Is Gmail Wiretapping? Federal Court Considers How Internet Companies Can Read Our Email

2,079 4 Loading

If you had learned in 1980 that the Postal Service was opening your letters (postage: 15 cents) and skimming them for keywords in order to send you more relevant advertising flyers, you would likely have blown a gasket.

And yet, come 2004, you may have been among the flood of users who eagerly signed up for Google’s new email service, Gmail, where all of your missives would be "read" by a computer in order to show you targeted online advertising.

Are the two situations similar? That is what a Northern California federal district judge is trying to determine in a class action lawsuit that alleges that Google essentially wiretapped all Gmail users in violation of the Electronic Communications Privacy Act.

Lucy_H._Koh-edThe judge, Lucy Koh, recently rebuffed Google’s request that the case be dismissed on the grounds that the company scans content in the ordinary course of business, in what one legal analyst called “a serious smackdown ruling for Google.”

“Google’s alleged interceptions are neither instrumental to the provision of email services, nor are they an incidental effect of providing these services," Koh wrote in her decision.

The ruling further rejected Google’s claim that it had obtained users’ permission to scan their emails with its terms of service, finding that the document doesn’t explain in clear language how the company handles email content. With that, the judge kicked a hornet’s nest of controversy about whether long, legalistic privacy policies, which studies have shown few users read, obtain any meaningful consent from users to allow Internet companies package and sell their data to advertisers.

“Google’s failure to be able to point to clear language in its policy (granted that no one actually reads) that highlights its scanning practices is inexplicable. They should have just said: ‘we scan your private communications, including chats and emails, for purposes of targeting and building profiles.’ End of story. Judge Koh’s conclusion that the policy failed to clearly flag this issue for users employs a consumer privacy-friendly mode of interpretation, but seems reasonable,” Venkat Balasubramani wrote on an influential blog on technology law.

But Orin Kerr, a Georgetown law professor who focuses on Internet law and wiretapping, said he thought the judge was asking more than the law demands of Google.

“Mere notice of monitoring is not enough, she concludes, because notice has to be specific as to what Google will do with the information. But I don't think that's right. Under the Wiretap Act, notice of monitoring generally is enough,” he told Singularity Hub.

gmail-logoWhile this particular ruling is unlikely to establish a major precedent, the Northern California district court is often a leader in technology law and privacy advocates hailed its finding as a victory for users, who must increasingly share personal information with an array of Internet companies in order to function in the digital age. Not just letters, but also banking and even dating are done online — and most come with a price of siphoned data.

“The court rightly rejected Google's tortured logic that you have to accept intrusions of privacy if you want to send email. The ruling means federal and state wiretap laws apply to the Internet.  It's a tremendous victory for online privacy. Companies like Google can't simply do whatever they want with our data and emails,” said John Simpson, the privacy project director at Consumer Watchdog, in a news release.

But a key question remains to be answered as the case continues to be fought in court: Does computer scanning constitute the “interception” of communications targeted by wiretapping laws?

Gmail is hardly the only Internet service that employs scanning for one reason or another. All email service providers must sort out which messages are spam, for instance, and, according to Google, that requires scanning. Social networks like Facebook also scan content — and are moving to run it through artificial intelligence networks — to serve up targeted advertising.

In other words, courts will have to wade into the basic question: By replacing the postal workers of yesteryear, what parts of our communications are Internet companies entitled to mine for data about our potential purchasing interests?

Photos: Juergen Faelchle via, U.S. Government, Google via Wikimedia Commons

Cameron Scott

Cameron received degrees in Comparative Literature from Princeton and Cornell universities. He has worked at Mother Jones, SFGate and IDG News Service and been published in California Lawyer and SF Weekly. He lives, predictably, in SF.

Discussion — 4 Responses

  • MalcolmTucker October 8, 2013 on 6:08 pm

    If it isn’t private, don’t call it mail. It doesn’t fit the definition.

    Google should call it something else; functionally speaking, it’s closer to a community bulletin board, like in an office lunchroom.

  • FB-ns October 8, 2013 on 9:46 pm

    We appreciate that Gmail and many such services are free. They are popular and patronized in millions only because of they are free. We also appreciate the fact that nothing can really be freely served. Someone, if not the user, is paying for the services. Instead of sneaking into content what gmail and such free service providers can do is be upfront and ask users to state their preferences. They may provide a broad list and ask teh user to check a few boxes in them to get the service free. The users who want to use the free service must be willing to provide some such profile of preferences to make the service viable for the provider. Such an arrangement can make the operation sustainable.

    What if users lie about preferences? Without surveillance, nothing can be done about it. But then users must also accept that there is actually no ‘free lunch’ and so better understand that it is in their long term interest of enjoying a free service that they need to provide authentic information on their likes and dislikes.

    Users who care too much for their privacy may be provided the option of an a la carte menu of paid services to choose from.

  • João Goulart October 10, 2013 on 2:59 pm

    Since Firefox browser exists and the AdBlock plugin, my gmail have no advertising whatsoever.

  • NobleTruthSeeker October 15, 2013 on 2:20 pm

    As a loyal Google gmail user, since soon after it launched, at first I was happy with gmail — especially compared to hotmail and yahoo email services. But in the years since then, my opinion steadily changed — recently more dramatically — in light of the case in the above article and the related issues that this judge raises, the illegal data scavenging Google did while collecting street view images,… and indirectly because of recent NSA monitoring revelations.

    I value my privacy. I think we need a U.S. Constitutional Amendment regarding protection of privacy. For me, privacy and liberty are related. My parents were European. Europeans value their privacy much more than Americans. The apple has not fallen far from the tree. In my opinion, Google has steadily encroached on my privacy, for inordinate financial gain.

    Recently, Google launched a shocking invasion of my privacy. I am not a lawyer. Here’s my layperson’s explanation. Google has announced a soon-to-be-implemented change in their privacy policy, via which Google informs us users that we have, by default under the new privacy policy, given Google permission to use both our name and contact info in Google ads — without our consent and without compensation.

    Google gives its customers a way to ‘opt-out’ — to decline to have their name and contact info included in Google ads. But the only way to opt out is via google plus.

    My question is: what about Google customers who are not google plus customers? I am a gmail customer but not a google-plus customer. Google is effectively extorting me to become a google plus customer, in order to opt out of Google using my name and contact info in their ads. And in order to become a google plus customer, they require that I give them more information about me. To me, this seems like extortion.

    I hope and pray that someone initiates a class-action lawsuit against Google for this extortive behavior. If someone does, I am in.

    To the lawyers reading this: I am pretty sure that extortion is a criminal issue, a class-action lawsuit is a civil issue, and one cannot mix criminal and civil issues in this way. As I wrote earlier, I am not a lawyer. So please feel free to apply the proper legal frameworks, and suggest how to deal with this outrageous impending new privacy policy via the U.S. legal system. (I presume that this case is on a federal level as it involves interstate commerce). I proposed the class-action aspect because to take on Google in a legal venue (perhaps they should have called themselves Goliath) and have any chance of winning, it seems to me that strength in numbers will be needed.