Anonymous animal icons in a Google document do not identify specific people and do not by themselves prove an account compromise. They can appear with link-based viewing, unsigned-in users, repeated sessions, or services that inspect a link. Review sharing before drawing a conclusion.
Inspect the access settings
Open Share on the correct file and inspect General access, named people, and groups. A file available to anyone with its link can be opened by people you did not invite individually. Editors may also have permission to share it with others unless that capability is limited.
Check unfamiliar named entries by their address rather than display name alone. Someone may have changed their account name, or a group may explain a broader audience.
Understand why icons can persist
Google notes that anonymous icons can remain briefly after sessions close. A messenger service checking a URL for phishing or malware, or an extension following a link, can also contribute to the display. Do not treat the number of icons as a count of confirmed attackers.
Work or school domain users generally display by name when viewing through the organization’s environment, while unsigned-in external access can appear anonymously when allowed.
Restrict unintended sharing appropriately
If the audience is broader than intended, have an authorized owner or editor correct the relevant sharing settings. Review parent-folder and group access as well as General access. Keep legitimate collaboration needs in mind and verify the intended accounts afterward. If there are separate signs of unauthorized account activity, follow your account-security or organizational incident process. Changing sharing controls future access; it cannot identify anonymous viewers retrospectively or retrieve copies already taken.
References
Reviewed against the linked official product guidance on November 3, 2026. Features, limits, screen labels, and access can vary by account, platform, region, and organization policy.