You must have the Chrome Enterprise Premium add-on for this feature.
You can use Chrome Enterprise Premium with data protection rules to monitor user actions on Chrome browser and on Windows, Mac, Linux, and ChromeOS devices. Using data loss prevention (DLP) with Chrome, you can scan up to 10 MB of text content in a file to automatically detect data that's opened, uploaded, downloaded, pasted, or transferred. Use data protection rules with Chrome Enterprise Premium for control over sensitive information, such as Social Security or credit card numbers.
Before you begin
- Ensure you have the View Chrome DLP rule and Manage Chrome DLP rule privileges.
Set up your Chrome Enterprise connector policies. For the steps, go to Set Chrome Enterprise connector policies for Chrome Enterprise Premium.
If you want to restrict the rule's scope to a user-created group, add all relevant users and browsers to the group. For example, if you want to apply the rule to Chrome browser, add the browser to your target group. For more details, go to Decide on groups for the rule's scope and Managing group-based policies.
If you want to enforce cloud storage, forcibly install the Secure Enterprise Browser extension and verify that your users' setup supports Google Drive or Microsoft OneDrive. For details, go to Enforce cloud storage for Chrome downloads.
Understand triggers
Before defining what content your rule should look for, you specify the trigger that initiates the scanning process. The trigger you select determines the Content type to scan options that are available for your rule.
You can select one of the following triggers:
- File uploaded—A user uploads a file from their device in Chrome browser.
- File downloaded—A user downloads a file to their device.
- Content pasted—A user pastes content into a webpage.
- Content printed—A user prints the content of a webpage.
- URL visited—A user navigates to a URL.
Understand DLP actions
When sensitive content is found, your rule enforces an action. You can choose from the actions listed in the following table.
If you have similar rules with different response actions, the stricter action takes precedence. From most to least restrictive, the action order is Block > Enforce cloud storage > Allow with warning > Audit only. For example, if one rule warns users when a Social Security number (SSN) is found and another rule blocks the user from using SSNs, the block rule is enforced.
| Action (for Chrome browser & ChromeOS) | Description |
|---|---|
| Block | Stops the user from completing the action, such as uploading a file. Optionally, you can add a custom message. The event is logged. |
| Enforce cloud storage (File downloaded trigger only) |
Prevents the file from being saved to the user's device and uploads the file to your organization's cloud storage. You can set the storage location to Google Drive for your organization or OneDrive for your organization. Optionally, you can add a custom message. Supports file sizes up to 150 MB. Larger files remain blocked. For details, go to Enforce cloud storage for Chrome downloads. |
| Allow with warning | Lets the user proceed after a warning message. Optionally, you can add a custom message. The user's choice is logged. |
| Audit only | Lets the user proceed without interruption and logs the event for review. |
For a URL visited trigger with an Allow with warning or Audit only action, you can also:
- Add watermark over page content—Overlay a translucent watermark and Confidential text or a custom message on the webpage.
- Restrict screenshot and screen-share content—Block screenshots and screen-sharing. Content is blacked out in screenshots (Windows, Android, and iOS) or disappears (Mac).
- Mask sensitive text on the page—Protect sensitive information by hiding personal letters and numbers. For details, go to Use data masking to strengthen DLP in Chrome.
Important: For the File uploaded and Content pasted triggers, the blocking behavior depends on your Chrome Enterprise connector policies' Delay file upload and Delay text entry settings. For details, go to Upload content analysis and Bulk text content analysis.
Understand DLP conditions
You can create a data protection rule with no conditions. In this case, the rule applies to all relevant content, depending on the trigger that you select.
Or, you can specify conditions in the data protection rule that define what content or activity to scan for. You can use predefined data types or create your own custom content detectors. You can also combine multiple conditions using AND, OR, or NOT operators.
For details, go to the following articles:
- About predefined content detectors
- About custom content detectors
- Data protection rules with nested condition operators
The Content type to scan options available change based on which trigger is selected to initiate the scan, such as File uploaded, File downloaded, Content pasted, Content printed, URL visited, and so on.
| Content type to scan | What to scan for | Details & use |
|---|---|---|
| All content |
Matches predefined data type Contains text string Contains word Matches regular expression Matches words from word list |
Scans all content for sensitive information that matches one of the following:
|
| Body |
Matches predefined data type Contains text string Contains word Matches regular expression Matches words from word list |
Scans the main text content (body) of a webpage or file. |
| File size |
Equals Is greater than Is less than |
Sets a file size threshold (in bytes) to trigger the rule based on your comparison. |
| File type |
Matches common MIME type Matches custom MIME type Matches system file category |
Filters what to scan by predefined file categories, such as Image or Executable or by a specific MIME type. Learn more about MIME types by file category. |
| Source Chrome context | Specific attributes related to Chrome browser | Scans for internal Chrome attributes to define the browser's environment or state. The rule applies if the context is one of the following values: Incognito, Clipboard, or Other Profile. |
| Source URL |
Contains text string Matches words from word list Matches regular expression |
Scans the URL where the content originated for specific text, words from a custom list, or patterns. |
| Source URL category |
Select category |
Works with triggers, such as Content pasted, to check if a source URL belongs to a predefined category, such as Social Networks or News. |
| Title |
Matches predefined data type Contains text string Contains word Ends with Matches regular expression Matches words from word list Starts with |
Scans the title of the webpage or document involved in the action. |
| URL |
Contains text string Ends with Matches URL from URL list Matches regular expression Matches words from word list Starts with |
Scans the URL involved in the action. This scan includes the URLs of content loaded inside any embedded iframes. |
| URL category | Select category | Checks if the URL involved in the action belongs to a predefined category, such as Social Networks, Games, or Gambling. This scan includes the URLs of content loaded inside any embedded iframes. |
| Web app signed-in account |
Matches domain name Matches email address Matches email address regex |
Scans the user account actively signed in to the Google web app, such as Gmail or Drive, at the time of the trigger. This condition applies to rules triggered by Paste, URL visited, File Download, File Upload, and Print events. Currently supported only for personal and managed Google Accounts. |
| Source web app signed-in account |
Matches domain name Matches email address Matches email address regex |
Scans the user account signed in to the Google web app that contains the source of the content (the app where the user copied the content). This condition only applies to rules triggered by the Content pasted event. Currently supported only for personal and managed Google Accounts. |
Note: The URL visited trigger doesn't scan URLs or their corresponding categories within embedded iframes.
Choose a region for your data
You can store your DLP and malware scans in a specific region, for example, the United States or Europe. You can choose a region to achieve data residency, which is a requirement for many compliance agreements. For details, go to Choose a geographic region for your data .
Create a rule
After you decide what you want your rule to do, you create the rule. For details, go to Create data protection rules.
Common use cases
The following table provides examples of how to combine a trigger (what the user does), conditions (what is checked), and a specific action (the enforcement) to define your DLP policy. To use this table, you must:
- Select a trigger.
- Map condition values to the corresponding options.
- Select an action.
| Use case | User event | Conditions | Action |
| Block files from being downloaded from Google Drive | File downloaded |
Content type: URL* Match: Contains text string Value: drive.google.com |
Block |
| Warn the user if a downloaded file contains more than 30 email addresses | File downloaded |
Content type: All content Match: Matches predefined data type Settings: Data Type: Global - Email Address, Medium likelihood, Minimum unique matches 30 |
Allow with warning |
| Block file uploads to social media sites | File upload |
Content type: URL category Match: Select category Value: Social Networks |
Block |
| Block the download of image files larger than 10 kilobytes | File downloaded |
Condition 1: File size Match: Is greater than Value: 10,000 bytes AND Condition 2: File type Match: Matches system file category Value: Image |
Block |
| Log instances where U.S. Social Security numbers are transferred in files in ChromeOS | File transfer |
Content type: All content Match: Matches predefined data type Settings: Data Type: United States - Social Security Number, Likelihood Medium, Minimum unique matches 1, Minimum match count 1 |
Audit only |
| Block users from pasting content copied from Gmail (mail.google.com) | Content pasted |
Content type: Source URL* Match: Contains text string Value: mail.google.com |
Block |
| Apply a watermark or restrict screenshots when users visit designated sensitive websites | URL visited |
Content type: URL* or URL category Match: Select appropriate match Value: The specific sensitive URL or category |
Allow with warning / Audit only (with Add watermark and/or Restrict screenshot selected) |
| Block file uploads to a personal Google Drive account | File uploaded |
Condition 1: Match: Contains text string Value: drive.google.com AND Condition 2: Match: Does not match domain name Value: your-organization-domain-name.com |
Block |
| Save downloads to Google Drive when they contain U.S. Social Security Numbers | File downloaded |
Content type: All content Match: Matches predefined data type Settings: Data Type: United States - Social Security Number, Likelihood Medium, Minimum unique matches 1, Minimum match count 1 |
Enforce cloud storage Storage location: Google Drive for your organization |
* If a URL you're filtering was recently visited, it's cached for several minutes and might not be successfully filtered by a new (or modified) rule until the cache is cleared. Wait approximately 5 minutes before testing a new or modified rule.
Review, monitor & investigate alerts
After you create data protection rules, you can review user actions, such as uploading and downloading or copying and pasting data in Chrome browser. You can then:
- View reports in the security dashboard. Reports related to Chrome
Enterprise Premium include:
- Chrome threat protection summary report
- Chrome data protection summary report
- Chrome high risk users report
- Chrome high risk domains report
- For details, go to Use the security dashboard.
- Investigate alerts of data-sharing incidents using the security investigation tool. For details, go to About the security investigation tool.
- View details of incidents in Rule log events and Chrome log events.
- Investigate rule violations to determine if they're real incidents or false positives. For details, go to View content that triggers DLP rules.
Related topics
- Set up timeout deadlines for DLP & malware scans
- Use custom URL lists for DLP in Chrome
- Combine DLP rules with Context-Aware Access conditions
- Protect Chrome users with Chrome Enterprise Premium
Google, Google Workspace, and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.