The short answer
Before you switch a Google Drive link to Restricted, review three separate doors into the same file: direct access granted to named people, access inherited from a shared folder, and any published copy of the file. Each door can stay open even when another is closed. The audit below walks through all three in order, because restricting a link while an inherited or published route remains open gives a false sense of closure.
This guide covers Google Drive files. It does not cover Google Photos album sharing, which is a different surface with different controls.
Step 1: Map direct access
Open the file and look at its sharing settings. Google Drive distinguishes named people from general link access, including Restricted access.
Google Drive sharing distinguishes named people from general link access, including Restricted access. Source
Write down two lists before changing anything: the named accounts that can open the file, and the current link-access state. Named access and link access are independent. Removing a name from the list does not change the link state, and restricting the link does not remove named people.
A practical habit is to record the file name, the named accounts, the link state, and the date you checked. If someone later asks why they lost access, you have a record of what changed and when.
Step 2: Check inherited access from folders
A file that sits inside a shared folder may be open to everyone the folder is shared with, even if the file’s own sharing panel looks narrow. Folder inheritance can affect file access.
Folder inheritance can affect file access. Source
To review inheritance, work upward. Note every folder that contains the file, then check each folder’s sharing settings. If a parent folder is shared broadly, the file inside it may be reachable through that folder regardless of the file’s own settings. Moving the file out of the folder, or narrowing the folder’s sharing, changes the picture — but do it deliberately, because narrowing a folder affects every file inside it, not just the one you are auditing.
A useful rule: audit the file and its parent folders together. A file-level review that ignores the folder tree is incomplete.
Step 3: Check for published copies
Publishing is a separate action from link sharing. A published file can remain reachable through its published route even after you tighten ordinary sharing. For publicly published files, Google instructs users to stop publishing the file as part of limiting public access.
For publicly published files, Google instructs users to stop publishing the file as part of limiting public access. Source
So the audit question is not only “who has the link?” but also “was this ever published?” If the file was published at any point, include stopping publication in your cleanup, not just a link-setting change.
Decision table: what to change, and in what order
| Finding | What it means | Action to consider | Order |
|---|---|---|---|
| Named people you no longer want to have access | Direct access to specific accounts | Remove the named accounts you have decided should lose access | 1 |
| Link access broader than intended | Anyone with the link may be able to open it | Narrow the link setting, including Restricted where appropriate | 2 |
| File sits in a broadly shared folder | Access may be inherited from the folder | Review and narrow the folder’s sharing, or relocate the file | 3 |
| File was published at some point | A published route may exist alongside sharing | Stop publishing the file as part of limiting public access | 4 |
| None of the above found | No route identified in this audit | Record the check and re-audit after any future sharing change | — |
The order matters for a simple reason: if you restrict the link first and then discover an inherited or published route, you have to reopen the file and repeat the work. Audit all three doors, then close them in a sequence you can explain.
Common mistakes
Treating the link setting as the whole story. Link access is one door. Named access, folder inheritance and publishing are separate. A file can look locked down at the link level while remaining reachable another way.
Auditing the file but not its folders. Folder inheritance can affect file access, so a file-level review that skips the folder tree can miss the widest route.
Forgetting that publishing is its own action. If a file was published, stopping publication belongs in the cleanup. Changing ordinary sharing settings is not the same step.
Removing named access without recording it. Without a written record, you cannot tell later whether a change was intentional or an accident.
Confusing Drive files with Photos albums. Google Photos album sharing has its own controls. Advice written for one surface does not automatically apply to the other.
Assuming a public profile match proves ownership. If your audit turns up a public handle or profile that looks related to you, treat it as a lead to review, not proof that the same person controls the file or account.
Protecting your own footprint
A sharing audit is a snapshot. The durable habit is to review sharing whenever a file’s audience changes — when a project ends, when a collaborator leaves, or when a document moves from a working folder to an archive.
Keep a simple log: file, named accounts, link state, folder inheritance noted, published yes or no, date checked. This is the same discipline that helps when you review older accounts more broadly; our guide to finding forgotten online accounts covers that wider sweep.
Where reviewing known public handles is part of the task — for example, checking whether a username you use appears on public profiles — a username lookup can help you collect leads. TraceSeek checks usernames across 3,000+ platforms and states that its first scan is free, with a scan time of 20-30 seconds. Those are product statements, not independent measurements. A username search is not a complete account inventory, and a public match is a lead, not proof of ownership. TraceSeek does not change platform settings, does not expose private records, and does not substitute for the Drive-side audit described above.
Finally, separate cleanup from closure. Removing a login connection or editing a profile does not establish that stored data was deleted, and an edited or empty profile is not evidence of deletion. Keep a recovery method you control until any closure you intend is actually completed.
Key facts
Google Drive sharing distinguishes named people from general link access, including Restricted access.
Folder inheritance can affect file access, so a file-level review should include the folders that contain it.
For publicly published files, Google instructs users to stop publishing the file as part of limiting public access.
TraceSeek checks usernames across 3,000+ platforms, and its first scan is free according to the product.
A username search is not a complete account inventory, and public username matches are leads rather than proof of ownership.