Create Drive labels for your organization

Supported editions for this feature: Frontline Starter and Frontline Standard; Business Standard and Business Plus; Enterprise Standard and Enterprise Plus; Education Standard and Education Plus; Essentials, Enterprise Essentials, and Enterprise Essentials Plus; G Suite Business. Compare your edition

To apply Drive labels to files, go here instead.

As an administrator, you can create labels for users to apply to files in Drive. You can create up to 150 labels, including one badged label. You create labels in the labels manager in Drive, not your Admin console.

Avoid confidential information in label names, field names, and selection options. Labels can be viewed by any admin in your organization with the Manage Labels privilege. They could also be visible to everyone in your organization if the label's permissions are set that way.

Before you begin:

Step 1. Create a label

On your computer, go to the labels manager at https://drive.google.com/labels.
Requires having the Manage Labels privilege.
Click New label.
To create a standard label:
1. Click a standard label template or click Create New.
2. Enter or update the label name.
3. (Optional) Add a description.
4. Choose whether the label is copied when the file is copied.
5. (Optional) Add a field. A label can contain up to 10 fields. For details, go on to the next section.
To create your one badged label:
1. Choose a badged label
2. Choose to start from an example, or from scratch.
3. Update the title.
4. (Optional) Add a description or a learn more URL that points to your organization’s internal documentation about the label.
5. Choose whether the label is required to be filled out by end users.
6. Customize options, and assign a color.

Step 2. (Optional) Add fields to a standard label

You can add up to 10 fields to labels to allow more granular classification. For example, a Department label could have a field with a list of options such as Finance, Engineering, and Legal.

With the label open in the labels manager (https://drive.google.com/labels), click Add Fields.
Click to set the number of each type of field you want to add. At the right, Drive shows you a preview of the fields. For details about field types, review the table that follows these steps.
Tips:
1. We recommend that you minimize the number of fields in a label to encourage consistent use. Users are more likely to apply labels and edit field values if it's quick and easy.
2. Data-protection rules can use only badged labels or labels with the Options List field type. Other field types aren’t supported.
Click Add fields.
Click a field to configure options, such as the field name, what options are available, the format of a date field, or if multiple selections are allowed.
(Optional) Make the field required by checking Require users to pick an option. Important: Drive highlights labels with required fields to encourage completion, but doesn’t enforce it. Users can still use Drive, Docs, Sheets, and Slides. If users don’t select an option, they see a notification and the required field is highlighted.

If you add an extra field or field option, you can delete them before you publish the label. For the field or field option you want to delete, click MoreDelete.

Review the new fields carefully. After you publish the label, you can’t change the field type. For Options list or Person fields, you can’t change whether users can pick multiple values.

Field types

Field	What users can do	Addtional details
Options list	Pick one or more options from a list	No more than 200 options Optional configuration: Allow multiple selections If multi-select is allowed, users can select no more than 10
Number	Enter a numerical value	Only whole numbers
Date	Pick a calendar date	Date format can be set to Long: Month DD, YYYY, or Short: MM/DD/YY
Text	Enter text in a text box	No more than 100 characters allowed
Person	Pick a person from their Workspace contacts	Optional configuration: Allow multiple sections If multi-select is allowed, users can select no more than 10

Step 3. Set who can view or use a label

By default, everyone in your organization can view and apply labels. Edit label permissions to control who can view, apply, edit field values, and search by the label. For example:

To allow users outside your organization, or groups containing outside users, to view and use labels, add these users and groups under Advanced permissions.
To test a new label, you can set Restricted access at first and give only a test group access to the label. After testing, you can change permissions so everyone can use the label.
If a label contains confidential information, you can set Restricted access so that only users who should have access to that information can view or use the label.

Note:

File permissions still apply. For example, if a user has view-only access to a file, they can only view labels applied to that file, even if they’re allowed to apply and set those labels.
Any user with a Google account can be granted permission to view or apply labels. However, labels can only be applied to items that are owned by users with a license that supports Drive labels or items in shared drives.

To set label permissions:

If it’s not open already, open the labels manager (https://drive.google.com/labels) and click the label.
At the top, click Permissions.
Select the permission level for your organization:
1. Can apply labels and set values–Users can apply, set values, and search for this label on flies they can edit.
2. Can view this label–Users can view and search for the label on files they can view or comment on.
3. Restricted access–Only users and groups you specify can view or apply labels. You can choose the permissions for each user or group in the next step.
(Optional) Add permissions for specific users and groups:
1. Under Advanced permissions, begin entering a user or group account and select the account.
2. Select the permission level for that account.
Click Save.

Step 4. Publish a label

New labels are created in a "draft" state so you can review how your label will appear to users before making it available.

To publish a label:

If it’s not open already, open the labels manager (https://drive.google.com/labels) and click the label.
Review the label and any fields. Important: Field type and the option to allow multiple selections for a field can’t be changed after the label is published.
Click Publish.
Confirm that you want to publish the label by clicking Publish.

Users with permissions to view or use the label now have access. and you can use the label to classify and protect data (described in the next section).

When you edit a label, changes are saved as a draft. To make your edits available to users, you must publish the label again.

Step 5. (Optional) Use labels to classify, protect, and manage data

You can set up policies to automatically apply labels to files. You can also set up data loss prevention (DLP) and Vault retention rules to prevent deletion or sharing based on a file’s labels.

Important:

When you use a label for default classification, AI classification, DLP, or Vault retention rules, the label’s settings are locked in the label manager. This prevents edits to labels that could break business policies.
When you use a label in DLP rules or Vault retention rules, the label can’t be disabled or deleted. Label managers can see that the label is used in a rule in the Rules column of the table of labels. However, they can’t see details of the rule that uses the label unless they have the required admin privileges.

Automatically apply labels to files

There are 3 ways to automatically apply labels: default classification, DLP, and AI classification. They work in different ways, and you can use them in combination depending on the type of labeling you want to do.

Expand all | Collapse all

Method comparison

How default classification labels work

Applies labels to new files and when the ownership of a file changes. Default classification doesn’t retroactively apply labels to existing files unless the file owner changes.
Applies labels based on the file owner’s organizational unit or group. Default classification doesn’t search the file content or metadata for certain conditions.
If users have permission to change a label, they can change it or remove it after it’s automatically applied.
Only labels with an options list field are supported for default classification.
Default classification labels are overwritten by DLP-set labels, even if the data classification value is higher in the options list.

How labels set by DLP rules work

Applies labels to new and existing files.
Applies labels based on conditions such as file type, word matches, and string matches. DLP rules don’t accept organizational unit or group as a condition.
You can’t apply a label with a DLP rule that uses a label as a condition.
You can prevent users from changing the label, even if they have permission to change it. If they change it, DLP will scan the file again immediately and revert to the DLP label configuration.
External users can’t view the version history of files that had a label applied to them by a DLP rule at any point.
DLP rules can apply labels with options list fields, including badged labels.

How AI classification labels work

Applies labels to new and existing files.
Only labels with one options list field with 2–4 values are supported for AI classification.
Applies labels after a training period. During the training period, designated labelers apply a training label to at least 100 files per field option.
AI classification labels are overwritten by DLP-set labels, but overwrite default classification labels.

Label conflict resolution

Label values set by DLP rules take priority over AI classification, and both take priority over default classification.

When 2 or more of the same kind of rules try to apply different label values to the same file, the value that's higher in the label's options list is applied. For example, you might have a label with a field that has 3 options listed in the label manager:

Confidential
Internal
Public

If Rule 1 tries to set the label as Confidential, and Rule 2 tries to set the label as Public for the same file, Confidential (Rule 1) is applied. Make sure that a label's field options are listed in your preferred order of priority before setting up rules.

Set up automatic labeling

To set up Default classification labels, follow the steps in Apply Default classification labels to new files automatically.

To set up DLP rules to automatically apply labels, follow the steps in Apply Drive labels automatically with DLP rules.

Prevent external sharing with label-based data loss protection (DLP) rules

You can define rules that apply only to items with a specific label or field. For example, you can create a DLP rule that scans for credit card numbers and social security numbers in documents. If a match is found, a label, such as Sensitive File, is applied, the field value is set to Confidential, and external sharing is blocked.

Data-protection rules can use badged labels or standard labels with the Options List field type. Other field types aren’t supported.

To set up a DLP rule, follow the steps in Create DLP for Drive rules and custom content detectors.

Retain files by label with Google Vault

You can define retention rules that prevent an item from being deleted, or require that an item be deleted, based on a Drive label and any field values. For examples and to learn more, see Retain Drive files with Vault.

Next steps

Now that you have labels your organization can use:

Teach your users how to apply labels and use them to search for files.
Learn how to edit, disable, delete, and monitor labels.

Was this helpful?

How can we improve it?