Public Links: Risks and How to Protect Your Files
Public links to files stored on cloud services can remain active for years, granting access to anyone who has the link—often without any way to track who is using it. Automatic expiration of such links is typically only available with paid plans, so it's important to manually review and disable shared access to sensitive documents to protect confidentiality.
Crius
Longevity of Public Links and Email Display
Public links created for sharing files remain active for years and display the owner's email address to anyone who opens the file via that link. For example, a link created in 2021 may still be active and show the owner's email to every user who accesses the file. At the same time, Google displays such visitors as anonymous animals.
The ability to set an expiration date for a link is only available on paid plans with Google, Microsoft, and Dropbox.
Types of Access to Cloud Files
There are two main types of file access in cloud services:
Access by Name — a list of users with individual permissions, who can be removed via the menu.
Public Link Access — access is determined solely by possession of the link, not by the user's name.
In many cases, public link access is set by default, as it is the fastest way to share a file. Removing a user from the list does not affect the link's functionality — it remains active.
Google distinguishes between these two methods: individual access requires account login, while public link access allows anyone to open the file without authorization, which explains the long lifespan of such links.
User Anonymity via Link
When a file is opened via a public link, user names are not displayed. Google notes that anyone who was not personally invited appears as an anonymous animal (for example, a tapir or meerkat). Names are visible only to those with individual access or those included in a mailing list. With link access, this condition is not met, regardless of how long the file has existed.
Reasons for anonymous users appearing in a document include sharing the file, not being logged into Google, changing the account name, or forwarding the link to others. Once forwarded, the link becomes available to an unlimited number of people, and the view log contains no names, since access is granted without authorization.
Link Expiration — A Paid Feature
Setting a link expiration date is recommended by all providers, but this feature is not available to regular users. Google offers it only for work or school accounts and only for individual access, not for public links. In November 2025, Google added expiration dates for files and folders on shared drives, which are available only in Workspace.
Microsoft limits expiration dates and password protection to Microsoft 365 subscribers. Dropbox provides this feature only on professional and business plans. For free and basic plans, automatic link deactivation is not available — access must be disabled manually.
How to Check and Restrict Access to Your Files
Google does not provide users with a list of all files they have shared via link. Google Drive search filters do not include a filter for public sharing, and search operators do not help.
It is recommended to start by checking folders containing important documents (taxes, contracts, resumes, medical records, personal photos). For each file, open the sharing dialog and set public access to "Restricted." After this, only users from the list will have access, and the link will stop working for everyone else, including those who received it earlier.
You can perform similar actions in OneDrive and Dropbox, where you also need to manually disable outdated links.
Important Limitations
Disabling a link only stops access in the future. It does not revoke files that were previously downloaded — their copies are already on other devices, and it is impossible to know how many exist.
Quick Recommendations:
Check the sharing settings for important files and folders.
Disable public link access for outdated files.
Remember that automatic link expiration is only available on paid plans.
Disabling a link does not remove copies of files that have already been downloaded.
