Yahoo and Gmail are Reading Your Emails

On October 13 Yahoo! launched Visualizing Yahoo, a website featuring an interactive map that showed off the popularity of its email service. Its most eye-catching feature was the real time visualization of the most used words by its users, analyzing the content of their emails. For the purposes of this publicity stunt Yahoo! promised that it had only read the subject lines of the emails. However, OWNI has discovered that Yahoo! can read all of your mails all of the time.

When questioned about the practice of reading emails, Yahoo! rejected the verb “read” but acknowledged it did take place. Pierre Landy, head of legal affairs for Yahoo! Europe, referred to “automated systems”, programs which “scan and analyze all messages sent and received on a user’s account.” Attachments, subject lines, the text of the emails themselves – everything is up for grabs. No human involvement is required; the analysis is done by computers. Unbeknownst to many, this process of scanning occurs with many free email services.

Gmail is also an avid reader

The other American giant of digital correspondence, Gmail, carries out the same practice. The contents of users’ emails are automatically scanned and analyzed in order to generate “keywords”. The last three lines of the “Advertising and Privacy” section of Gmail’s Terms of Service explains:

Google scans the text of Gmail messages in order to filter spam and detect viruses. The Gmail filtering system also scans for keywords in users’ emails which are then used to match and serve ads. The whole process is automated and involves no humans matching ads to Gmail content.

Yahoo! and Google claim the process is entirely legitimate, as Pierre Landy of Yahoo! Europe explained:

This (process) allows us to block nearly 550 billion spam emails from landing in users’ inboxes each month worldwide, around 1,800 spam mails per user.

If at the same time this analysis identifies the interests of users, this “improves the relevance of the ads” and offers users advertisements tailored to their needs – otherwise known as contextualized advertising.

An indicator of the legality of the practice can be found in the “Visualizing Yahoo!” application. The tab “What am I seeing?”, below the line of keywords, informs us that data from Italy, the United Kingdom, Germany, Spain and France was not used in the visualization.

A potential violation of a fundamental right

This list of five EU countries suggests that the provisions of European law might have been an impediment to the email content analysis, or at least the dissemination of that analysis. This suggestion is supported by the European Data Protection Supervisor. Contacted by OWNI, he believes that “the practice of scanning implies a potential violation of the confidentiality of correspondence”, a fundamental right of the European Charter of Human Rights.

Pierre Landy from Yahoo! Europe assured OWNI that the data collection is legal:

The project was initiated in the United States and there is currently no plans to expand it locally in other countries (…) This explains why the data for France, Spain, Italy, Germany and the UK, if they were indeed collected, are not presented.

A directive adopted in 2002 by the European Parliament does not forbid content analysis, but requires companies to inform the user of the practice. It was adopted in addition to Directive 95/46/EC, a reference text for matters of personal data protection. Internet users should have the opportunity to opt out of the service. Another EU working group established in 2006 legitimized the scanning process – referred to as “filtering” in the legislation – given the massive levels of spamming it helped protect against.

In layman’s terms, this type of analysis is not deemed a concern by the European Court of Justice since:

• it has been deemed necessary.
• it’s automated.
• it’s accepted by the user when they sign up to the email services.

Hence the importance of the “Accept” button when creating a Gmail or Yahoo! Mail account. While it’s impossible to opt out of the scanning, it is possible to disable the contextualized advertising.