5 Takeaways From the Google Email Scanning Lawsuit
On Thursday, U.S. District Court Judge Lucy Koh (who also presided over the Apple v. Samsung patent dispute) refused to dismiss a series of class-action lawsuits against Google, which allege that the company's email scanning practices violate wiretapping laws. Google scans the emails of its users for a variety of purposes, including spam control, advertising, data collection and delivering extra features like Priority Inbox.
The plaintiffs are not free Gmail users (who have consented to the scanning via Google's Terms of Service). Instead, they are users of either Google's ad-free paid offerings or of third-party email services which communicate with Gmail users (and thereby have their emails scanned, despite not being a Google customer). The last time a document from this lawsuit hit the Internet, we learned that Google argued that its users had no expectation of privacy.
What did we learn this time?
Email Scanning Is Not Just for Free Customers
Every email sent to a Gmail address is scanned. The scan helps Google to identify and filter out spam email, a helpful industry-standard practice. It's also done for advertising purposes and for gathering demographic data for "big data" models.
And it's not just emails sent to the free @gmail.com addresses, according to the lawsuit. Free users make privacy concessions in exchange for a quality email service. Paid Google Apps users (who have @theirowndomain.com email addresses, or email addresses provided by partnerships with their educational institution or Internet service provider) also have their email scanned for data-gathering purposes. This is where the lawsuit factors in. It alleges that the practice violates wiretapping laws by monitoring others' communications.
Scanning as Part of Service to Customers
To a certain extent, some email scanning is done by all providers. Otherwise, spam filtering would not exist. Google uses scanning for spam, to categorize emails via its "Priority Inbox" feature, and to provide other similar features, such as the recently-implemented "Inbox, Social, Promotional" method of sorting incoming email.
Scanning for Other Purposes
Though the dates in the lawsuit have been redacted, according to the suit, at a certain point, Google started scanning all emails for their own benefit, using two separate processes. One process handles advertising. The other gathers "big data" models for Google's other profit-making enterprises. Prior to the change, these scans were allegedly only done to ad-supported free accounts, but after the change, the "big data" scans are done to all accounts.
No Privacy Expectation for Gmail Users
Last month, word leaked from a court filing in this case that Google had argued there was no expectation of privacy for its Gmail users. It maintained that argument, though Judge Koh didn't buy it. In refusing to dismiss the lawsuit, she held:
"The Court therefore finds that a reasonable Gmail user who read the Privacy Policies would not have necessarily understood that her emails were being intercepted to create user profiles or to provide targeted advertisements. Accordingly, the Court finds that it cannot conclude at this phase that the new policies demonstrate that Gmail user Plaintiffs consented to the interceptions."
"Gmail" users, as mentioned by the court, included both free and Apps accounts.
Nor for Anyone Else
It isn't just Google-serviced email account users who should be worried. Any email sent to or from such an account is scanned. Considering Google is the largest email provider in the world, that's a lot of alleged privacy intrusion. The consolidated lawsuits include proposed classes that would include these non-Google users.
Related Resources:
- In re: Google Inc. Gmail Litigation (District Court Order)
- Google's Gmail Keyword Scanning Might Violate Wiretap Law, Judge Finds (Wired)
- 9th Cir: Google's Wifi Sniffing May Have Violated Wiretap Laws (FindLaw's Technologist)