How can I share a Google Doc with someone that doesn't have a Google Account and let her/him be editor of the document?
You can do that by using the option Anyone with the link instead of Restricted. This is an extremely high-risk way to share a document as it only provides "security through obscurity", (the document is only safe if the address is not known).
It is likely that your new editor has a Google account they can use and the safest approach would be to request it. A less safe approach is one where you send a restricted share link to a recipient whose Google account is unknown.
To be Clear
Regardless if a user has a Google account that is known to you or not, you cannot have document permissions that are restricted based on a user's Google account while also allowing document editing without the need for a Google account. The document is either restricted or not.
Restricted Sharing
The "much less safe approach" to restricted sharing is what you were describing in your question and @doubleunary's answer correctly explained restricted sharing to recipients whose Google account is unknown.
Copy link URL is Generic
I have tried clicking the "Copy link" button and opened the resulting link in a private window
Using the URL from the Copy link button is equivalent to copying the document URL from your browser's address bar.
- The URL is not unique but simply a generic link to the document with
usp=sharing appended.
- In the private window if you log in to an account that has the appropriate privileges, you will get access to the document.
- If you log in to an account that doesn't have permissions, or don't log in to an account at all, you will not get access to the document.
Notify People Option
The Copy link button always contains a generic link to the document rather than anything specific to a particular account/user. For example, you can share to additional Google accounts at different times and the link always remains the same. It is the same link "you" use to access the document with the addition of usp=sharing at the end.
When you share a Google Doc with someone but can't identify their Google account, you can't uncheck the Notify people option. The exception is when Google associates the recipient with you. [See "Identified Edge Case"]
For this reason, the Copy link button can only be used to access a restricted document by Google accounts listed in 'People with access' (PWA).
Send Link to Unknown Account
When you send out a restricted document's sharing link to a recipient whose Google account is unknown, the link in that email is based on the generic document link with an invite code appended, for example, usp=sharing_eil_m&invite=BLd_65rY&ts=71dbs6f3.
That invite code allows the following:
- Anyone with that link can
view the document without needing a Google account. This includes the recipient as well as anyone with whom they share it.
- Anyone with the link can
edit the document if they log into a Google account. This includes the recipient as well as anyone with whom they share it.
- If the document is accessed by a Google account, that account is listed in the PWA section of the document. That is in addition to the entry for the recipient whose Google account is unknown.
- Removing the entry for the recipient whose Google account is unknown from the PWA section will invalidate the link (becomes a generic document link), but will not affect any Google accounts that already have access, even if that access came as a result of the original link.
Security
Sharing a restricted document with a recipient whose Google account is unknown poses significant security risks. Anyone with the link who has a Google account can edit it. The risk can be either:
- avoided, by requesting a user's Google account address in advance, or
- mitigated, by removing that recipient from the PWA section as soon as the intended user has successfully logged in with their Google account.
Identified 'Edge Case'
"when I click it [ Share button ] after entering my own non-Gmail-address, a progress bar is animated for a few seconds and then I am back at my document"
Your comment above describes an unexpected behavior that prompted me to investigate further. You are describing adding a recipient whose Google account is unknown, however instead of being forced to Send a notification email you are able to skip that step by unchecking Notify people and successfully completing the process by clicking Share instead.
I performed additional tests and reproduceD the same behavior when the recipient address is associated with the document owner's account 'in some way'. For example, an address listed on Gmail Settings Accounts and Import page, or an Alternate email for a Google account, etc.
In those cases when Google checks the recipient address it is able to confirm the association and allows skipping the notification.
This kind of (undocumented) behavior is not completely unknown with Google apps. For example, when creating a Gmail Send-as alias using a plus address, Gmail will indicate that it requires email verification, require you to click a button to send the verification, and confirm the email verification has been initiated. However, behind the scenes, Google is able to identify that the email verification is unnecessary, the alias is immediately verified, and the email never arrives.
