Gemini Notebook rebrand widens the extraction surface

Google rebranded NotebookLM to Gemini Notebook this week. The tooling didn't change. The user agent did — `Google-NotebookLM` becomes `Google-GeminiNotebook`, with a grace period until August 2026 before the old string stops resolving. If you had firewall rules or `.htaccess` entries hardcoded to the old agent, you've got a few weeks to update them or your block goes dark.

That's the surface-level story. Here's the actual one.

Gemini Notebook is a user-triggered fetcher, which means it does not obey robots.txt. Its Discover Sources feature will scrape up to ten articles for a user's query, generate an AI summary, and produce zero referrals. Its multimodal output can turn your article into an audio podcast or a video explainer, which — if the user chooses to publish it — competes directly against the source material it was built from.

None of this is new behaviour. What's new is that this quietly landed the same week Google's Nick Fox announced that AI features in Search are sending "billions of clicks to websites every week," with no baseline, no methodology, and no way for any individual publisher to verify a single one of those clicks against their own analytics. And the same week a proposed class action was filed accusing Google of training Gemini on millions of books supplied through Google Books, Play Books and Scholar without authorisation.

Three stories. One pattern. Worth naming clearly.

The unfalsifiable traffic claim

Fox posted the "billions of clicks weekly" number on LinkedIn and X. He tagged the daily Search click figure — a number Google has cited before — but did not tag the weekly AI-feature figure the same way. There is no earlier public statement it maps to. There is no denominator. There is no methodology. And critically, there is no click data in the new generative AI performance reports in Search Console that would let any individual publisher check the aggregate against their own logs. Impressions, yes. Country and device breakdowns, yes. Clicks, no.

This is a number designed to sit above the reach of any counter-evidence.

This is a number designed to sit above the reach of any counter-evidence. You cannot audit it. You cannot compare it to your own site. You cannot ask "what fraction of that is my industry." You can only accept it or reject it, and either response is unfalsifiable.

I'm not saying the number is fabricated. I'm saying it's structurally immune to being wrong. There's a difference, and the difference matters.

The extraction infrastructure keeps expanding

Set the traffic claim aside for a moment. Look at what the plumbing is actually doing.

Gemini Notebook's Discover Sources fetches up to ten articles per user query. Because it's user-triggered, it bypasses robots.txt entirely. AI Overviews summarise your content in the SERP. AI Mode now connects to Personal Intelligence signals like Calendar to synthesise personalised answers. Nano Banana image generation means AI Overviews now generate their own visuals rather than pulling from the image results your traffic used to come from.

Every one of these features is a channel through which your content enters a Google product, gets transformed, and reaches a user without necessarily generating a referral. Some of these channels obey robots.txt. Some don't. Some can be blocked at the firewall level. Some can only be blocked with `.htaccess` rules that break silently when a user agent rebrands.

The maintenance burden of "opting out" now falls on the publisher, distributed across a growing list of user-agent strings that change without warning. And even a comprehensive block only addresses the technical fetch — it does nothing about the content Google already ingested via Google Books, Play Books, Scholar, or any of the other channels the publisher lawsuit describes as sitting outside the crawler-controls model entirely.

The controls are a surface. The extraction is structural.

The publisher lawsuit points at the real gap

The class action filed on 10 July by Hachette, Cengage, Elsevier, Scott Turow and S.C.R.I.B.E. is the clearest articulation I've seen of a point the industry has been circling for two years without naming.

The complaint argues that works supplied to Google Books, Play Books and Scholar were provided for specific commercial purposes — search, sales, academic distribution — and that using those same works to train Gemini was not one of those purposes. Google-Extended, the robots.txt token that lets publishers opt out of Gemini training, does not apply to any of these channels because the content wasn't crawled from the open web. It was handed over under a different agreement.

Separately, the lawsuit alleges Google trained on copies of these works that appeared in Common Crawl after being hosted on pirate sites and subscription libraries. That content sits on domains the plaintiffs don't control. No robots.txt file they could publish would touch it.

Google's June policy paper argues that training on public web data is a "transformative, non-expressive use" protected by fair use, and points to Google-Extended as the machine-readable opt-out. The publisher complaint essentially says: fine, but the material we're suing over didn't come through channels Google-Extended governs. So the opt-out you're pointing at doesn't cover the use you're being sued for.

Whether the fair-use defence holds is a legal question no court has ruled on. The structural point is separable and worth stating plainly: the industry has been treating robots.txt tokens and firewall rules as if they're the front door of a consent model. They're not. They're one door in a building with a lot of doors, most of which don't have locks a publisher can operate.

Why the two stories fit together

Take Fox's traffic claim and the extraction infrastructure story side by side.

The traffic claim is unverifiable in the direction that benefits Google. The extraction infrastructure is comprehensive in the direction that costs publishers. If you're a publisher trying to model the net economic effect of AI Search on your business, you have detailed data on impressions, no data on clicks from AI features, no way to independently verify the aggregate traffic claim, and a growing list of user agents you have to actively maintain blocks for if you want to limit extraction — with no assurance that blocking the technical fetch stops the underlying use, because a lot of the underlying use doesn't run through those fetchers.

That's the loop. And it's been built one announcement at a time.

I don't think Google engineered this maliciously. I think it's the emergent shape of a company that operates simultaneously as a search index (which owes something to the sites in it), an AI platform (which needs training data), and a competitor to the publishers whose content it ranks (via Answers, AI Overviews, and now Gemini Notebook's repurposing features). The three roles produce contradictions the company doesn't have a clean way to resolve, so it resolves them one press release at a time and hopes the friction stays below the threshold that produces a lawsuit.

The lawsuit suggests the friction just crossed that threshold.

The honest limits

A few things this argument doesn't cover.

First, the weekly AI clicks figure might be true. I have no way to prove it isn't, which is exactly the problem I'm describing. Google may in fact be driving substantial traffic through AI Overviews and AI Mode citation links. The problem is not that the claim is false, but that the measurement design makes it impossible to verify at the level any individual business actually operates at.

Second, the publisher lawsuit is at the complaint stage. No court has ruled. The internal Google documents quoted in the filing — including the one that allegedly called using Play Books data for AI "highly problematic for Google" with potential fines "$10Bs-$100Bs" — are not public and come only from the plaintiffs' filing. They may be characterised misleadingly or in ways that a full record would soften. We'll see.

Third, blocking Gemini Notebook is not obviously the right decision for every publisher. If Discover Sources actually surfaces your content to researchers who might not have found it otherwise, that could be net positive for brand exposure even without referrals. This is a judgement call, not a universal recommendation.

Fourth, the extraction problem is not unique to Google. ChatGPT, Perplexity, Claude, and every other AI system that has ever cited a source has done a version of the same thing. Singling Google out risks obscuring the industry-wide shift.

What actually to do

Update your firewall and `.htaccess` rules before August 2026 if you were blocking `Google-NotebookLM`. The example rewrite for `Google-GeminiNotebook` is straightforward. Do it now rather than remembering in July next year.

Decide deliberately whether you want to block Gemini Notebook at all. Not as a default. As a considered call about whether Discover Sources appearances are worth anything to you.

Stop treating "billions of clicks weekly" as data. It's a directional statement about a number Google has, at a scale you can't audit. Your own Search Console impressions, your own log files, your own analytics — those remain the only ground truth you have on AI-driven traffic to your specific site.

And accept that the consent model for AI training is broken in ways robots.txt cannot fix. If you're a publisher who cares about how your content is used downstream, the mechanisms you actually need are contractual, legal, and collective — not technical. The lawsuits are a symptom of that gap, not a distraction from it.

The traffic claim will keep getting bigger. The extraction surface will keep expanding. The controls will keep lagging behind both. That's the shape of the next twelve months unless something in the legal picture forces a reset. Plan accordingly.