You've just shared a Google Drive link with a colleague, a client, or a friend, and then a thought hits you a few minutes later: who else can open this link, and can I stop them if I change my mind? It's a fair question, and the answer depends entirely on one setting, which is the permission level attached to that link, because a link shared with specific people behaves very differently from a link that anyone on the internet can open.

This matters because Google Drive's sharing model is built for convenience, and convenience often wins when you're in a hurry, which is exactly how "anyone with the link" becomes the default and how files end up exposed to people who were never supposed to see them. So here is a practical breakdown of how link permissions actually work, what an expiry date can and cannot do, and how to close the door after you've opened it.

What a Shared Link Actually Is

A shared link is a URL that points to a file or folder in Google Drive, and the link itself does not contain your password or your account credentials, so sharing it does not hand over your Google account. What it does is tell Google Drive who is allowed to open the item behind that URL, and that permission is what determines whether the link is a private invitation or a public doorway.

When you open the Share dialog, Google Drive gives you a choice under "General access," and that choice is the single most important setting on the screen. You can choose "Restricted," which means only the people you explicitly add can open the link, or you can choose "Anyone with the link," which means anyone who has the URL can open it, and the difference between those two options is the difference between a locked door and an open one.

The Three Link Permissions, Explained

Google Drive offers three core access levels, and each one determines what a person can actually do once they open the link, so it's worth knowing exactly what you're granting before you click Send.

• Viewer. A viewer can open the file and read it, but they cannot change it, and they cannot add comments, so this is the safest level for sharing something that only needs to be read.
• Commenter. A commenter can read the file and leave comments, which is useful for review cycles, but they still cannot edit the content itself.
• Editor. An editor can make changes, and this is the level that carries the most risk, because an editor can alter your document, and in some configurations they can also change who else has access.

There's also a subtler point that catches people out, which is that viewers and commenters can often download, print, and copy the file unless the owner turns those options off in the advanced sharing settings. So even a "read-only" link can still result in a copy of your document leaving your control, because the person on the other end can simply download it.

The "Anyone with the Link" Problem

The "Anyone with the link" setting is where most of the real-world risk lives, because it does exactly what it says, which means no sign-in is required, no approval is needed, and the only thing standing between a stranger and your file is the URL itself.

That URL can be forwarded, pasted into a group chat, posted in a public Slack channel, or forgotten on a Trello card, and Google Drive does not notify you when a link is reshared, and it does not tell you who opened it. There's also a less obvious risk, which is that publicly shared files can sometimes end up indexed by search engines if the link becomes discoverable on the public web, which turns a link you meant for one person into something a stranger can find through Google.

Practical Example: 

A contractor stores staging environment credentials in a Google Doc and sets the doc to "anyone with the link can view," and months later someone searching for a related hostname finds the document through autocomplete, which means the credentials were exposed for an unknown period of time without anyone being alerted.

Practical Scenario: 

A team shares a design folder with "anyone with the link" so a client can review it, and the client forwards the link to a colleague who forwards it to a vendor, and by the end of the week the folder has been opened by people nobody on the team has ever met.

The Real Limit of Expiry Dates

Expiration dates are a genuinely useful control, but they come with a limitation that most people don't realize until it matters, which is that expiry applies to per-person permissions, not to "anyone with the link" access.

This means you can set an expiration date on a share that is tied to a specific person's email address, and when that date passes, that person automatically loses access, which is exactly the behavior you want for a contractor or a temporary collaborator. But if you've shared something with "anyone with the link," there is no expiry option for that general access setting, so the link can keep working for as long as the file exists and the setting stays in place.

Practical Example :

You share a folder with a contractor by adding their email address and setting an expiration date of 30 days, and after 30 days their access is revoked automatically, which is a clean, reliable outcome because the permission was tied to a person.

Practical Scenario : 

You share a file with "anyone with the link" so a client can open it without signing in, and you assume you can set an expiry on it, but the option isn't available for that access type, so the link stays live until you manually change the setting, and in the meantime it can be forwarded indefinitely.

What Happens When a Permission Expires

The way expiry behaves also depends on where the file lives, which is a detail that matters for anyone managing shared folders.

If the file is in a Shared Drive, you can set an expiration date on files for any role, whether that's viewer, commenter, or editor, and for folders you can set an expiration specifically on the viewer role, which is useful for removing read-only access after a review phase ends. If the file is in "My Drive," Google added a softer behavior, so when a temporary editor permission expires, the person may drop down to whatever access they already have on the parent folder rather than losing access entirely, which prevents accidental lockouts but also means the permission change is less absolute than it sounds.

How to Actually Lock a Link Down

If your goal is to make sure a shared link doesn't stay open longer than it should, the practical steps are straightforward, and they don't require any technical expertise.

• Change "Anyone with the link" to "Restricted" when the share is meant for specific people. This is the single most effective fix, because it closes the general access route entirely.
• Use per-person sharing with an expiration date for temporary collaborators. Add the person's email address, choose the right role, and set an expiry so access is revoked automatically.
• Turn off download, print, and copy for viewers and commenters if you don't want copies leaving your control. This is found in the advanced sharing settings for the file.
• Audit your shared files periodically. Look for anything set to "anyone with the link" and decide whether it still needs to be that open, because old shares are easy to forget.
• Check folder inheritance. If a parent folder is set to public, files inside it can inherit that access, so a file you thought was private can become public through the folder it lives in.

Real Two Scenarios

Scenario 1: The Link That Never Expired

The Setup

A marketing team shares a campaign strategy folder with "anyone with the link" so external agencies can review it without needing Google accounts, and the team assumes the share will be cleaned up after the project ends.

The Attack

Nobody remembers to change the setting, the link gets forwarded between agencies, and months later the folder is still open, and a competitor's researcher stumbles onto it through a shared bookmark.

The Result

The strategy documents are exposed, and the team can't tell who accessed them or when, because Google Drive doesn't provide that visibility for link shares, and the cleanup never happened because nobody owned it.

The Lesson

"Anyone with the link" has no expiry, so the only reliable fix is to change the setting when the share is no longer needed, or to avoid using that setting for anything sensitive in the first place.

Scenario 2: The Expiring Collaborator Share

The Setup

A finance team needs an external auditor to review a spreadsheet for two weeks, so they add the auditor's email address as a viewer and set an expiration date of 14 days, and the auditor gets access the same day.

The Attack

No attack occurs, because the share is scoped to one person with one role and a hard end date, and when the 14 days pass, the auditor's access is revoked automatically.

The Result

The review finishes on time, the access disappears without anyone needing to remember, and the team has a clean audit trail showing exactly who had access and for how long.

The Lesson

Per-person shares with expiry are the most controllable way to collaborate with outsiders, because the permission is tied to an identity and it ends on a schedule rather than relying on someone remembering to clean up.

How to Spot Risky Link Sharing

• Files set to "Anyone with the link" that don't need to be public. This is the most common source of accidental exposure.
• Links shared in chat or email without an expiry. If the share is per-person but open-ended, it will outlive the project.
• Folders with inherited public access. A private file inside a public folder is still public, so check the parent.
• Download and copy left enabled on sensitive viewers. A read-only link that allows downloads is still a copy you can't control.
• Old shares nobody owns. If no one remembers why a file is shared, it probably shouldn't be.

Quick Reference: Google Drive Link Security Checklist

The Bottom Line

A shared link doesn't give someone your Google account, but it does give them whatever access the link is configured to allow, and that access can range from a private invitation to a public doorway, depending entirely on the setting you chose. "Anyone with the link" is the risky option because it requires no sign-in, has no expiry, and can be forwarded without notice, while per-person shares with an expiration date are the most controllable option for working with outsiders.

So the next time you share something, check the General access setting before you send, prefer per-person sharing with an expiry for temporary collaborators, and audit your old shares periodically, because the link you sent six months ago is probably still live, and you're the only one who can close it.

FAQ

Can someone access my Google Drive through a shared link?

They can access the specific file or folder the link points to, but only to the extent the link's permission allows, and they cannot browse the rest of your Drive or log into your account through that link.

Is it true that “anyone with the link” needs to have a Google account?

Not necessarily, because anyone who has the URL can open the file even without signing in, when the option is set to “Anyone with the link,” which makes it more dangerous than per-person sharing.

Can I set an expiration date on a link shared with "anyone"?

No, expiration dates apply to per-person permissions, not to "anyone with the link" general access, so the only way to close that route is to change the setting back to "Restricted" or delete the share.

What happens when a Google Drive share expires?

For a per-person share, the recipient automatically loses the access you granted when the date passes, though in "My Drive" they may drop down to whatever access they already have on the parent folder rather than losing everything.

Can someone forward my Google Drive link to someone else?

Yes, a link can be forwarded, and Google Drive does not notify you when that happens, which is why "anyone with the link" should be treated as potentially public from the moment you enable it.

Can search engines index my shared Google Drive files?

Publicly shared files can sometimes be indexed if the link becomes discoverable on the public web, which is one more reason to avoid "anyone with the link" for anything that isn't meant to be public.

How do I stop people from downloading my shared file?

Open the file's Share dialog, go to the settings gear, and turn off the option that lets viewers and commenters download, print, and copy, which reduces but does not eliminate the risk of copies being made.

Source: Official Google Documentation