Protecting sensitive business data, intellectual property, and internal documentation in Google Workspace requires controlling how files leave your organization. While assigning users the “Viewer” or “Commenter” role prevents them from modifying or deleting files in a Google Shared Drive, Google Drive permits these users to download, print, and copy file contents by default. Applying Information Rights Management (IRM) controls allows administrators and managers to block local downloads and printing across an entire Shared Drive or on individual sensitive documents.
Quick Answer
To restrict downloads across a Shared Drive, open it on the web as a Manager, click the gear icon, select Shared drive settings, and uncheck “Allow viewers and commenters to download, print, and copy files.” For a single document, open its Share menu, click the gear icon, and uncheck the corresponding restriction box.
What the Download Restriction Setting Controls
When download restrictions are enabled, Google Workspace implements Information Rights Management (IRM) protections across web and desktop interfaces:
User Action Permitted vs. Blocked under IRM:
[Viewer / Commenter Account]
│
├── View file in web browser ──> ALLOWED
├── Add comments (if Commenter) ──> ALLOWED
│
├── File > Download (PDF, DOCX, etc.) ──> BLOCKED (Option grayed out)
├── File > Print ──> BLOCKED (Option grayed out)
├── Edit > Copy (Clipboard text copying) ──> BLOCKED (Selection restricted)
└── Google Drive for Desktop export ──> BLOCKED (Virtual file streaming locked)
The document interface displays a persistent warning banner: “Options to download, print, and copy have been disabled on this file.”
Method 1: Restrict Downloads Across an Entire Shared Drive (Recommended)
Applying restrictions at the Shared Drive root ensures that all existing files and any newly uploaded documents inherit download protection automatically.
Requirements:
- You must hold the Manager role on the Shared Drive. Content Managers and Contributors cannot alter drive-level security policies.
Step-by-Step Configuration:
- Open Google Drive on the web.
- Select Shared drives in the left navigation menu.
- Open the target Shared Drive.
- In the upper-right corner, click the Settings (gear) icon, or click the Shared Drive name at the top and select Shared drive settings.
- Locate the setting: Allow viewers and commenters to download, print, and copy files.
- Uncheck this box.
- Click Apply.
Shared Drive Settings Interface:
[X] Allow people outside [Organization] to access files
[X] Allow people who aren't shared drive members to access files
[ ] Allow viewers and commenters to download, print, and copy files <-- UNCHECK THIS
Every nested subfolder and file within the Shared Drive enforces the restriction immediately. Inherited settings cannot be overridden at the subfolder level; see Fixing Permission Inheritance Issues in Shared Subfolders.
Method 2: Restrict Downloads on an Individual File
If your Shared Drive must allow general downloads, but specific confidential spreadsheets or presentations must remain protected, you can enforce restrictions on individual files.
Step-by-Step Configuration:
- Right-click the file in Google Drive and select Share (or click the blue Share button inside an open document).
- In the upper-right corner of the sharing modal, click the Settings (gear) icon.
- Uncheck the option: Viewers and commenters can see the option to download, print, and copy.
- Click the back arrow and click Done.
Individual File Sharing Settings:
[ ] Editors can change permissions and share
[ ] Viewers and commenters can see the option to download, print, and copy <-- UNCHECK THIS
Technical Scope and Limitations
While this security setting blocks standard file extraction paths, administrators must understand its operational limits:
What It Successfully Blocks:
- The Download, Print, and Make a copy options in Google Docs, Sheets, Slides, and the Drive file previewer.
- Direct clipboard text copying (
Ctrl+C/Cmd+C) within Google Docs and Sheets viewers. - Offline file export through Google Drive for Desktop virtual drives.
- Third-party web extensions attempting direct DOM-based file export.
What It Cannot Prevent:
- Screenshots and Screen Recording: Users can still capture their desktop display using operating system screen-capture utilities or third-party capture software.
- Physical Photography: Users can take a photograph of their monitor using an external camera or smartphone.
- Browser Caching: The document must render visually in the client browser, meaning pixel data is transmitted to the client machine.
Interplay with Organizational Policies
Download restrictions operate alongside other Google Workspace security controls:
- Non-Member Access: If your drive also enforces link sharing blocks, review Why “Prevent non-members from accessing files” is breaking flow.
- External Sharing: To confirm whether documents can be viewed by parties outside your tenant, consult Why Shared Drive External Sharing is Blocked.
- Enterprise Security Audits: Workspace administrators can audit which Shared Drives allow downloads domain-wide via the Admin Console. Follow the audit procedures in How to Audit Permissions via Google Admin Console and review the controls outlined in The Shared Drive Security Audit Checklist for Admins.