Google's Gmail, other services let third parties read user emails, report says

Just over a year after promising to no longer scan user emails in Gmail for personalized ads, Google is allowing outside developers to do just that, a new report says.

According to a Wall Street Journal report published Monday, Google continues to allow outside software developers to "scan the inboxes of millions of Gmail users who signed up for email-based services offering shopping price comparisons, automated travel-itinerary planners or other tools."

Vetted app developers that are part of Google's Gmail program are allowed to read these emails to create new services or app features. Normally, the bulk of emails are scanned electronically by computer software, but in some cases human employees are doing the reading.

For example, Return Path, a firm that skims emails for data of interest to marketers, scanned the inboxes of over 2 million people, leaving 8,000 unredacted emails to be read by its employees. Other marketing companies, as well as app makers, also gained access to Gmail emails.

Google is not alone in its practices, as Microsoft and Verizon's Oath Communications also let partners skim user emails. Oath, which formed out of Verizon's acquisition of Yahoo, says access is considered "on a case-by-case basis" and requires explicit consent from users, policies similar to those employed by Microsoft.

The report, based on interviews with more than 25 current and former employees of app developers and data companies, finds that the practice of reviewing email data has become common in the industry.

Google told the Journal that its own employees only read user emails "in very specific cases where you ask us to and give consent, or where we need to for security purposes, such as investigating a bug or abuse," while Google "lets any user revoke access to apps at any point."

In June of 2017, Google announced that later in that year, the company would begin serving ads based on a user's setting, meaning that consumer Gmail accounts would not be used or scanned for any ads personalization.