Google has rolled out two significant security improvements to Workspace this week — one that protects against account takeover via stolen session cookies, and another that prevents sensitive data from being inadvertently shared through calendar events.

• Device Bound Session Credentials (DBSC) — Now Generally Available: Active by default from 3 June 2026 for Chrome on Windows. DBSC ties your login session to the specific device you authenticated from. If an attacker steals your browser session cookie — a common technique used by malware and phishing tools — they cannot use it from a different machine. No action is required from end users; IT admins should confirm it is active in your Admin console.
• Data Loss Prevention for Google Calendar — Now Generally Available: Admins can now create DLP rules that scan calendar event titles, descriptions, and locations for sensitive content such as credit card numbers or government identification numbers. When a policy match is detected, admins can choose to audit the event, warn the user, or block the event from being saved entirely. This is particularly useful for organisations with compliance requirements around how sensitive information is shared in meeting invites.
• Who is affected: All Google Workspace business customers. DBSC applies to users on Chrome for Windows. Calendar DLP is available to admins across all Workspace editions that include DLP functionality.
• What to do: Workspace admins should review the Calendar DLP settings in the Google Admin console and consider implementing policies appropriate to your industry. Confirm that DBSC is active, particularly for teams with elevated access to sensitive systems.

These are positive security improvements that require minimal configuration but can meaningfully reduce risk for Workspace environments, particularly for businesses in regulated industries.

Source: Google Workspace Updates Blog