or to other recipients.
- (Optional) Choose a custom message to show end users.
- Click Continueto review the rule details.
- Choose a status for the rule:
- Active—Your rule runs immediately.
- Inactive—Your rule exists, but does not run immediately. This gives you time to review the rule and share it with team members before implementing. Activate the rule later by going to Security Access and data control Data protection Manage Rules. Click the Inactivestatus for the rule and select Active. The rule runs after you activate it, and DLP scans for sensitive content.
- Click Create.
Note:If a URL that you're filtering has been visited recently, it's cached for several minutes and may not be successfully filtered by a new (or modified) rule until the cache is cleared of that URL. Please allow approximately 5 minutes before testing out a new or modified rule.
This example shows how to use rule settings to block a user if they try to navigate to an URL that's part of a custom list.
Before you begin, sign in to your super administrator account or a delegated admin account with these privileges:
- Organizational unit administrator privileges.
- Groups administrator privileges.
- View DLP rule and Manage DLP rule privileges. Note that you must enable both View and Manage permissions to have complete access for creating and editing rules. We recommend you create a custom role that has both privileges.
- View Metadata and Attributes privileges (required for the use of the investigation tool only): Security CenterInvestigation ToolRuleView Metadata and Attributes.
Learn more about administrator privileges and creating custom administrator roles .
- Sign in to your Google Admin console .
Sign in using your administrator account (does not end in @gmail.com).
- In the Admin console, go to Menu Security Access and data control Data protection.
- Create a word list custom detector containing a comma-separated list of the URLs you want to block. For example: “example.com,example2.com.” For specific instructions, see Create a custom detector .
- Click Manage Rules. Then click Add ruleNew rule.
- Add the name and description for the rule.
- In the Scopesection, choose Apply to all < domain.name
>or choose to search for and include or exclude organizational units or groups the rule applies to. If there is a conflict between organizational units and groups in terms of inclusion or exclusion, the group takes precedence.
Note that organizational units can contain devices, users or a combination of devices and users. This is important to know, because rules apply only to users for Chrome browsers and only to devices for Chrome OS. Keep this in mind as you create your DLP rules for Chrome Enterprise Premium.
- Click Continue.
- In Apps, for Chrome, select URL visited.
- Click Continue.
- In the Conditionssection, click Add Conditionand select the following values:
- Content type to scan—URL
- What to scan for—Matches words from word list
- Word list name—The name of the word list you created in Step 3.
- Match mode—Match any word
- Minimum total times any word detected—1
- Click Continue. In the Actionssection, under Chrome, select Block.
- (Optional) Choose a custom message to show end users.
- Select the Customize Messagecheck mark.
- Enter the message that will be shown to end users. The message can be 300 characters or less. Hyperlinks are allowed but count toward the character limit.
- (Optional) In the Alertingsection:
- Choose a severity level (Low, Medium, or High) for how an event triggered by this rule is reported in the security dashboard.
- Choose whether an event triggered by this rule should also send an alert to the alert center. Also choose whether to email alert notifications to all super administrators or to other recipients.
- (Optional) Choose a custom message to show end users.
- Click Continueto review the rule details.
- Choose a status for the rule:
- Active—Your rule runs immediately.
- Inactive—Your rule exists, but does not run immediately. This gives you time to review the rule and share it with team members before implementing. Activate the rule later by going to Security Access and data control Data protection Manage Rules. Click the Inactivestatus for the rule and select Active. The rule runs after you activate it, and DLP scans for sensitive content.
- Click Create.
Note:If a URL that you're filtering has been visited recently, it's cached for several minutes and may not be successfully filtered by a new (or modified) rule until the cache is cleared of that URL. Please allow approximately 5 minutes before testing out a new or modified rule.