How to Set Up Content Compliance Rules in Google Workspace

The short answer#

In the Google Admin console, go to Menu > Apps > Google Workspace > Gmail > Compliance, pick the organizational unit on the left, then hover over Content compliance and click Configure (or Add another if a rule exists). Name the rule, tick the message types, add an expression, choose Modify, Quarantine or Reject, and save twice.

Modify, Quarantine or Reject: what each action does#

Pick the action before you write the expression, because it decides what goes wrong if the expression is too broad. Here is what Google's Admin Help documents for each one.

How to create a content compliance rule#

1. 1

   Open the Compliance settings

   Sign in to admin.google.com as a super admin or an admin with the Gmail Settings administrator privilege. Go to Menu > Apps > Google Workspace > Gmail > Compliance.

2. 2

   Choose the organizational unit

   On the left, select the organization or OU the rule should cover. Rules apply to users in that OU and are inherited by child OUs; a child OU can disable an inherited rule. Leave the top-level organization selected for a domain-wide rule.

3. 3

   Start a content compliance rule

   In the Compliance section, scroll to Content compliance, hover over it and click Configure. If rules already exist, click Edit or Add another. Enter a unique description such as Outbound card numbers to quarantine. That description is how you will recognise the rule later in logs.

4. 4

   Select the email messages to affect

   Tick any of Inbound, Outbound and the two internal options, which Google's help calls internal outbound and internal inbound (console labels can differ slightly). Internal means a verified domain of your organization. A data-loss rule usually needs Outbound only; ticking every box on a broad rule is how internal mail starts bouncing.

5. 5

   Add expressions

   Choose whether ANY or ALL expressions must match, click Add, pick a match type and click Save. You can add up to 10 expressions, and a rule with none has no effect. The types are Simple content match, Advanced content match (a location such as Subject or Body, plus a match type such as Contains text or Matches regex), Metadata match (authentication, source IP, TLS, S/MIME, message size, confidential mode) and Predefined content match.

6. 6

   Choose the action

   Under the expressions, choose Modify message, Reject message or Quarantine message and set its options. For Reject, write a short notice that tells the sender why and who to contact; Gmail adds 550 5.7.1 to the bounce automatically. For Quarantine, pick the quarantine you created first.

7. 7

   Set the account types and any exceptions

   Click Show options. Account types to affect is required: Users is the default, Groups covers mail to or through groups, and Unrecognized/Catch-all covers inbound mail to addresses that don't exist. You can also use address lists to bypass or limit the rule, or an envelope filter to target specific senders or recipients.

8. 8

   Save twice, then test

   Click Add setting (or Save) in the dialog, then Save at the bottom of the Compliance page. Google says changes can take up to 24 hours but usually happen sooner. Send a message that should match, then check it in Email Log Search.

How to quarantine messages with a content compliance rule#

A content compliance rule can only send mail to a quarantine that already exists, so set the quarantine up first. If you skip this step, matches go to the default quarantine.

1. 1

   Create the quarantine

   Go to Menu > Apps > Google Workspace > Gmail > Manage quarantines and click Add Quarantine. Google's setup page says you need to be a super admin for this.

2. 2

   Fill in the quarantine settings

   Give it a name and an optional description. Optionally choose a reviewers group; without one, only super admins and admins with the Access Admin Quarantine privilege can see it. Set the inbound and outbound denial consequences (drop the message silently, or send the default reject message), and decide whether super admins get periodic notifications.

3. 3

   Point the rule at it

   In your content compliance rule, choose Quarantine message and select the new quarantine. Leave Account types to affect on Users: quarantine isn't available for the Groups account type, and messages to or from suspended accounts can't be quarantined.

4. 4

   Review held messages

   From Manage quarantines, click Go to Quarantine to open the dashboard, then release messages for delivery or deny them. Quarantined messages are deleted permanently after 30 days if nobody acts.

Google Workspace predefined content detectors#

Predefined content match uses Google's built-in detectors for common sensitive data, such as credit card numbers, U.S. Social Security numbers and passport numbers, across many U.S. and international data types. Google lists the feature for Enterprise Standard and Plus, Frontline Standard and Plus, and Education Fundamentals, Standard and Plus editions.

Two settings tune it. Minimum number of matches is how many times the data must appear before the action fires, and repeats of the same number don't count twice. Confidence threshold is High (fewer matches, so some sensitive mail can slip through) or Medium (more matches, including some mail that should have been delivered).

A typical first rule: Outbound only, Predefined content match with Credit card number, threshold High, action Quarantine. Google says credit card numbers are detected with high confidence using a pattern and checksum, while weaker formats such as ABA routing numbers are only medium confidence. It also says plainly that predefined matching is not 100% accurate and does not guarantee regulatory compliance.

Content compliance vs objectionable content vs attachment compliance#

All three live under Gmail > Compliance and all three can Modify, Quarantine or Reject. They differ in what they can match.

Why a content compliance rule does not trigger#

Wrong message type. An Outbound rule does not see mail between two people in your domain; that needs the internal outbound and internal inbound options.

Not propagated yet. Changes can take up to 24 hours. Rules that cover many users, or OUs with many children, take longer to update, which is why Google recommends testing in a small OU first.

Wrong OU or account type. The rule only covers the OU you had selected and its children. It also only applies to the account types you ticked, and Users is the default, so mail delivered through a group may need Groups as well.

Regex outside RE2. Google uses RE2 syntax, which has no lookaheads, lookbehinds or backreferences, so patterns copied from PCRE testers can fail. Each regex is limited to 10,000 characters.

Content Gmail can't read. Content filters scan messages and attachments up to 1 MB of text, files over 10 MB aren't converted or scanned, and password-protected files and archives can't be opened. Use an attachment compliance rule for those.

Gmail address patterns. For content filtering, Gmail removes dots and plus signs from usernames during delivery, so leave dots out of patterns that match Gmail addresses.

Where AI Emaily fits#

AI Emaily's inbox rules sort one person's mail after it has been delivered, adding labels, moving threads or handing them to the AI agent. They don't enforce policy for your domain, so they are no substitute for a content compliance rule.